1

I am trying to demo an exploit and here is the scenario:

A service is running with SYSTEM privileges where the executable it is running (binpath) can be modified by any user. The exploit consists of replacing the target binary with a malicious one so that on startup of the machine the malicious executable is launched with SYSTEM privileges instead of the original one. The problem here however, is that the service binary can't be replaced as it is being used by the service in question while the computer is running. Typically only admins can stop services so stopping the service before switching the binaries would make the demo kind of moot.

My question is:

Is there a way to replace the binary (which I have full permissions to) without permissions to stop the service?

  • Create a script that launches both the legit binary and your own binary then reboot? – schroeder Sep 17 '18 at 16:00
  • Inject a malicious process into the binary? – schroeder Sep 17 '18 at 16:01
  • @schroeder Not sure what you mean by launching both of them. And how would I go about injecting the malicious process? Ideally I would simply replace the existing binary with the malicious one – trallgorm Sep 17 '18 at 16:05
  • legit.bat launches the legit.exe binary and also your own binary. That way the legit script runs as usual, but you also run your other binary. As for injecting, metasploit's meterpreter gives you multiple options if you are not familiar with the process. – schroeder Sep 17 '18 at 16:08
  • @schroeder I'm still not sure how the script applies. Where would the legit.bat be run from? The idea is that as the service will run the malicious executable, it will run it with higher privileges. I don't actually need the original binary to be executed. Are there any ways you can think of just replacing the binary in question? – trallgorm Sep 17 '18 at 16:14
2

Generally, binaries can be renamed while they are executing, unless the process (or some other process) explicitly prevents this. Simply rename the binary and then drop a malicious one in with the old name. When the computer reboots (or the service restarts), it'll run your version.

Another approach is DLL planting. Find a DLL that the app uses (ideally not a system DLL, and definitely not one that is loaded only as a resource file) that is not being loaded by explicit path, and replace it with a malicious version. You can either use the renaming trick mentioned above, or simply take a DLL that is normally loaded from another location (such as System32) and put your malicious copy in the service's install directory (or working directory, if different that's writable).


Actually weaponizing this is left as an exercise to the reader, of course, but I think it's important to post this answer because a lot of people don't realize that executing a Windows binary does NOT inherently prevent the binary from being renamed.

0

From an infosec perspective, yes, there are several ways of accomplishing this depending on the level of access to the server. You cannot trust binaries to remain static once installed, and so HIPS/HIDS or whitelisting are important layers of defense.

Incorrect permissions on the executable already allow anyone to overwrite it if the service halts normally or is made to crash.

Since this site discourages questions/answers which facilitate inappropriate usage, I won't go into detail on other methods. This question is an excellent example of why defense in depth and insider threat are basic security principles.

0

Well do you need to overwrite the file in the first place?

  • Does the binary path have any spaces & is unquoted?
  • Does the service allow you to perform dll hijacking?

Can you crash the service, operating system or perform a system reset so the above options are even viable?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.