How to prevent code injection/swap for a windows service?

Question

Heyo!

As part of our product, we have an on-premise installer on our client's servers that interacts with their database. We’re currently in the process of transforming it into a windows service. We’ve found how to make the windows service using the nssm, but one thing that we have trouble with is how to ensure that we don’t expose our clients to security risks (such as elevated privileges) by allowing an attacker to switch our code with theirs.

More specifically, the service will run a command like %SOME_DIR%\node.exe my_javascript.js and we want to avoid having an external player simply switch out the node.exe or the javascript file.

So my question is threefold:

• Is it possible for an attacker without administrative privilege to switch the files used by a service?
• Is this a security concern at all, or can we assume that if an attacker has the ability to reach a point where they can switch the content of the files it’s pretty much game over anyway?
• If it is a security concern, how we can avoid this being an issue/reduce the risk? Is there a way to lock the file such that only privileged users (or the service itself) can change the content of the files? The solution should allow the service to update its code automatically.

Thanks a lot for your answers!

Cheers ☀️

Phil

Answer 1

Let's see if I can address your 3 questions.

1. Assuming that your service executable file, and the .js file are located in a directory that a normal user has access to (write access), it can easily modify the .js file (to add/remove code), replace the .js file with a whole new one with the same name (overwrite the legit one) or even delete it (preventing the service from starting properly). The same can be said about the executable. It could even be replaced with a malicious one.

2. It is a security concern, as you don't always need Admin Rights on a system to be able to modify files. The situation you're presenting could be used by an attacker with user rights to gain Admin Rights (privilege escalation).

3. You should place your service executable file and the .js file in a directory(ies) where only users with Admin Rights have write access. That should mitigate the risk. Also, make sure that you put the service command inside quotes (" ") to prevent Windows Unquoted Service Path Enumeration (abusing a service with a command line that isn't wrapped in quotes, and that has spaces in it).

If you need more details on any of my answers, feel free to ask!