Nssm-2.24 Privilege Escalation Access

In a locked-down environment, the user cannot start the service themselves. However, an attacker can simply wait for the server to reboot (or trigger a crash/reboot via another vector), at which point the service starts automatically.

net stop ElevationTest net start ElevationTest nssm-2.24 privilege escalation

Since NSSM is often a trusted binary (signed, known), it can be used to execute arbitrary unsigned scripts under the guise of a legitimate service manager. In a locked-down environment, the user cannot start

The Non-Sucking Service Manager (NSSM) version 2.24 is susceptible to a Local Privilege Escalation (LPE) vulnerability. NSSM is a utility used to wrap arbitrary applications as Windows Services. Due to insufficient sanitization of the application path and arguments when installed as a service, a local attacker can manipulate the service binary path to execute arbitrary code with SYSTEM privileges. net stop ElevationTest net start ElevationTest Since NSSM