Many enterprises run service on production servers as SYSTEM without considering the risk that might arise from this configuration, what is the biggest risk associated with it? and how would attackers exploit this kind of configuration?


Worst case scenario

When an attacker exploits an application to run arbitrary code then this code will run under the context (and thus the privileges) of the exploited application. So if the service running as SYSTEM has a listening port and is exploitable from the internet or network then the attacker can do pretty much anything on the computer, including adding new administrator accounts or dumping passwords and certificates using mimikatz

Privilege escalation

If the application isn't listening on a port, or isn't exploitable using that port, then the service might still allow the attacker to elevate privileges. this requires the attacker to have some lower privileged access first, like through exploiting a lower privileged application or user.

To attack the service this way the attacker usually needs to look for misconfigurations in the service itself, rather than the application. He can try to edit the binary (exe file) of the application and then restart the service, try and edit the path of the service (thus editing what exe is executed when the service boots up). Or he can try DLL hijacking just to name a few.

If one of these attacks succeed, he can run code in context of the application and thus as SYSTEM. To minimize this risk, run applications on the least amount of required privileges possible, if the service doesn't need to run a SYSTEM then doing so poses an unnecessary security risk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.