This slide is useful to understand about "Unquoted Service Path Exploitation" and how we can prevent our operating system against these kind of attacks.

1. Unquoted Service Path exploitation
By Dhruv Sharma

2. Introduction
• This exploitation technique is used to perform Privilege Escalation from non admin / non Root
user to System / Admin user. We will exploit unquoted service path for the services.
• Used with Windows Operating System.
• Services running on the server can be:
• Unquoted
• Quoted

3. Introduction
Are all unquoted service path are vulnerable ?
• A: No. If there are no spaces in the name of the directory i.e.
ProgramFiles [non vulnerable] || Program Files [vulnerable]
Service Path: C:Program FilesA SubfolderB SubfolderC SubfolderSomeExecutable.exe
In order to run SomeExecutable.exe, the system will interpret this path in the following order from
1 to 5.
Step 1: C:Program.exe
Step 2: C:Program FilesA.exe
Step 3: C:Program FilesA SubfolderB.exe
Step 4: C:Program FilesA SubfolderB SubfolderC.exe
Step 5: C:Program FilesA SubfolderB SubfolderC SubfolderSomeExecutable.exe
If C:Program.exe is not found, then C:Program FilesA.exe would be executed. If C:Program
FilesA.exe is not found, then C:Program FilesA SubfolderB.exe would be executed and so on.

4. Tips
• Use below script to search for vulnerable services:
wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v
"C:Windows" | findstr /i /v ""“
• Service name = Some Vulnerable Service.
• Path name = C:Program FilesA SubfolderB SubfolderC SubfolderSomeExecutable.exe
• Display name = Some Vulnerable Service
• Start mode = Auto

5. Lab Demo
• Step 1: We ran our command to find out any possible vulnerable services. Only
last 3 services are not quoted – Some Vulnerable services, Babi Service & myBabi
Service.

6. Lab Demo
• Check the services. This service is configured for Auto Start, which
means it will try to automatically started after reboot.

7. Lab Demo
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7

8. Lab Demo
• Step 2: In this case we will try to exploit it. Let’s check if our user has
privileges. The folder has Write privileges, which is inherited from the
parent folder.

9. Lab Demo
• Step 3: We analyzed the directory and placed babi.exe (reverse shell
payload) as shown below.

10. Lab Demo
• Finally we start to run the application. It is not important for us to run
the service, but going through the path is important.

11. Create your own vulnerable Service
• Create your own service for dhruv.exe
• Provide write access to Dhruv Sharma directory
icacls "C:Program FilesA Subfolder" /grant "BUILTINUsers":(F) /t [full access]
icacls "C:Program FilesA Subfolder" /grant "BUILTINUsers":W [write access]

12. References
• https://medium.com/@SumitVerma101/windows-privilege-
escalation-part-1-unquoted-service-path-c7a011a8d8ae