akde/infosec

Information security is ultimately about managing risk

Unquoted Service Path hijacking

Check if there is some service in a path which contains spaces (outside of the windows directory):
wmic service get name,pathname | findstr /i /v "C:\Windows\" | findstr /i /v """
Alternatively in Powershell: See the Windows Service Exploitation article.
Check that it is possible to restart the service, e.g. via Start-Service $serviceName in Powershell.
If this is possible, check if we can write somewhere. For example, the executeable service is C:\Program Files\Super App\SuperApp.exe. Then, the following directories should be checked with icacls:
1. C:\Program.exe
2. C:\Program Files\Super.exe
3. C:\Program Files\Super App\SuperApp.exe
If you have write access, compile a binary e.g. from the Binary hijacking post and place it there and €profit.

You must be logged in to post a comment.

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';