Understanding NSSM-2.24 Privilege Escalation: Risk and Remediation
: Attackers look for instances where NSSM has been configured with weak file permissions. If a user can overwrite nssm.exe or its configuration in the Registry (located at HKLM\System\CurrentControlSet\Services\ \Parameters ), they can point the service to a malicious script. nssm-2.24 privilege escalation
NSSM version 2.24 does not have inherent privilege escalation vulnerabilities in its code, but it is frequently used in local privilege escalation scenarios due to misconfigurations like insecure file permissions, unquoted service paths, or placement in writable folders. While often flagged by security tools, mitigation involves upgrading to the 2.25 pre-release, auditing permissions, and securing service paths. For specific bugs and fixes, refer to the NSSM Bug Tracker . Bugs - NSSM - the Non-Sucking Service Manager Understanding NSSM-2
Check the permissions on the registry keys where NSSM stores its parameters. Ensure that standard users cannot modify keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ . 3. Use Service Accounts While often flagged by security tools, mitigation involves
: Regularly monitor and audit service configurations and system calls to detect and respond to potential exploitation attempts.
: An attacker with low-level access replaces the nssm.exe binary with a malicious file (e.g., a reverse shell). Because NSSM usually runs as the LocalSystem account, the next time the service restarts, the attacker's code executes with full administrative power. Unquoted Service Paths :