Nssm224 Privilege Escalation Updated -

For years, system administrators have relied on NSSM (Non-Sucking Service Manager) to run unstable or legacy batch scripts as robust Windows services. Its ability to monitor process health, restart crashed executables, and handle graceful shutdowns made it indispensable.

However, in the context of red teaming and penetration testing, NSSM 2.24 has become a notorious binary for unintended privilege escalation. Recently, updated research has shed light on specific configurations and default behaviors in version 2.24 that, while patched or altered in later forks, remain exploitable on legacy systems and misconfigured enterprise environments.

This article explores the updated mechanics of how attackers abuse NSSM 2.24 to escalate from a low-privileged user to NT AUTHORITY\SYSTEM.

Even with quoted paths, NSSM 2.18 through 2.24 sometimes inherit weak ACLs (Access Control Lists) on the registry key: HKLM\SYSTEM\CurrentControlSet\Services\MyService

If a standard user can modify the ImagePath value, they can point the service to their own executable.

The infamous nssm224 privilege escalation issue is not a bug in NSSM’s code per se. Instead, it stems from misconfigurations combined with NSSM’s default behavior.