E-SC
sc
Query and inspect Windows services in place — names, states, and binary paths.
OVERVIEW
sc is the built-in Service Control command on Windows (learn.microsoft.com). `sc query` and `sc qc` print each service’s state, start type, and binary path — the same data a privilege-escalation check cares about: unquoted paths with spaces, writable service binaries, and services running as SYSTEM that an unprivileged user can reconfigure.
Querying is enumeration. Creating, starting, or changing a service is a configuration change on a live host, logged by default, and only in scope when the rules of engagement allow post-exploitation on that machine. Stay on query/qc until you have that sign-off.
USE CASES
Practical use cases
- 01
Listing all services and start types on a scoped Windows host.
- 02
Printing the binary path of a named service to check quoting and ACLs.
- 03
Confirming whether a service recovered from a crash or is stuck stopped.
- 04
Documenting a weak service configuration as a privilege-escalation lead.
QUICK START
On a Windows host in scope, to list services and their image paths before deciding whether a weak service ACL or an unquoted path is a finding.
- Confirm the Windows host is in scope for local enumeration.
- List services with sc query, then sc qc on any name whose path or account looks interesting.
- Note binary paths that are unquoted, writable, or running as a high-privilege account.
- Do not create or modify a service unless post-exploitation on this host is explicitly authorized.
sc query state= allBEFORE YOU RUN IT
What to check before running it
sc create / sc config / sc start change the host and are high-signal events in Security and System logs — treat them as post-exploitation, not as enum.
Remote sc against another machine uses RPC and will show up in that host’s logs; confirm the remote target is in scope.
A writable service binary is a lead until you confirm the ACL on disk; sc qc alone does not prove exploitability.