Nssm-2.24 Privilege Escalation

Ensure that standard users do not have write access to directories in the service path (e.g., C:\Program Files\ , C:\Program Files (x86)\ ). 4. Implement Security Monitoring Monitor for the creation of new services.

Or via registry (if direct sc fails):

The most critical vulnerability is formally identified as CVE-2025-41686. Published on August 12, 2025, this flaw has been assigned a CVSS v3.1 base score of .

The is a popular, lightweight tool used to turn Windows applications, scripts, and batches into managed services. By managing the service lifecycle, it ensures applications restart automatically if they crash. However, older versions, specifically NSSM 2.24 , have been associated with a critical vulnerability— Local Privilege Escalation (LPE) —that can allow a low-privileged user to gain NT AUTHORITY\SYSTEM rights. nssm-2.24 privilege escalation

$ sc stop SomeService && sc start SomeService

: None (Can be done entirely quietly in the background). 💻 Step-by-Step Exploitation Mechanics

If a service is installed with a path like C:\Program Files\My App\nssm.exe , and it is not properly quoted, Windows attempts to execute the path in the following order: C:\Program.exe (with args: Files\My App\nssm.exe ) C:\Program Files\My.exe (with args: App\nssm.exe ) C:\Program Files\My App\nssm.exe Ensure that standard users do not have write

Replace nssm.exe v2.24 with the latest 2.25 pre-release version.

Attackers who establish an initial foothold as a low-privileged local user leverage these structural flaws to hijack the service execution chain. This allows them to run malicious code under the context of NT AUTHORITY\SYSTEM —effectively gaining full, unrestricted administrative control over the machine. Anatomy of NSSM 2.24 Security Vulnerabilities

Vendor guidance and disclosure practices Or via registry (if direct sc fails): The

NSSM (Non-Sucking Service Manager) version 2.24 is a widely used tool for managing Windows services, but it presents specific security risks, primarily revolving around . While NSSM itself is not inherently "malicious," its misconfiguration or presence in a compromised environment can be leveraged by attackers to gain NT AUTHORITY\SYSTEM privileges. Deep Review of NSSM 2.24 Vulnerabilities 1. Unquoted Service Path (Most Common)

: Many applications bundle nssm.exe but fail to secure its directory. For example, if a "Users" group has full control (the 'F' flag) over the binary or its parent folder, an attacker can replace nssm.exe with a malicious rootkit. When the service restarts, it executes the replacement with elevated privileges.

: Ensure all service binary paths are wrapped in double quotes.

The attacker renames the original executable and replaces it with a malicious payload (like a reverse shell) named exactly the same as the original. 4. Triggering the Payoff

Are you running older software that might have bundled ?