Cau\u00adtion<\/strong>: This com\u00admand works via RDP<\/span> in an inter\u00adac\u00adtive ses\u00adsion, but NOT<\/span> in a non-priv\u00adi\u00adleged bind\/winrm shell.<\/p>\n\n\n\n All ser\u00advices:<\/p>\n\n\n\n All run\u00adning services:<\/p>\n\n\n\n All autostart pro\u00adgrams<\/em> (not ser\u00advices, but it fits here anyway\u2026):<\/p>\n\n\n\n Check if a ser\u00advice will start auto\u00admat\u00adi\u00adcal\u00adly on boot time:<\/p>\n\n\n\n The fol\u00adlow\u00ading lists all ser\u00advice names and the bina\u00adries for them. After this, check inter\u00adest\u00ading files with cacls \/ icacls.<\/p>\n\n\n\n Show all path of exe\u00adcute\u00adable files which are used by Win\u00addows services<\/p>\n\n\n\n Show process\u00ades:<\/p>\n\n\n\n Kill process\u00ades by PID<\/span> or name:<\/p>\n\n\n\n Note<\/strong>: Check file per\u00admis\u00adsions for each ser\u00advice file \u2014 if we can write to one, we can change the file or inject own code with shelter!<\/p>\n\n\n\n If you need to restart a service:<\/p>\n\n\n\n There is a bina\u00adry write\u00adable you can exe\u00adcute? See bina\u00adry hijacking.<\/a><\/p>\n\n\n\n Does the tar\u00adget run a (priv\u00adi\u00adleged) soft\u00adware you can install on an own VM<\/span>? Try to inves\u00adti\u00adgate with Proc\u00admon, if it loads DLLs you could over\u00adwrite. See the DLL<\/span> injec\u00adtion article.<\/a><\/p>\n\n\n\nPS> Get-CimInstance -ClassName win32_service | Select Name,State,PathName<\/pre>\n\n\n\n
PS> Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
PS> Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'} | Where-Object { -not ($_.PathName -like '*indows*') }<\/pre>\n\n\n\nGet-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List<\/pre>\n\n\n\n
PS> Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like 'mysq*'} \/\/ This is not grep! Add * here!<\/pre>\n\n\n\nIn Windows command line<\/h3>\n\n\n\n
schtasks \/query \/fo LIST \/v
net start
tasklist \/v
tasklist \/SVC \/\/ Shows all running processes only
accesschk.exe \/accepteula -ucqv $servicename \/\/ Show which users have permissions for a serviceaccesschk64.exe \/accepteula -wvucq $currentUserName $serviceexe<\/code> \/\/ Shows the permissions you have<\/pre>\n\n\n\nsc query state= all | findstr \"SERVICE_NAME:\" >> Servicenames.txt
FOR \/F \"tokens=2 delims= \" %i in (Servicenames.txt) DO @echo %i >> services.txt
FOR \/F %i in (services.txt) DO @sc qc %i | findstr \"BINARY_PATH_NAME\" >> path.txt<\/pre>\n\n\n\nsc query state= all | findstr \"SERVICE_NAME:\" >> a & FOR \/F \"tokens=2 delims= \" %i in (a) DO @echo %i >> b & FOR \/F %i in (b) DO @(@echo %i & @echo --------- & @sc qc %i | findstr \"BINARY_PATH_NAME\" & @echo.) & del a 2>nul & del b 2>nul<\/pre>\n\n\n\n
With escalation scripts<\/h3>\n\n\n\n
\n
winPEASany.exe quiet servicesinfo<\/code> and see if there are inter\u00adest\u00ading services.<\/li>\n\n\n\nHandling services with sc<\/h3>\n\n\n\n
sc query state= all \/\/ shows all services
sc qc $service \/\/ shows one service
sc start $service
sc stop $service
sc config $service start= demand \/\/ only needed to manually activate a service which is disabled. Remember to disable it afterwards again.<\/pre>\n\n\n\nHandling services with wmic<\/h3>\n\n\n\n
wmic \/node:$victim \/user:$user \/password:$password process list brief<\/pre>\n\n\n\n
wmic \/node:$victim \/user:$user \/password:$password process where processid=\"$pid\" delete\nwmic \/node:$victim \/user:$user \/password:$password process where name=\"$name\" delete<\/pre>\n\n\n\n
Exploitation<\/h2>\n\n\n\n
PS> Restart-Service BetaService<\/pre>\n\n\n\n
Binary hijacking<\/h3>\n\n\n\n
DLL<\/span> injection + hijacking<\/h3>\n\n\n\n
Unquoted Service Paths<\/h3>\n\n\n\n