Windows Privilege Escalation - Unquoted Service Path

[@craigmac7176]

Another banger, well explained, well presented, well exploited thank you!

[@c0nd4]

Thank you for the kind words 😁

[@dawnsix]

Your content is really good man, much appreciated.

[@c0nd4]

No problem! I appreciate the support!

[@programmingcheatsheet]

Stumbled on this video looking for details on a homework assignment, and as someone with no previous experience doing anything security related this was well done and coherent enough for me to follow. Liked, subbed, & bookmarked. Don't stop making videos like this

[@bex3911]

Great explained realy helped me out 😁 ... cant wait for more WindosPrivesc Vids.

[@c0nd4]

Thank you! Glad I could help. If all goes as planned, there could be a new windows priv esc video out tomorrow 😉

[@travispatt907]

You are awesome, thank you. This helped me so much with understanding some material for Pentest+.

[@kallikantzaros]

Born to be educator :) Well put my friend, explained it very well like in your other videos.

[@c0nd4]

Thank you!

[@waltzofthestars2078]

wonderfully explained, makes it seem simple af while also noting every little detail. Thanks!

[@c0nd4]

No problem! Thank you for the feedback, I appreciate it 🙂

[@will227inyoface2]

Are you still making videos? I just found this while studying for my PenTest+ and this content is fantastic! Subscribed!

[@tomyates5346]

Good stuff. Clear and concise explanation. Thanks!

[@HK-sw3vi]

had to login to say how good this video is. thanks a bunch man

[@c0nd4]

Thank you!

[@wolfgang-lj2hp]

Very well explained and demonstrated. Thanks

[@ajaykumark107]

Keep them coming!

[@aahringer]

It would be great to talk about how Windows Defender/AV/EDR and AMSI react to well known tools like PowerSploit and default payloads from msfvenom as they would likely cause an alert to the blue team or be blocked entirely in many situations.

[@skyredfive]

Very nicely explained! Came across this video while researching for my assignment. Can I confirm what is the CVE for this vulnerability and which Microsoft patch remediates this vulnerability? This information would be useful for my assignment and my own try out on my VM. Thanks!

[@volodymyrgorbachov]

That was perfect! Thank you!

[@c0nd4]

Thanks!

[@bernietamberg8581]

excellent video.

[@madhavnakar9396]

Another great video, thank you. Any tips about how to use this when powershell is not available on a box? I frequently come across boxes that when I run powershell commands, the reverse shell drops, which can be frustrating.

[@c0nd4]

Thank you! If you don't have powershell available, you can find services that have unquoted paths with a wmic command. I don't remember the syntax off the top of my head, but I'm sure you can find out online. Good luck!

[@slythx5231]

Hi@@c0nd4, that must be "wmic service get pathname,startname", right? But this is manual checking. How can we automate this or at least lessen the output for the unquoted path services only?

[@c0nd4]

Try this command: wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

[@slythx5231]

I think this will work: wmic service get pathname,startmode | findstr /V "C:\Windows\\" | findstr /i /v "c:\" | findstr /i /v """

[@c0nd4]

Great minds think alike 😉

[@Saw-o3h]

why you didnt do last part in terminal? we dont have access to the rdp. this part wasnt good actually. I know how to do that but many people dont and come here to leran mate. I wish you did last part in terminal too. thanks

[@scout17s17]

Thank you very much!

[@c0nd4]

No problem!

[@koushiksuthar95]

Very helpful 👍

[@c0nd4]

Glad to hear. Thanks!

[@ytg6663]

Gow can i automate it using c++ programmatically ?

[@MrJingy08]

excellent stuff

[@c0nd4]

Thank you!

[@Waseemakram-eb9ws]

awesome man

[@c0nd4]

Thanks!

[@aryavrata4542]

I don't have vulnservice running in my services.

[@c0nd4]

Sorry if it that wasn't clear. Windows does not come with a service called "VulnService". I created that for the video. You can create this service using the "sc create" command if you'd like to try it. Good luck!

[@roya2045]

Hi if i have the domain admin password i can access the local systems in my domain using the password. But if i want to access a system that is connected to local Lan but without being in domain how can I gain access to that system I tried using my domain admin password on that system but seems like that does not work. Please reply

[@c0nd4]

A domain administrator password will only work on domain joined machines

[@taiquangong9912]

Done this on THM and was missing a step.

[@icarus1656]

good video

[@c0nd4]

Thanks!

[@aulisarinili7297]

Windows part seemed so hard to me.

[@anntakamaki1960]

Why does Windows look for the file like that? Seems kind of dumb for Windows to do that.

[@jamalnasir5648]

So how do you fix this? Should have explained that as well

[@c0nd4]

Put quotes around the service path

[@jamalnasir5648]

@@c0nd4 Thanks. I found the settings in the registry to change to quotes

[@xcets.]

i just played you in modern warfare. gg

[@c0nd4]

GG

[@syd824]

duuuuuuuude.......leker content. Well explained.