Nssm-2.24 Privilege Escalation [portable] Official

This article dissects the mechanics of the NSSM 2.24 privilege escalation attack, why it works, and what happens when an attacker gains a foothold on a machine with this version installed. Before diving into the exploit, let's establish the baseline. Windows services typically run under the context of SYSTEM , LOCAL SERVICE , or NETWORK SERVICE —privileged accounts that have significant access to the operating system.

NSSM allows a standard user (without admin rights) to install a service, but here lies the critical catch: on Windows. You cannot simply run nssm install from a command prompt as a standard user and succeed. Or so the logic goes. nssm-2.24 privilege escalation

The vulnerability in NSSM 2.24 subverts this logic not by breaking the Windows security model, but by mishandling how the service binary executes after installation. The Core Issue (CWE-269: Improper Privilege Management) When a standard user is tricked or coerced into running NSSM 2.24 (perhaps via a phishing attack or a malicious script on a shared terminal server), the tool does not properly validate the executable path and arguments before the service starts. This article dissects the mechanics of the NSSM 2

The attacker runs: