Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
winPEAS.exe servicesinfo
The icacls utility outputs the corresponding principals and their permission mask.4 The most relevant permissions and their masks are listed below:
| MASK | PERMISSIONS |
|---|---|
| F | Full access |
| M | Modify access |
| RX | Read and execute access |
| R | Read-only access |
| W | Write-only access |
icacls permissions mask
Let's use icacls on the Apache binary BetaServ.exe first.
Check the Startup Type of the mysql service with the help of the Get-CimInstance Cmdlet by selecting Name and StartMode as well as filter for the string "BetaService" with Where-Object.
Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like 'BetaService'}
