Replace a privileged service binary or consumed file

Needs: Effective file/parent replacement rights, compatible artifact, file-lock handling and available privileged restart/boot trigger

Writable service binary or replaceable parent

REM Writable service binary or replaceable parent
sc.exe qc SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"
copy /Y "C:\Path\To\service.exe" "C:\Windows\Temp\service.exe.backup"
copy /Y "C:\Windows\Temp\PAYLOAD_EXE" "C:\Path\To\service.exe"
sc.exe stop SERVICE
sc.exe start SERVICE

Verify → Prove actual selected file, trigger and resulting token; retain the recovery copy privately.

If it fails → File locking, read-only paths, wrong architecture or unavailable restart can block this specific route. More detail ↓

If → then

A new Windows session or claimed administrator/SYSTEM transition → Establish Windows token, host and process context
Needs: A functioning command channel and the actual effective token/process context
A downloaded/generated artifact exists but does not run → Match an artifact to its executable consumer and runtime
Needs: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format
A privileged object appears writable or an ACL tool reports a useful right → Prove effective file, registry and service-object permissions
Needs: Correct trustee/token, object type and effective rights including parents and deny entries

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Replace a privileged service binary or consumed file

USE WHEN: A privileged service consumes a file whose bytes or parent replacement are controllable
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: Verified execution of the replacement under the service identity

Recognize the clue

From service inventory follow the exact executable/script path and inspect both its own ACL and its parent's replacement rights.

sc.exe qc SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"

SYNTHETIC EXAMPLE OUTPUT

SERVICE_START_NAME: LocalSystem
BINARY_PATH_NAME: C:\APP\service.exe
C:\APP: DOMAIN\GROUP:(M)

Means: A higher-identity service consumes a potentially replaceable file in a modifiable directory.

Confirm: Use sc qc to locate the real binary and account, then icacls on that file and its parent. Confirm replacement rights and an available privileged service start/restart; a writable unrelated file is insufficient.

After validation: The replaced compatible file is actually started under the service identity: select this route.
Ruled out in this context: The modified directory is unrelated to the configured executable: reject this consumer assumption.
Still inconclusive: A writable path without restart/boot evidence leaves execution unproved.

Troubleshooting: File locking, read-only paths, wrong architecture or unavailable restart can block this specific route.

Writable service binary or replaceable parent

A parent with delete/create rights can permit replacement even when the file is not directly writable. Confirm architecture, file locks, recovery copy and exact trigger.

Why it works

Filesystem control can redirect service execution without permission to change the service object. The actual consumed path and service account must be confirmed.

Worked example · hypothetical

Observation: a LocalSystem service binary is replaceable. Test: preserve it, verify the restart right and trigger the documented replacement. Illustrative output: the controlled effect runs as SYSTEM. Interpretation: verify the token and restore the original artifact.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗