Windows Privilege Escalation: Unquoted Service Path
Windows Privilege Escalation: Unquoted Service Path
The Unquoted Service Path vulnerability arises, when a service is created whose path to the service executable contains spaces and is not enclosed within double-quotes. If a low privilege user can write to the location along an unquoted service path, they could exploit the vulnerability.
The Windows API must assume where to find the referenced application if the path contains spaces and is not enclosed by quotation marks.
Commands used in this video:
wmic service get name,displayname,pathname,startmode |findstr /i “auto” |findstr /i /v “c:\windows\\” |findstr /i /v “””
mkdir "C:\Program Files\NotLegit\BadService"
sc create "I am not a real service" binpath= "C:\Program Files\NotLegit\BadService\update.exe" start= auto
icacls "C:\Program Files\NotLegit" /grant "BUILTIN\Users":W
icacls "C:\Program Files\NotLegit"