Windows services

Overview

Services are SCM-managed background programs, each with a binary path, start type, and a service account (often SYSTEM). Misconfigured paths/permissions/binaries make services the top Windows local-privesc target.

Why it matters

Most Windows local privilege escalation runs through services: unquoted paths, weak reconfigure rights, or writable binaries let a normal user run code as SYSTEM. Service enumeration (sc qc, accesschk) is a standard early step.

Core concepts

SCM. Manages services (Windows' daemons). Service account. LocalSystem/LocalService/NetworkService/user — SYSTEM is the prize. Misconfig classes. Unquoted path, weak permissions, writable binary. Enumeration. sc query/qc, services.msc.

Lesson

A Windows service is a background program managed by the Service Control Manager (SCM) — the Windows equivalent of a Linux daemon/systemd unit.

What defines a service

Each service has: a binary path (the executable + arguments), a start type (automatic/manual/disabled), and a service account it runs as.

Service accounts

Services run as LocalSystem (= SYSTEM, all-powerful), LocalService/NetworkService (limited), or a specific user. A service running as SYSTEM is the prize: control its code and you are SYSTEM.

Why services are a privesc goldmine

Common misconfigurations (detailed in the privesc track):

• Unquoted service path with spaces → Windows may execute an attacker-placed binary earlier in the path.
• Weak service permissions → a normal user can reconfigure the service binary (sc config), then restart it.
• Writable service binary (NTFS ACL issue) → replace the exe.

Tools

sc query / sc qc <name> show service config; services.msc is the GUI. Enumerating services, their accounts, and their binary ACLs is core Windows enumeration.

Summary

Windows services run background code under an account that's frequently SYSTEM; their path, permissions, and binary ACLs are the most common local-escalation routes, so enumerating them is essential.