Unquoted Service Path
>-
Theory
Windows privilege escalation through unquoted service paths is a common vulnerability that occurs when a service executable file is installed in a directory path that contains spaces but is not surrounded by quotation marks. When Windows starts a service, it looks for the executable file based on the service's configuration. If the path to the executable contains spaces and is not enclosed in quotation marks, Windows may interpret the path incorrectly. In such cases, Windows will try to locate the executable using a combination of the directory names and filenames in the path, which can result in unintended files being executed.
Here's an example to illustrate this, consider we have the following executable path:
C:\Program Files\A Subfolder\B Subfolder\C Subfolder\VulnSvc.exeIn order to run SomeExecutable.exe, the system will interpret this path in the following order:
- C:\Program.exe
- C:\Program Files\A.exe
- C:\Program Files\A Subfolder\B.exe
- C:\Program Files\A Subfolder\B Subfolder\C.exe
- C:\Program Files\A Subfolder\B Subfolder\C Subfolder\VulnSvc.exe
Practice
We can use one of following methods to enumerate it:
CMD
# Method 1
wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """PowerShell
Get-WmiObject win32_service | select Name,PathName,StartMode,StartName | where {$_.StartMode -ne "Disabled" -and $_.PathName -notmatch "`"" -and $_.PathName -notmatch "C:\\Windows"} | Format-ListPowerUp
Alternatively, we can use Get-UnquotedService from PowerUp.
. .\PowerUp.ps1
Get-UnquotedServiceResources
PayloadsAllTheThings/Methodology and Resources/Windows - Privilege Escalation.md at master \u00b7 swisskyrepo/Paylogithub.com