Skip to content

Added Windows privesc tools and info about unquoted services #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 7, 2014
Merged

Added Windows privesc tools and info about unquoted services #82

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cb27dd4
Added Windows privesc tools and info about unquoted services
v-p-b Jun 6, 2014
812d63a
Added clarification for unquoted Windows service paths
v-p-b Jun 7, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Added clarification for unquoted Windows service paths
  • Loading branch information
@v-p-b
v-p-b committed Jun 7, 2014
commit 812d63a63fdd29a8b3a80804c51e96b4fbe84105
2 changes: 2 additions & 0 deletions privesc/windows/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ Services with unquoted binary paths may allow privilege escalation.
* Assume ServiceA refers to the unquoted path C:\Program Files\Some Service\service.exe
* Service is started with desirable privileges (e.g. domain, SYSTEM)
* If attacker can create files as c:\Program.exe or ''c:\Program Files\Some.bat'' the next time the service starts the attacker controlled binary will execute
* This is because the system can not decide if a space in the command string indicates a space in the binary path or a separator between command line arguments. The system starts with the first substring before the first space and checks if there is a file with an executable extension there (in this case C:\Program.exe, C:\Program.bat, etc.). If there is not, it checks for the next substring (C:\Program Files\Some.exe, C:\Program Files\Some.bat, etc.) and so on. If you can create a file that is checked before the intended executable, you win.
* The scenario is typical when services are created from the command line with sc: `sc create PrivEsc binpath= "..."`

# Tools

Expand Down