When Services Run Out
Services are the richest source of “a privileged thing you can change”, but they’re not the only one. This note covers the last hijackable component (scheduled tasks), and then what you do when nothing at all is misconfigured: exploits.
Scheduled Tasks
Windows runs background jobs on a schedule through the Task Scheduler: cleanups, update checks, maintenance. Every task is two pieces:
- a trigger (the condition that fires it: a time, at logon, at startup, on an event)
- an action (the program it runs when the trigger fires)
And it runs that action as some user.
If that user is privileged, and you can overwrite the program it runs, you’ve found another way up. This is exactly service binary hijacking, with a task as the host instead of a service.
The Three Questions
You evaluate any task by asking three things:
| Question | Why it decides the attack |
|---|---|
| Who does it run as? | If it runs as your user, hijacking it gains nothing. If it runs as SYSTEM or an admin, that’s a path up. |
| When does it trigger? | A trigger that already fired and won’t recur (or only fires after your engagement ends) is useless to you. You want one that runs again. |
| What does it run? | If you can overwrite the program it executes, you win. |
When all three line up, a privileged user, a recurring trigger, and a writable action, you replace the binary and wait for the clock.
Finding and Hijacking a Task
Enumerate every task and its details:
Read the Run As User, Task To Run, and Next Run Time fields. The classic find is a task that runs a binary out of a normal user’s own folder (so it’s writable) but as an administrator, on a short recurring trigger.
Confirm you can write to the binary, then swap it for your payload:
Wait for the trigger to fire, and your binary runs with the task’s privileges. (Restore the original binary afterward.)
When Nothing’s Misconfigured: Exploits
Everything so far depended on someone making a mistake, a loose permission, a missing quote, a writable task. When the box is configured cleanly, you fall back on actual vulnerabilities. There are three kinds.
Application Vulnerabilities
A piece of installed software runs with administrative rights and has an exploitable bug. Exploit it, gain code execution in its context, and you’ve escalated. This is just “find a public exploit for the software you enumerated”, the situational awareness from Enumerating Windows feeding directly into a known-exploit search.
Kernel Exploits
A bug in the Windows kernel itself. The payoff is the best possible: instant SYSTEM, in a single shot.
The workflow is mechanical:
- Enumerate the exact OS build and installed patches
systeminfo Get-CimInstance -Class win32_quickfixengineering # installed security updates - Spot a missing patch that corresponds to a kernel privilege-escalation CVE
- Find the public exploit for that CVE
- Run it, and
whoamireturnsnt authority\system
Kernel exploits are a loaded gun: a failed one can crash the machine (BSOD). In a real engagement you only use exploits with source available (so you can see they’re not malicious), you test on a clone first, and you respect the rules of engagement. The power is real, so is the risk.
The Third Kind: Abusing a Privilege
There’s a final, and in practice the most common, way to escalate, one that needs no misconfiguration and no exploit at all. Sometimes your own process already holds a privilege that can be turned directly into SYSTEM.
You saw it back in enumeration: whoami /priv. A line like SeImpersonatePrivilege in that output is often a one-step win, especially when you’ve landed via a web shell.
That technique, token impersonation and the Potato attacks, is its own beast, and it’s Abusing Token Privileges.
Practice Boxes
- Blue - TryHackMe. The classic kernel exploit: EternalBlue straight to SYSTEM.
- Windows PrivEsc Arena - TryHackMe. A sandbox covering scheduled tasks, privileges, and many other escalation vectors.
- Optimum - HackTheBox. A textbook kernel-exploit privesc (enumerate patches, find the gap, MS16-032 to SYSTEM).
- Devel - HackTheBox. Foothold via file upload, then a kernel exploit to SYSTEM.