Exploiting unquoted service paths
When starting or running services, Windows requires the location of the target executable in order to run. The path of the executable is typically encapsulated by quotation marks, which allows Windows to locate the path or location of the executable. The following path is an example of a secure service path:
"C:\Program Files\OpenSSH\bin\cygrunsrv.exe"
If the path of the executable is not encapsulated by quotation marks, Windows will resort to searching for the executable in every directory and executing each one until it locates the target executable. We can leverage this vulnerability to elevate our privileges by identifying a service that runs under administrative privileges and that is not encapsulated in quotation marks. The following path is an example of an insecure service path that we can exploit:
C:\Program Files\OpenSSH\bin\cygrunsrv.exe
The exploitation process involves generating and uploading a binary to the target...
