icacls — Windows Permissions Reference
What is icacls?
icacls (Integrity Control Access Control Lists) is a built-in Windows command-line tool for viewing and modifying file and directory permissions (ACLs). During a pentest it’s used to:
- Check if a low-priv user can write to privileged executables or service binaries
- Identify writable paths for DLL hijacking or binary replacement
- Modify permissions when running as an admin/SYSTEM
OSCP use: A core tool for Windows PrivEsc — always check permissions on service binaries, scheduled task executables, and
PATHdirectories.
Syntax
icacls <path> [options]📌 1) Permission Abbreviations
These appear in icacls output next to each user/group:
| Abbreviation | Full Name | Description |
|---|---|---|
F | Full Control | Read, write, execute, delete, change permissions |
M | Modify | Read, write, execute, delete (no permission changes) |
RX | Read & Execute | Read file contents and execute |
R | Read | Read file contents only |
W | Write | Write to file, create files in folder |
D | Delete | Delete the file or folder |
OI | Object Inherit | ACE applies to files within the folder |
CI | Container Inherit | ACE applies to subfolders |
IO | Inherit Only | ACE only applies to children, not the object itself |
NP | No Propagate | ACE not inherited by grandchildren |
I | Inherited | ACE was inherited from a parent |
N | No Access | Explicitly denied |
📌 2) Viewing Permissions
View permissions on a file or folder
icacls C:\Windows\System32\cmd.exe
icacls "C:\Program Files\SomeApp\service.exe"
icacls C:\TempView permissions recursively (entire directory tree)
icacls C:\Program Files /T
/T— Traverse all subdirectories
Suppress error messages (cleaner output)
icacls C:\Program Files /T /C
/C— Continue on errors (e.g. access denied on some paths)
View permissions and save output to file
icacls C:\Services /T /C > perms.txt📌 3) Modifying Permissions
Grant a user full control
icacls C:\Temp\file.exe /grant UserName:FGrant a user read & execute
icacls "C:\Program Files\App\app.exe" /grant Everyone:RXGrant with inheritance flags (for folders)
icacls C:\Temp /grant UserName:(OI)(CI)F
(OI)(CI)F— Full control, inherited by files and subfolders
Remove a user’s permissions
icacls C:\Temp\file.exe /remove UserNameDeny a user access
icacls C:\Temp\file.exe /deny UserName:FReset permissions to inherited defaults
icacls C:\Temp /reset /TTake ownership (requires admin)
takeown /f C:\Temp\file.exe
icacls C:\Temp\file.exe /grant Administrators:F📌 4) Saving and Restoring ACLs
# Save current ACLs to a file
icacls C:\ImportantFolder /save acl_backup.txt /T
# Restore ACLs from saved file
icacls C:\ImportantFolder /restore acl_backup.txt📌 5) Privilege Escalation — What to Look For
When running as a low-priv user, look for write (W) or full control (F) or modify (M) on:
# Check a specific service binary
icacls "C:\Program Files\VulnApp\vulnservice.exe"
# Check all running service binary paths
wmic service get name,pathname,startmode | findstr /i "auto"
# Check a scheduled task executable
schtasks /query /fo LIST /v | findstr "Task To Run"
icacls "C:\Path\To\ScheduledTask.exe"
# Check directories in the system PATH (DLL hijacking)
echo %PATH%
icacls C:\Python27
icacls C:\TempVulnerable output examples
C:\Vulnerable\service.exe
BUILTIN\Users:(W) ← Users can WRITE — replace the binary
BUILTIN\Users:(M) ← Users can MODIFY — overwrite it
Everyone:(F) ← Everyone has FULL CONTROL
📌 6) Useful One-Liners for Pentest
# Find all writable files/folders for current user (slow but thorough)
icacls C:\ /T /C 2>nul | findstr /i "(W) (F) (M)" | findstr /i "Users Everyone Authenticated"
# Check permissions on all service binaries
for /f "tokens=2 delims='='" %a in ('wmic service list full ^| find /i "pathname"') do @icacls "%a" 2>nul | findstr /i "(W) (F) (M)"
# PowerShell — check write access to a path
[System.IO.File]::OpenWrite("C:\Program Files\App\test.tmp").close()
# No error = writable📌 Quick OSCP Cheat Sheet (Copy/Paste)
REM View permissions on a service binary
icacls "C:\Program Files\SomeService\service.exe"
REM Recursive check on a directory
icacls "C:\Program Files\SomeApp" /T /C
REM Look for weak permissions (writable by Users or Everyone)
icacls C:\ /T /C 2>nul | findstr /i "Users.*:(W\|F\|M)"
REM Grant yourself full control (if already admin/SYSTEM)
icacls C:\Temp\file.exe /grant %username%:F
REM Reset to inherited
icacls C:\Temp /reset /T