Windows Privilege Escalation — Part 1 (Unquoted Service Path)

<h1>Prerequisites</h1> This blog post assumes that you have gotten a low privileged shell (either through netcat, meterpreter session, etc). <h1>Aim</h1> We will be creating a vulnerable service and shall be exploiting it in order to escalate our privilege level from low privileged user account to SYSTEM. <h1>What in the world is Unquoted Service Path?</h1> When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges (only if the vulnerable service is running with SYSTEM privilege level which most of the time it is). In Windows, if the service is not enclosed within quotes and is having spaces, it would handle the space as a break and pass the rest of the service path as an argument. <a href="https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae">Click Here</a>