Exploit an unquoted service path with a writable earlier prefix

Needs: An earlier executable prefix is absent and creatable, service identity is higher and a start/restart trigger exists

PowerShell commands

# Baseline
Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match '\s' -and $_.PathName -notmatch '^\s*"' } |
  Select-Object Name,StartName,State,StartMode,PathName

Windows commands

REM Baseline
icacls C:\
icacls "C:\Program Files"
icacls "C:\Program Files\Vendor App"
sc.exe qc SERVICE

Confirmed only if: path contains spaces and is unquoted; an earlier attempted executable such as C:\Program.exe or C:\Program Files\Vendor.exe is absent and creatable; service runs higher; trigger exists. A listed unquoted path alone is a false positive.

Verify → Confirm the earlier prefix is actually selected after the trigger and verify its resulting token.

If it fails → A quoted path, existing protected earlier file, unwritable directory or absent trigger defeats the chain. More detail ↓

If → then

A privileged object appears writable or an ACL tool reports a useful right → Prove effective file, registry and service-object permissions
Needs: Correct trustee/token, object type and effective rights including parents and deny entries
A privileged service consumes a file whose bytes or parent replacement are controllable → Replace a privileged service binary or consumed file
Needs: Effective file/parent replacement rights, compatible artifact, file-lock handling and available privileged restart/boot trigger
A new Windows session or claimed administrator/SYSTEM transition → Establish Windows token, host and process context
Needs: A functioning command channel and the actual effective token/process context

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Exploit an unquoted service path with a writable earlier prefix

USE WHEN: A service command line contains unquoted spaces
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: Verified execution of the earlier executable candidate

Recognize the clue

List service command lines and accounts, then inspect every earlier executable prefix in the actual unquoted path.

Get-CimInstance Win32_Service | Select-Object Name,StartName,State,PathName

SYNTHETIC EXAMPLE OUTPUT

StartName: LocalSystem
PathName: C:\Program Files\Vendor App\service.exe -d
Quotes around executable: absent

Means: Spaces plus absent executable quoting create candidate earlier prefixes; writable placement and trigger remain unproved.

Confirm: Read the unquoted service command with sc qc. Check each earlier executable prefix for write/create access with icacls; confirm the service account and restart trigger. Spaces alone do not make the path exploitable.

After validation: A usable earlier prefix is selected at a privileged trigger: choose this parsing route.
Ruled out in this context: All earlier prefixes are protected, already occupied or the executable is correctly quoted: reject it.
Still inconclusive: A scanner flag without prefix/trigger checks leaves exploitability unknown.

Troubleshooting: A quoted path, existing protected earlier file, unwritable directory or absent trigger defeats the chain.

Additional prerequisite checks

Get-CimInstance Win32_Service | Select-Object Name,StartName,PathName

For C:\Program Files\Vendor App\service.exe -d, check every attempted prefix:

Confirmed only if: path contains spaces and is unquoted; an earlier attempted executable such as C:\Program.exe or C:\Program Files\Vendor.exe is absent and creatable; service runs higher; trigger exists. A listed unquoted path alone is a false positive.

Why it works

Windows executable-path parsing may try earlier space-separated prefixes. Spaces alone do not create control; each attempted prefix and its creation rights matter.

Worked example · hypothetical

Observation: a service uses an unquoted Program Files path. Test: inspect each attempted prefix and its directory ACL. Illustrative output: all earlier prefixes are protected. Interpretation: this is not an exploitable path under the current identity.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗