search
Home

Unquoted Service Path

hashtag
Enumeration

hashtag
Automatic

From powersploit invoke-allcheck

ServiceName    : unquotedsvc
Path           : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
ModifiablePath : @{Permissions=AppendData/AddSubdirectory; ModifiablePath=C:\;IdentityReference=NT AUTHORITY\Authenticated Users}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'unquotedsvc' -Path <HijackPath>
CanRestart     : True

ServiceName    : unquotedsvc
Path           : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
ModifiablePath : @{Permissions=System.Object[]; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'unquotedsvc' -Path <HijackPath>
CanRestart     : True

hashtag
manual

powershell equivielant

hashtag
Inspection

What we are doing is seeing where we are allowed to write, since we know the full path we incrementally check the permissions of every path and then see where we can edit

lets apply this

hashtag
Manual using accessscheck

So lets testing the program files directory

we get nothing here!, lets try the next directory

Here we can see that we are as users we have full FILE_ALL_ACCESS so thats the path we need to go for, just incase lets check the Common Files directory too.

still nothing so it seems the targeted is C:\Program Files\Unquoted Path Service\

hashtag
Exploitation

since we know we can add files inside of C:\Program Files\Unquoted Path Service we know that the next directory is Common Files so we can have a EXE with the Common name

So the EXE that i placed there is a binary that creates a user called sawyer and then proceeds to add them to local administrators

hashtag
Automated exploitation

This is done using Write-ServiceBinaryarrow-up-right it works but the issue with it is that sometimes you get access denied and patching AMSI is required, I have no clue how to do it on a windows 7 machine because im lazy soooooo

References:

https://juggernaut-sec.com/unquoted-service-paths/

PreviousStartup applicationNextPassswords

Last updated