Nssm-2.24 Privilege Escalation ^new^ -

# Malicious configuration file path malicious_config_file = os.path.join(config_dir, ' malicious_config.txt')

NSSM 2.24 is not inherently a rootkit or exploit. However, its —running user-specified binaries as SYSTEM without integrity checks—makes it an ideal primitive for privilege escalation in misconfigured environments.

: Avoid running services as LocalSystem unless absolutely necessary. Use a dedicated Managed Service Account (MSA) with restricted permissions.

The NSSM-2.24 privilege escalation vulnerability is caused by a improper handling of service configuration files. Specifically, the vulnerability arises from the way NSSM handles the nssm.exe executable and its associated configuration files. When a user attempts to start or stop a service using NSSM, the service manager executes the nssm.exe executable with elevated privileges. However, due to a flaw in the configuration file handling, an attacker can manipulate the configuration files to execute arbitrary code with elevated privileges. nssm-2.24 privilege escalation

An attacker can exploit this vulnerability by creating a malicious configuration file with elevated privileges. When a user with limited privileges attempts to start a service using NSSM, the service manager will execute the malicious configuration file, allowing the attacker to gain elevated privileges.

This leads to code execution in the context of the service's account, typically reaching NT AUTHORITY\SYSTEM . Weak Registry Permissions

Using icacls or PowerShell:

# Set the configuration file path in the NSSM service configuration nssm_command = f'nssm set service_name config malicious_config_file' os.system(nssm_command)

If the directory containing nssm.exe or the binary it launches has "Modify" or "Full Control" permissions for the Users group, a low-privileged user can replace the legitimate executable with a malicious one.

For privilege escalation to work, the following conditions must be met: Use a dedicated Managed Service Account (MSA) with

When NSSM starts the service, it will execute the attacker's path instead of the intended application. Mitigation and Defense

Disclaimer: This article is for educational and defensive purposes. Unauthorized privilege escalation is illegal under computer fraud laws in most jurisdictions.

An attacker can place a malicious file named Program.exe in C:\ . When the service attempts to start, Windows may execute C:\Program.exe before the intended service. When a user attempts to start or stop