Privilege escalation

De Banane Atomic
Aller à la navigationAller à la recherche

With a writable Windows service

If the executable of a Windows service is writable by non-admin users, you can replace it with another executable that will launch a command prompt in the system account.

Program.cs

  1. Replace the executable of the Windows service by the compiled application.
  2. A command prompt will be launched when the Windows service starts.
Dos.svg
whoami
REM nt authority\system