In this lesson,
we're going to cover the concept of unquoted service paths
and the tools used to detect and exploit them,
such as PowerShell and PsExec.
Unquoted service paths refer to the misconfiguration
and the way services are defined in Windows.
When a service path contains spaces
and is not enclosed in quotation marks,
it can lead to a vulnerability
that attackers can exploit to gain elevated privileges.
This issue arises,
because Windows may incorrectly interpret the service path,
potentially leading to the execution
of malicious executables placed by the attacker.
To understand unquoted service paths,
let's first look at how Windows services are configured.
Each service has an executable path defined
in the Windows Registry.
For example, a service might have a path,
like C:\Program Files\MyService\service.exe.
If this path is not enclosed in quotes,
Windows might misinterpret it
and look for executables at various points along the path,
such as C:\Program.exe,
or C:\Program Files\MyService.exe,
or C:\Program Files\MyService\service.exe.
An attacker could place a malicious executable,
named Program.exe in the C directory,
which Windows might execute with elevated privileges.
Imagine you are performing a penetration test
on a financial services company, DionFinanceSecure.
During the reconnaissance phase,
you discover
that the company uses a custom-developed software,
called FinanceTracker that runs as a Windows service.
The service executable is located at the following location,
but this path is not enclosed in quotes
in the service configuration.
To detect this vulnerability,
you can use PowerShell to check the service paths
for any that contain spaces and are not enclosed in quotes.
Here's an example of a script
to find unquoted service paths.
This script retrieves all services
that are set to start automatically
and checks their paths for services
that are not enclosed in quotes.
Any unquoted service paths found are printed to the output.
Please note that you do not need to know
how to write a script like this for the exam.
Just understand that PowerShell can be used
for this type of discovery
and be able to recognize the script's general purpose.
Now back to the example.
Upon running the script,
you discover that the FinanceTracker service,
indeed has an unquoted service path.
To exploit this,
you could place a malicious executable named Program.exe
in the root of the C:\ drive.
This executable will be executed
with the privileges of the Financial Tracker service,
which runs under a high-privilege account.
Here's how you might use PsExec
to place and execute a malicious payload
on the remote system.
In this example,
PsExec is used to remotely create a file named Program.exe
in the root directory of the C: drive
on the FinanceSecure Corp server.
The -u, -p options are used
to specify the username and password of a privilege account.
Now when the FinanceTracker service starts,
Windows will attempt to execute the tracker.exe program.
However, because the path is unquoted and contained spaces,
Windows will incorrectly execute the Program.exe instead.
This results in your malicious payload being executed
with elevated privileges.
To fix this issue,
FinanceService Corp should ensure
that all service paths are properly enclosed in quotes.
This simple change prevents Windows
from misinterpreting a service path
and helps protect against this type of vulnerability.
So remember, unquoted service paths are a type
of misconfiguration
that can lead to privilege escalation.
Detecting these vulnerabilities involves checking
for service paths with spaces
that are not enclosed in quotes.
PowerShell scripts can automate this detection,
and tools like PsExec can be used
to test and exploit the vulnerability.
Understanding these techniques allows penetration testers
to identify and mitigate potential security risks related
to unquoted service paths.
Always ensure service paths are properly quoted
to prevent such vulnerabilities from being exploited.