{"id":101,"date":"2023-02-21T18:06:07","date_gmt":"2023-02-21T18:06:07","guid":{"rendered":"https:\/\/merrillnewman.tech\/?p=101"},"modified":"2023-02-22T02:28:47","modified_gmt":"2023-02-22T02:28:47","slug":"windows-privilege-escalation-via-unquoted-service-paths","status":"publish","type":"post","link":"https:\/\/merrillnewman.tech\/?p=101","title":{"rendered":"Windows Privilege Escalation Via Unquoted Service Paths"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Overview<\/h3>\n\n\n\n<p>In a Windows environments it&#8217;s possible to escalate your privileges via misconfigured services. The most common ways for this to happen is insecure permissions on the service executable, unquoted service paths, and insecure permissions. In this article I will walk you through the exploitation of unquoted service paths and how to fix them.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h3 class=\"wp-block-heading\">Unquoted Service Paths<\/h3>\n\n\n\n<p>If you would like to follow along with this article all the examples used are from the <a href=\"https:\/\/tryhackme.com\/room\/windowsprivesc20\">Windows Privilege Escalation<\/a> room on TryHackMe. <\/p>\n\n\n\n<p><\/p>\n\n\n\n<p> To understand this vulnerability we must first understand how windows looks for executables when quotes are not present. Let&#8217;s take the following service for example.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"389\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-23-1024x389.png\" alt=\"\" class=\"wp-image-103\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-23-1024x389.png 1024w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-23-300x114.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-23-768x292.png 768w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-23.png 1312w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Querying service configuration<\/figcaption><\/figure>\n\n\n\n<p>We can see the intended path to the executable in the <code>BINARY_PATH_NAME<\/code> argument. However since there are now quotes Windows will look for the service executable in the following order.<\/p>\n\n\n<ul>\n<li>C:\\MyPrograms\\Disk.exe<\/li>\n<li>C:\\MyPrograms\\Disk Sorter.exe<\/li>\n<li>C:\\MyPrograms\\Disk Sorter Enterprise\\bin\\disksrs.exe<\/li>\n<\/ul>\n\n\n<p>If we are able to create any of these executables before the intended one then the service will run our arbitrary executable under the permissions of the service (usually SYSTEM). In order for this to work you must be able to write to the directory the service is installed under. In this example the service is installed under <code>C:\\MyPrograms<\/code>, we can check the permissions of this directory using <code>icacls<\/code>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"942\" height=\"312\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-24.png\" alt=\"\" class=\"wp-image-108\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-24.png 942w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-24-300x99.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-24-768x254.png 768w\" sizes=\"auto, (max-width: 942px) 100vw, 942px\" \/><figcaption class=\"wp-element-caption\">Checking directory permissions with icacls<\/figcaption><\/figure>\n\n\n\n<p>In this example the <code>BUILTIN\\USERS<\/code> group has <code>AD<\/code> and <code>WD<\/code> permissions on the  <code>C:\\MyPrograms<\/code> directory, these give us write and append privileges respectively. From here all we need to do is create our executable and place it one of the previously mentioned locations.<\/p>\n\n\n\n<p> <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"180\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-25-1024x180.png\" alt=\"\" class=\"wp-image-111\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-25-1024x180.png 1024w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-25-300x53.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-25-768x135.png 768w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-25-1536x270.png 1536w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-25.png 2028w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Generating the executable<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"324\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-26-1024x324.png\" alt=\"\" class=\"wp-image-112\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-26-1024x324.png 1024w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-26-300x95.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-26-768x243.png 768w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-26.png 1250w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Downloading the executable and placing it in the proper location<\/figcaption><\/figure>\n\n\n\n<p>With our executable in place we can restart the service and get a shell. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"596\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-27-1024x596.png\" alt=\"\" class=\"wp-image-113\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-27-1024x596.png 1024w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-27-300x175.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-27-768x447.png 768w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-27.png 1226w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Restarting the service<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"423\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-28-1024x423.png\" alt=\"\" class=\"wp-image-114\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-28-1024x423.png 1024w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-28-300x124.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-28-768x317.png 768w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/02\/image-28.png 1224w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Catching the shell<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Caveats<\/h3>\n\n\n\n<p>Exploiting unquoted services paths does require some permissions and some mess ups on the blue team side. A common issue to run into would be that by default most services are installed under <code>C:\\Program Files<\/code> or <code>C:\\Program Files (x86)<\/code> directory which are both only writable by administrator accounts. Another issue is that often you will not have permissions to start\/stop the service, in this case its possible to restart the computer and achieve execution that way if it is an auto-start service but in many situations restarting the computer can cause unacceptable downtime. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Remediation<\/h3>\n\n\n\n<p>To protect yourself from this kind of vulnerability all you need to do is put quotes around your service paths. This command will return all service paths with spaces and no quotes so you can fix them via the registry or the command line.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic service get name,displayname,pathname,startmode |findstr \/i \"auto\" |findstr \/i \/v \"c:\\windows\\\\\" |findstr \/i \/v \"\"\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">References<\/h3>\n\n\n\n<p><a href=\"https:\/\/tryhackme.com\/room\/windowsprivesc20\">https:\/\/tryhackme.com\/room\/windowsprivesc20<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/isgovern.com\/blog\/how-to-fix-the-windows-unquoted-service-path-vulnerability\/\">https:\/\/isgovern.com\/blog\/how-to-fix-the-windows-unquoted-service-path-vulnerability\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview In a Windows environments it&#8217;s possible to escalate your privileges via misconfigured services. The most common ways for this to happen is insecure permissions on the service executable, unquoted service paths, and insecure permissions. In this article I will walk you through the exploitation of unquoted service paths and how to fix them.<\/p>\n","protected":false},"author":1,"featured_media":118,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"hide_page_title":"","_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","_mi_skip_tracking":false,"footnotes":""},"categories":[6],"tags":[],"class_list":["post-101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-windows"],"_links":{"self":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts\/101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=101"}],"version-history":[{"count":7,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts\/101\/revisions"}],"predecessor-version":[{"id":117,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts\/101\/revisions\/117"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/media\/118"}],"wp:attachment":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}