net stop <service_name> net start <service_name> The service runs as (by default for manually installed services), executing malware.exe with the highest privileges. Step 5 – Persistence & Lateral Movement The malware can now add a new admin user, dump credentials from LSASS, or implant a backdoor—all while masquerading as a legitimate service. Real-World Attack Scenario Imagine a corporate environment using a legacy monitoring agent installed via NSSM 2.24 on hundreds of Windows Server 2012 R2 machines. A contractor with limited access discovers the NSSM service LegacyMonitor has its binary stored in C:\ProgramData\Monitor\ . The ProgramData folder, by default, grants BUILTIN\Users write access.
But the real prize is . On many systems, authenticated users can enumerate and modify NSSM-managed services due to overly permissive service security descriptors. Technical Deep Dive: How the Escalation Works Step 1 – Enumeration An attacker with low-privileged access (e.g., a standard user on a compromised workstation or via a reverse shell) first enumerates all services: nssm-2.24 privilege escalation
Introduction NSSM (Non-Sucking Service Manager) has long been a staple for system administrators and developers on the Windows platform. Versions like 2.24 , released in the mid-2010s, are celebrated for their ability to turn any executable into a Windows service quickly. However, beneath its utilitarian veneer lies a dangerous attack vector: privilege escalation . A contractor with limited access discovers the NSSM
accesschk.exe -uwcqv "Authenticated Users" <service_name> accesschk.exe -uwcqv "BUILTIN\Users" <service_name> If the attacker has write access to the service configuration (often misconfigured in legacy systems), they can proceed. The attacker changes the binPath to point to a malicious executable they control: On many systems, authenticated users can enumerate and
sc qc <service_name> If the BINARY_PATH_NAME points to an NSSM executable (e.g., C:\nssm-2.24\win32\nssm.exe ), the service is a candidate. Using accesschk.exe from Sysinternals or PowerShell, the attacker checks if they have SERVICE_CHANGE_CONFIG or WRITE_DAC rights: