A penetration tester issues the following command after obtaining a low-privilege reverse shell: wmic service get name,pathname,startmode Which of the following is the most likely reason the…

Question

Options

• ATo search for passwords in the service directory
• BTo list scheduled tasks that may be exploitable
• CTo register a service to run as System
• DTo find services that have unquoted service paths

• A
  7% (2)
• B
  4% (1)
• C
  11% (3)
• D
  78% (21)

Explanation

The command wmic service get name,pathname,startmode is used by penetration testers to enumerate services and their configurations, specifically looking for services with unquoted paths. If a service's path contains spaces and is not enclosed in quotes, it can be exploited by placing a malicious executable along the path, leading to privilege escalation. For example, if the service path is C:\Program Files\My Service\service.exe and is unquoted, an attacker could place a malicious Program.exe in C:, which would then be executed with the same privileges as the service when the service starts. Identifying such services allows penetration testers to highlight potential security risks that could be exploited for privilege escalation.

No community discussion yet for this question.