Ethical Hacking Academy · Lesson

Service Misconfigurations

Unquoted paths, weak perms.

Service Misconfigurations is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Services as a Vector

Windows services often run as SYSTEM and start automatically. A misconfigured service — weak permissions, a hijackable binary path, or a writable executable — lets you run code as SYSTEM.

Unquoted Service Paths

If a service's binary path contains spaces and is not quoted, Windows tries each space-delimited prefix with .exe. For C:\Program Files\My App\svc.exe it tries C:\Program.exe, then C:\Program Files\My.exe, etc.

wmic service get Name,PathName,StartName | findstr /i /v "\""

Exploiting Unquoted Paths

If you can write to one of those intermediate directories (e.g. C:\Program Files\ in a misconfigured box), drop a malicious My.exe there. When the SYSTEM service starts, Windows runs your binary.

icacls "C:\Program Files"
# need write access to the unquoted segment

Weak Service Permissions

If your user has SERVICE_CHANGE_CONFIG on a SYSTEM service, you can repoint its binary path to your payload and restart it. Check service ACLs with AccessChk.

accesschk.exe -uwcqv "Users" *
# look for SERVICE_ALL_ACCESS / SERVICE_CHANGE_CONFIG

Modifying the Service Binary Path

With config rights, change binPath to a command that adds you to Administrators, then restart the service so it runs as SYSTEM.

sc config vulnsvc binPath= "cmd /c net localgroup administrators user /add"
sc stop vulnsvc & sc start vulnsvc

Weak File Permissions on the Binary

Even without config rights, if the service's executable file itself is writable by your user, overwrite it with your payload and restart the service (or wait for a reboot).

icacls "C:\Program Files\VulnApp\service.exe"
# (M) or (F) for Users/Everyone = writable

DLL Hijacking

If a SYSTEM service loads a DLL by name from a writable directory in its search order, place a malicious DLL there. The service loads your code on next start. This is DLL hijacking / search-order abuse.

Registry-Based Service Abuse

Service config lives under HKLM\SYSTEM\CurrentControlSet\Services. Write access to a service's registry key lets you alter its ImagePath — another route to controlling what runs as SYSTEM.

reg query "HKLM\SYSTEM\CurrentControlSet\Services\vulnsvc"

Restarting Services

Escalation often depends on triggering a restart. If you cannot stop/start the service directly, you may need a reboot — or target an auto-restart service. Check whether your account can restart it.

sc qc vulnsvc        # query config
sc query vulnsvc      # current state

Using PowerUp to Find These

PowerUp's checks (Get-ServiceUnquoted, Get-ModifiableServiceFile, Get-ModifiableService) automate discovery of all these service misconfigurations and even generate exploitation commands.

powershell -ep bypass
Import-Module .\PowerUp.ps1
Invoke-AllChecks

Defenses and Ethics

Defenders should quote all service paths, restrict service and binary ACLs, run services with least privilege, and protect service registry keys. Exploit these only on authorized systems.

Quick Check

Test your service-misconfig knowledge.

Recap

You learned service-based escalation:

Unquoted service paths let you plant a binary in an earlier path segment
Weak service permissions let you repoint binPath
Writable service binaries and DLL hijacking also work
PowerUp automates discovery and exploitation

Next: token impersonation.

Frequently asked questions

Is the “Service Misconfigurations” lesson free?

Yes — the full text of “Service Misconfigurations” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Service Misconfigurations”?

Unquoted paths, weak perms. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Service Misconfigurations” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy