weyne/pwnwiki.github.io
1
0
Fork 0
mirror of https://github.com/oXis/pwnwiki.github.io.git synced 2025-10-29 16:56:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added clarification for unquoted Windows service paths

Browse Source
This commit is contained in:
B 2014-06-07 10:55:06 +02:00
parent cb27dd426c
commit 812d63a63f
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
privesc/windows/index.md
View File

@ -24,6 +24,8 @@ Services with unquoted binary paths may allow privilege escalation.
* Assume ServiceA refers to the unquoted path C:\Program Files\Some Service\service.exe
* Service is started with desirable privileges (e.g. domain, SYSTEM)
* If attacker can create files as c:\Program.exe or ''c:\Program Files\Some.bat'' the next time the service starts the attacker controlled binary will execute
* This is because the system can not decide if a space in the command string indicates a space in the binary path or a separator between command line arguments. The system starts with the first substring before the first space and checks if there is a file with an executable extension there (in this case C:\Program.exe, C:\Program.bat, etc.). If there is not, it checks for the next substring (C:\Program Files\Some.exe, C:\Program Files\Some.bat, etc.) and so on. If you can create a file that is checked before the intended executable, you win.
* The scenario is typical when services are created from the command line with sc: `sc create PrivEsc binpath= "..."`
# Tools