search

Unquoted Service Paths

hashtag
Enumeration

Manual enumerate with wmic

C:\>wmic service get name, pathname | findstr /i /v system32 | findstr /v \"
Name                                      PathName

LSM

NetSetupSvc

NetTcpPortSharing                         C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

PerfHost                                  C:\WINDOWS\SysWow64\perfhost.exe

PSEXESVC                                  C:\WINDOWS\PSEXESVC.exe

TrustedInstaller                          C:\WINDOWS\servicing\TrustedInstaller.exe

VulnService                               C:\Setup\Vuln Service\VulnService.exe

Use SC command for enumerating with the Service Control Manager and services.

By default, this inherits the permissions of the C:\ directory, which allows any user to create files and folders in it. We can check this using icacls:

The system tries to interpret the possibilities in the following order:

  1. c:\program.exe

  2. c:\program files\sub.exe

  3. c:\program files\sub dir\program.exe

  4. c:\program files\sub dir\program name.exe

We can abuse this service by generating a payload named 'Vuln.exe'.

Once the service gets restarted, your payload should execute.

We may restart the service or the machine if we lack permission to stop the service.

PreviousAutoInstall ElevateNextWeak Service Permissions

Last updated