Nssm224: Privilege Escalation Updated ((better))

If an attacker can modify the ImagePath or Application parameter of an existing NSSM-managed service (or create a new one), they can execute arbitrary commands as SYSTEM or LOCAL SERVICE (depending on the service’s configured account).

The privilege escalation vulnerability in NSSM 2.24 installations usually boils down to or vulnerable installation practices.

Avoid running NSSM services under the LocalSystem ( NT AUTHORITY\SYSTEM ) account unless absolutely necessary. Instead:

Since the original NSSM is largely unmaintained, consider migrating to actively supported alternatives like which prioritize secure default configurations. Service Hardening: Configure services to run under Managed Service Accounts (gMSA) or low-privilege accounts rather than LocalSystem whenever possible. certvde.com How to Proceed If you are managing a specific environment, I can help you: Write a PowerShell script to audit your system for insecure NSSM installations. Compare alternatives to NSSM for Windows Server 2025. Draft a security advisory for your internal IT team. CVE-2016-20033 Detail - NVD nssm224 privilege escalation updated

Jax watched the code scroll. Unlike standard vertical privilege escalation , where an attacker jumps from a user to an admin, this update created a "phantom" tier. It allowed any service running under NSSM224 to inherit the permissions of the kernel itself, bypassing the standard security checks .

NSSM stores its configuration parameters (like the Application path) in the Windows Registry under: HKLM\SYSTEM\CurrentControlSet\Services\ \Parameters

In August 2025, security researchers disclosed a critical privilege escalation vulnerability associated with — one of the most widely used open-source utilities for managing Windows services. Identified as CVE-2025-41686 , this flaw quickly became a top concern for organizations relying on NSSM-powered software deployments. This article provides a comprehensive technical analysis of the vulnerability, its real-world impact, and actionable steps to secure your systems. If an attacker can modify the ImagePath or

They then compile or drop a malicious executable (e.g., a reverse shell) and name it the original application’s filename.

Recent research (late 2024 through mid-2025) has identified three variants of the NSSM-224 technique. These are not patches to NSSM but rather new ways to abuse it in modern Windows environments.

If you have permission to restart the service, do so. If not, wait for a system reboot. sc stop sc start Use code with caution. Copied to clipboard Instead: Since the original NSSM is largely unmaintained,

Researchers found that the permissions on nssm.exe were not secured properly. The weakness is categorized as , where the product does not verify a user’s identity before allowing modification of a critical resource.

: Restrict write access to the service directories to "Administrators" and "SYSTEM" only .

: Check if the "Users" group has high privileges on the service folder using icacls . 3. Mitigation & Hardening

NSSM is used to run applications as Windows services. Privilege escalation occurs if the service is configured to run as LocalSystem but points to an executable or DLL that a low-privileged user can modify.