A transit Windows service runs as SYSTEM and its service binary is writable by a standard user. Conceptually, what does that enable?
Select an answer to reveal the explanation.
Short Explanation
If SYSTEM runs a program you can overwrite, you are rewriting the script the most powerful local account will perform. That writable-service-binary theme is high-value Windows priv-esc. It does not magically grant forest-wide Domain Admin by itself.
Full Explanation
A transit Windows service running as SYSTEM whose service binary is writable by a standard user enables replacement or modification leading to SYSTEM-level execution when the service restarts or is otherwise triggered. Writable privileged binaries are among the highest-signal Windows LPE findings.
Impact is not limited to changing the next interactive wallpaper. It does not automatically grant Domain Admin across every forest trust. It does not guarantee bypass of network segmentation between VLANs.
Exam caveat: confirm ACLs on the binary and directory, and consider service restart constraints under RoE before demonstrating.
Operational check: inspect service binary permissions, document standard-user write access, and recommend SYSTEM/Administrators-only write ACLs with change monitoring for transit servers. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.