Insecure service permissions (Windows)

A Windows service starts by running a specific binary (BINARY_PATH_NAME) under a given account (SERVICE_START_NAME), often LocalSystem. If a regular user has write access to that binary or to the folder containing it, they can replace it with their own code; when the service starts again (reboot or sc start), it will run that code under the service account, usually SYSTEM.

You enumerate it with sc qc (config) and icacls/accesschk (permissions):

sc qc <service>
icacls "C:\path\to\service.exe"
icacls "C:\path\to"
accesschk.exe /accepteula -uwcqv "Users" *          :: services modifiable by Users
accesschk.exe /accepteula -quvw "C:\path\to\service.exe"   :: binary permissions

# PowerUp automates all three flaws (binary, folder and service config)
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"
Get-ModifiableServiceFile; Get-ModifiableService

Two cases matter:

• Writable binary (icacls shows (F) or (M)/(W) for Users/Authenticated Users): overwrite the .exe directly.
• Writable folder even if the binary isn't: rename the original and drop a malicious one with the same name.

To avoid leaving the service down, the malicious binary usually launches the payload (a reverse shell or net user ... /add) and then relaunches the renamed original executable. After dropping the file you force a reboot if the service is AUTO_START and can't be restarted directly:

move C:\svc\svc.exe C:\svc\svc.orig.exe
move payload.exe C:\svc\svc.exe
shutdown /r /t 0

Nuances. This differs from the unquoted service path (there the issue is a space-containing path without quotes) and from weak service permissions on the service itself (SERVICE_CHANGE_CONFIG, which lets you change the binary with sc config). Here the flaw is the NTFS permissions of the file or folder.

How to detect it. The host signature is the overwrite of the service binary: Sysmon Event ID 11 (FileCreate) or object auditing 4663 (write access) on a service .exe by a non-admin account, followed by the service restart (7036/7035) and a 4688/Sysmon 1 where that binary, running as SYSTEM, spawns cmd/powershell or net user ... /add. If instead of the file the service config is changed, you get 7040 (start-type change) or 4697/7045 (service installed/modified). At rest, accesschk -uwcqv Users * returning services with SERVICE_ALL_ACCESS or binaries with (M)/(W) for Users is the preceding indicator.

Defence. Folders and binaries of services running as SYSTEM must be writable only by administrators; never grant Modify/Write to Users over C:\Program Files or over service directories. Audit writes to service binaries and config changes with Sysmon. Related to ACL abuse with icacls and a service with a group-writable folder.