Posts on: Services

---

Windows services are one of the most common privilege escalation paths because they often run as LocalSystem while pointing to files, service objects, or registry keys that normal users can influence. Three separate misconfigurations can grant SYSTEM, and they are often confused: Attack surface You control Exploitation Primary check Writable binary The .exe on disk Replace the file, restart the service icacls on the binary Modifiable service DACL The service object Change binPath=, restart the service accesschk -uwcqv Writable registry key The service’s registry entry Edit ImagePath, restart the service accesschk -kvuqsw on HKLM\...\Services Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory, only permission to reconfigure the service itself.

Scheduled and supervised execution is the most consistent privilege-escalation surface on Linux. Root runs something on a timer, on boot, on log rotation, or on a process event — and if you can influence what it runs, where it runs it, or how it resolves it, you inherit root. This file covers every scheduler you will encounter: cron, anacron, at, systemd timers and units, transient systemd-run jobs, and logrotate. 1. Cron Job Abuse Scheduled jobs, typically used for administrative tasks — backups, cleanup, reporting. The crontab command creates a cron file that the cron daemon runs on the specified schedule.

Windows services are the highest-yield privilege escalation surface on the platform because they run as LocalSystem while referencing four separate objects that a low-privileged user may be able to influence: Attack surface You control Exploitation Primary check Service binary The .exe on disk Replace the file, restart the service icacls on the binary Loaded DLL A DLL path the service searches Plant a DLL with the expected name Procmon NAME NOT FOUND Service DACL The service object sc config binPath=, restart accesschk -uwcqv Service registry key ImagePath / ServiceDll Edit the value, restart accesschk -kvuqsw Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory. A writable registry key is a third, separate problem. Enumerate all four.

DNS translates domain names to IP addresses and is the foundation of every other enumeration path — subdomain discovery feeds HTTP probing, zone transfers expose the entire internal namespace, and misconfigured records enable takeover and cache poisoning. It typically runs on port 53 UDP, with TCP/53 used for large responses, DNSSEC, and zone transfers. 2025–2026 context: zone transfers are thirty years old and still misconfigured in 18% of enterprise DNS setups, and a 2022 survey found 12% of organisations had at least one nameserver allowing unauthorised AXFR. At the same time, DNS rebinding has become a first-class vulnerability class — Microsoft Playwright MCP Server (CVE-2025-9611), Glances (CVE-2026-32632), Rojo (RUSTSEC-2026-0279), and multiple Rust MCP servers were all rebindable in 2026. Cache poisoning returned with BIND 9 CVE-2025-40778 (CVSS 8.6) and the weak-PRNG CVE-2025-40780.

FTP is a clear-text protocol for file transfer that typically runs on TCP port 21 (control channel). There are different commands and status codes in FTP, and not all commands are consistently implemented on the server — which is precisely what makes enumeration valuable: the banner, the supported command set, and the write permissions often determine the entire attack path. 2025–2026 context: FTP is legacy infrastructure that remains in production because appliances, backup systems, and industrial equipment still depend on it. The current CVE feed is dominated by two classes: FTP server implementations with unauthenticated or authenticated RCE (Wing FTP Server, CrushFTP, ProFTPD, the Windows FTP Service), and FTP client-side flaws where a malicious server attacks the connecting client (Wget PASV, GVfs PASV). The client-side class is frequently overlooked — and it turns a seemingly harmless “connect to the target FTP” into a pivot into the attacker’s own network.

The Internet Message Access Protocol (IMAP) works on TCP port 143 (unencrypted) and 993 (implicit TLS). Unlike POP3, IMAP allows online management of email directly on the server and supports folder structures — which makes a compromised IMAP account a live-intelligence source, not just a static mailbox dump. 2025–2026 context: IMAP is no longer just a mail-retrieval protocol — it is the persistence mechanism of choice for advanced adversaries. The 2026 Zimbra espionage campaigns (Laundry Bear, Ulej) used IMAP as a covert, MFA-bypassing persistence channel: after gaining webmail access, they enabled IMAP on the mailbox and created application-specific passwords, allowing continued mailbox access outside the browser session and outside MFA. On the server side, Dovecot, Cyrus, and Courier produced a steady stream of authentication-bypass, memory-disclosure, and command-injection CVEs throughout 2025–2026.

Introduction IPMI is a set of standardized specifications for hardware-based host management systems used for system management and monitoring IPMI provides sysadmins with the ability to manage and monitor systems even if they are powered off or in an unresponsive state using a direct network connection to the system’s hardware without requiring any form of authentication IPMI can also be used for remote upgrades to systems without requiring physical access to the target host. It can also be used for querying inventory information, reviewing hardware logs, and alerting using SNMP Source: HacktheBox Academy IPMI Commands Command Description msf6 auxiliary(scanner/ipmi/ipmi_version) IPMI version detection. msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) Dump IPMI hashes.

Microsoft SQL Server (MSSQL) is Microsoft’s SQL-based relational database management system. The default port is TCP 1433. In Active Directory environments, MSSQL is consistently one of the highest-value targets: it is almost always over-privileged, frequently under-monitored, and the service account running it is typically a domain account with broad rights. 2025–2026 context: the attack surface has expanded in three directions. SQL Server 2025’s AI features (sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL) provide native HTTPS exfiltration and C2 channels that never touch xp_cmdshell. Microsoft-signed stored procedures contain SQL injection that re-enables a disabled xp_cmdshell. And Machine Learning Services (sp_execute_external_script) is now a documented xp_cmdshell alternative because EDR has become very good at catching the classic path.