Binary Paths
Overview
Services sometimes have executables attached to them. If we have the right permissions to the service then we can change the binary path (executable file) to a malicious one.
Exploitation using PowerUp
Run PowerUp on machine
. .\PowerUp.ps1
Invoke-AllChecks
Change the binary path
Start service
Exploitation via Accesschk64
Check for services with write permissions
Query the service
Changing the binary path is the same as the last method
Last updated
Was this helpful?