Privilege Escalation: Nssm-2.24
– Migrate to Microsoft’s native sc.exe or New-Service PowerShell cmdlet, or use WinSW (Windows Service Wrapper) which supports better security configuration.
CVE-2016-20033 Severity: High (CVSS: 7.8) Attack Vector: Local (AV:L) Privileges Required: Low (PR:L)
: Windows interprets the space in "Program Files" as a potential break. If an attacker can place a file named Program.exe in the C:\ root, Windows will execute it instead of the intended NSSM binary during the next boot, granting the attacker SYSTEM privileges. Why NSSM 2.24 specifically? nssm-2.24 privilege escalation
: If an application uses NSSM to run a service but fails to enclose the path to in quotation marks (e.g., C:\Program Files\App\nssm.exe ), a local attacker can place a malicious file (like C:\Program.exe ) to gain elevated SYSTEM privileges upon a reboot. Insecure Executable Permissions : If the folder containing
The first step for any local attacker is enumeration. A low-privileged user runs a series of commands to identify weak spots: – Migrate to Microsoft’s native sc
: The attacker checks Windows services to find binaries running with elevated privileges (like LocalSystem or NetworkService ). They identify a service utilizing NSSM-2.24.
This is the most common real-world scenario. When an administrator installs NSSM or the application it wraps, they often place the binaries into custom directories (e.g., C:\Apps\MyService\ ). Why NSSM 2
Windows services often execute under highly privileged accounts, such as NT AUTHORITY\SYSTEM , LocalService , or NetworkService . If a low-privileged user can manipulate how a privileged service starts, stops, or executes, they can trick the operating system into running arbitrary code with the service's elevated permissions. Why NSSM 2.24 Becomes a Target
An authenticated, low-privileged user can achieve full SYSTEM privileges on the affected host. This compromises integrity, confidentiality, and availability.
Ensure that you are using the most stable, secure version of NSSM. Regularly check the official NSSM repository for security advisories, patches, or updates that address memory corruption, argument injection, or privilege management flaws.
Later versions of NSSM (2.24.1, 2.25, and above) introduced critical safeguards:
