However, it doesn't show exactly what the permissions are, so we need to dig a little deeper. This PowerShell script will print which service rights we have.
We can see that all Authenticated Users have ChangeConfig, Start and Stop privileges over this service. We can abuse these weak permissions by changing the binary path of the service - so instead of it running C:\Program Files\Vulnerable Services\Service 2.exe, we can have it run something like C:\Temp\payload.exe.
First - validate that the current path is "C:\Program Files\Vulnerable Services\Service 2.exe" (also note that the path is quoted).
\
Next, upload a service binary payload and reconfigure the binary path on the vulnerable service.
\
The space after binPath= is intentional as this is how it's documented in sc's help documentation.
\
Validate that the path has indeed been updated.
\
Because the service is currently running (as can be seen with sc query VulnService2), we must stop and then start the service to execute our malicious binary.
\
To restore the previous binary path:
The additional set of escaped quotes is necessary to ensure that the path remains fully quoted, otherwise you could introduce a new unquoted service path vulnerability.