Posts on: Acls

---

Windows services are one of the most common privilege escalation paths because they often run as LocalSystem while pointing to files, service objects, or registry keys that normal users can influence. Three separate misconfigurations can grant SYSTEM, and they are often confused: Attack surface You control Exploitation Primary check Writable binary The .exe on disk Replace the file, restart the service icacls on the binary Modifiable service DACL The service object Change binPath=, restart the service accesschk -uwcqv Writable registry key The service’s registry entry Edit ImagePath, restart the service accesschk -kvuqsw on HKLM\...\Services Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory, only permission to reconfigure the service itself.