Nssm-2.24 Privilege Escalation [portable] | 2025 |

Before diving into the exploit, let's establish the baseline. Windows services typically run under the context of SYSTEM , LOCAL SERVICE , or NETWORK SERVICE —privileged accounts that have significant access to the operating system.

The is a popular, lightweight tool used to turn Windows applications, scripts, and batches into managed services. By managing the service lifecycle, it ensures applications restart automatically if they crash. However, older versions, specifically NSSM 2.24 , have been associated with a critical vulnerability— Local Privilege Escalation (LPE) —that can allow a low-privileged user to gain NT AUTHORITY\SYSTEM rights.

NSSM operates by acting as a wrapper. When you register a service using NSSM, Windows actually starts nssm.exe . In turn, NSSM reads configuration parameters from the Windows Registry to determine which actual executable, arguments, and I/O redirection to spin up. nssm-2.24 privilege escalation

: It may fail to launch services on newer Windows versions (Windows 10 Creators Update/Server 2016+) unless specific registry keys like AppNoConsole=1 are set. Summary Table: NSSM 2.24 Security Profile Status/Risk Recommendation Primary Vulnerability Unquoted Service Path Always wrap paths in double quotes in the registry. Account Privileges Runs as SYSTEM by default Use a low-privilege Service Account whenever possible. Stability Known crashes on XP and Nano Server Upgrade to the latest pre-release or stable build. Permissions Weak folder ACLs lead to LPE Restrict write access to Administrators and SYSTEM only. Mitigation & Recommendations To secure an environment using NSSM 2.24, you should:

Version 2.24 was the last build before these patches. It exists in countless enterprise golden images, legacy application stacks, and developer test environments where security updates are deprioritized. Before diving into the exploit, let's establish the baseline

CVE-2024-51448 documents this exact behavior in IBM Robotic Process Automation. All files in the install inherited the file permissions of the parent directory, allowing a non-privileged user to substitute any executable for the nssm.exe service. A subsequent service restart would then execute the attacker's binary with administrator privileges, granting immediate escalation.

The attacker identifies the path hierarchy. If the service path is C:\Program Files\App\nssm.exe , they place a malicious Program.exe in the C:\ directory. They ensure their binary is executable. When the service restarts, the SCM finds Program.exe first, executes it, and grants the attacker SYSTEM privileges. By managing the service lifecycle, it ensures applications

Proofs-of-concept and tooling

The beauty of NSSM is its straightforward approach; the tragedy is that this very simplicity has allowed fundamental security best practices (proper file permissions, quoted paths, and least privilege) to be overlooked for over a decade. Until organizations systematically audit their NSSM deployments and enforce strict controls, this seemingly benign service manager will remain a silent entry point for attackers seeking total system compromise. Security is not about banning tools—it is about configuring them correctly. With NSSM-2.24, the difference between a useful service and a devastating vulnerability is, quite literally, a pair of quotation marks and a few restrictive icacls settings.

refers to a high-severity local security flaw (tracked globally under vulnerabilities like CVE-2025-41686 ) where weak file or directory permissions allow a low-privileged local user to hijack the Non-Sucking Service Manager (NSSM) binary and execute arbitrary code with administrative or NT AUTHORITY\SYSTEM rights. Because NSSM version 2.24 is widely bundled by third-party Windows installers to run scripts and applications as native background processes, a misconfiguration in its deployment represents a major attack vector for infrastructure compromise. 🛠️ The Role of NSSM 2.24 in Windows Environments