Privilege escalation – weak service file
During a penetration testing phase, you may encounter a standard user where you don't have full privilege to access or modify a filesystem due to the user access control (UAC) and, each time you try to elevate your privilege, you will be prompted to the window that asks you to enter the administrator password. In this section, we will discuss one of the types of doing a privilege escalation attack, where you technically jump from a standard user to an administrator or system privilege. These types of attacks, which we will discuss, are called privilege escalation via service file permission weakness. The system will be vulnerable if the location of a service executable file is modifiable by the standard user. Then, it can be overwritten by another malicious executable. We may use this capability to gain system privilege(s) by booting our own executable in place of the service executable. Once the service is started after restarting the system, the...
