I am trying to demo an exploit and here is the scenario:
A service is running with SYSTEM privileges where the executable it is running (binpath) can be modified by any user. The exploit consists of replacing the target binary with a malicious one so that on startup of the machine the malicious executable is launched with SYSTEM privileges instead of the original one. The problem here however, is that the service binary can't be replaced as it is being used by the service in question while the computer is running. Typically only admins can stop services so stopping the service before switching the binaries would make the demo kind of moot.
My question is:
Is there a way to replace the binary (which I have full permissions to) without permissions to stop the service?