A penetration tester locates a few unquoted service paths during an engagement. Which of the following can the tester attempt to do with these?

Unquoted service paths do not expose service account credentials; extracting passwords requires a separate technique such as credential dumping or hash capture from memory.

DLL hijacking exploits missing or incorrectly ordered DLL search paths, not the ambiguity in unquoted executable service paths.

Identifying weak file and folder permissions is a distinct enumeration step; unquoted service paths specifically enable code execution through path parsing ambiguity, not through permission weaknesses on existing files.

When a Windows service executable path contains spaces and is not enclosed in quotation marks, the Service Control Manager attempts to resolve the path by executing at each space-delimited segment before reaching the intended binary. An attacker with write access to an earlier directory in the path can place a malicious executable that Windows runs under the service's elevated account, achieving local privilege escalation.