A penetration tester enters a command into the shell and receives the following output: C:\Users\UserX\Desktop>vmic service get name, pathname, displayname, startmode | findstr /i auto | findstr /i…

Question

Options

• AUnquoted service path
• BWritable services
• CClear text credentials
• DInsecure file/folder permissions

• A
  76% (26)
• B
  6% (2)
• C
  15% (5)
• D
  3% (1)

Explanation

This is an unquoted service path vulnerability. The executable path 'C:\Program Files\A Subfolder\B Subfolder\SomeExecutable.exe' contains spaces and is not wrapped in quotation marks in the service configuration. When Windows attempts to start this service, it resolves the path ambiguously by trying each space-delimited token as a potential executable: first 'C:\Program.exe', then 'C:\Program Files\A.exe', then 'C:\Program Files\A Subfolder\B.exe', before finally finding the real binary. If an attacker has write access to any of those intermediate directories (e.g., C:\Program Files\A.exe), they can place a malicious executable there that will run with SYSTEM privileges when the service starts. The wmic command used here is the standard technique for discovering this vulnerability on Windows systems.

No community discussion yet for this question.