> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/weak-permissions.md).

# Weak Permissions

Note that most popular services and applications have robust permissions, however, you might find issues with less popular third-party applications. When looking for weak permissions on a system, it's important to review over the following potential areas of interest:

* [ ] Permissive File System ACLs
* [ ] Weak Service Permissions
* [ ] Un-quoted Service Paths
* [ ] Permissive Registry ACLs
* [ ] Modifiable Registry Autorun Binary

## Useful Tools

<table><thead><tr><th width="213">Tool</th><th>Info / Flags</th></tr></thead><tbody><tr><td><a href="https://github.com/GhostPack/SharpUp/">SharpUp</a></td><td><p>Enumerates services with weak ACLs or modifiable paths</p><p></p><p><code>audit</code> (runs all vuln checks), <code>HijackablePaths</code> (checks modifiable paths in user's %PATH%)</p></td></tr><tr><td><a href="https://ss64.com/nt/icacls.html">icacls</a></td><td>Lists ACLs for a given object</td></tr><tr><td><a href="https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk">accesschk</a></td><td><p>Determines what groups may access a given object</p><p> </p><p><code>-q</code> (omit banner), <code>-u</code> (suppress errors), <code>-v</code> (verbose), <code>-c</code> (specify name of a Windows service), <code>-w</code> (show only objects that have write access), <code>-k</code>  (registry objects), <code>-s</code> (recurse)</p></td></tr></tbody></table>

Often a binary or folder with weak permissions may allow you to modify the binary being run by editing configurations or overwriting the binary itself. You can examine weak ACLs via tools like [SharpUp](https://github.com/GhostPack/SharpUp/) or [icacls](https://ss64.com/nt/icacls.html).&#x20;

{% hint style="info" %}
SharpUp will automatically query services for weak permissions
{% endhint %}

{% tabs %}
{% tab title="SharpUp" %}

<pre class="language-bat"><code class="lang-bat"><strong>SharpUp.exe audit
</strong>-> Runs all vulnerability checks regardless of integrity level or group membership.
        
SharpUp.exe HijackablePaths
-> Check only if there are modifiable paths in the user's %PATH% variable.

SharpUp.exe audit HijackablePaths
-> Check only for modifiable paths in the user's %PATH% regardless of integrity level or group membership.
</code></pre>

{% endtab %}

{% tab title="icacls" %}

```bat
icacls "C:\Program Files (x86)\PCProtect\SecurityService.exe"
```

{% endtab %}
{% endtabs %}