Nssm-2.24 Privilege Escalation

Blue teams can detect exploitation attempts via:

Summary

Affected versions

Root cause

Typical exploitation scenarios

  • Controllable parameters or configuration files

  • DLL search-order or dependency hijack

  • Registry- or link-based redirection

    • PoC outline (high-level, non-code)

    Mitigations and remediation

  • Long-term:
  • Detection:

    • References and further research

    If you want, I can:

    Title: From Service Manager to SYSTEM: Abusing NSSM 2.24 for Privilege Escalation nssm-2.24 privilege escalation

    Date: [Insert Date] Tags: #Windows #PrivilegeEscalation #NSSM #InfoSec

    When a standard user is tricked or coerced into running NSSM 2.24 (perhaps via a phishing attack or a malicious script on a shared terminal server), the tool does not properly validate the executable path and arguments before the service starts.

    More specifically, the flaw exists in how NSSM 2.24 manages the Application and AppDirectory parameters. A low-privilege user can modify the configuration of an existing NSSM-managed service or, in some versions, inject a malicious payload during the initial (aborted) installation sequence.

    sc sdset MyNSSMService "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)" Blue teams can detect exploitation attempts via: Summary

    Since NSSM is often a trusted binary (signed, known), it can be used to execute arbitrary unsigned scripts under the guise of a legitimate service manager.

    Look for: