search
LinkedInGitHub

Regsvc ACL

hashtag
Overview

After enumeration, if it's discovered that we have full permissions to a registry key, we can compile a malicious executable written in C and get it to run a command for us as system

hashtag
Escalation via Regsvc

View permissions on registry key

powershell -exec bypass -NoP
Get-Acl -Path hklm:\System\CurrentControlSet\services\regsvc | fl

Change the command to get a reverse shell and compile the executable

Add the executable to the service

  • /v - What is the value name

  • ImagePath - Is a registry key that contains the path of the drivers image file

    • So if you place the file here and run the service it will run the executable

  • /t - type being REG_EXPAND_SZ which is running a string value

  • /d - Data being C:\temp\x.exe ; data you want to use

  • /f - No prompts for confirmation just execute

Start the service and pop a shell

PreviousAlwaysInstallElevatedNextwhoami /priv