Windows Privilege Escalation - Unquoted Service Path

[@celeretaudaxx]

Another banger, well explained, well presented, well exploited thank you!

[@c0nd4]

Thank you for the kind words 😁

[@programmingcheatsheet]

Stumbled on this video looking for details on a homework assignment, and as someone with no previous experience doing anything security related this was well done and coherent enough for me to follow. Liked, subbed, & bookmarked. Don't stop making videos like this

[@dawnsix]

Your content is really good man, much appreciated.

[@c0nd4]

No problem! I appreciate the support!

[@bex3911]

Great explained realy helped me out 😁 ... cant wait for more WindosPrivesc Vids.

[@c0nd4]

Thank you! Glad I could help. If all goes as planned, there could be a new windows priv esc video out tomorrow 😉

[@kallikantzaros]

Born to be educator :) Well put my friend, explained it very well like in your other videos.

[@c0nd4]

Thank you!

[@will227inyoface2]

Are you still making videos? I just found this while studying for my PenTest+ and this content is fantastic! Subscribed!

[@waltzofthestars2078]

wonderfully explained, makes it seem simple af while also noting every little detail. Thanks!

[@c0nd4]

No problem! Thank you for the feedback, I appreciate it 🙂

[@travispatt907]

You are awesome, thank you. This helped me so much with understanding some material for Pentest+.

[@HK-sw3vi]

had to login to say how good this video is. thanks a bunch man

[@c0nd4]

Thank you!

[@tomyates5346]

Good stuff. Clear and concise explanation. Thanks!

[@wolfgang-lj2hp]

Very well explained and demonstrated. Thanks

[@aahringer]

It would be great to talk about how Windows Defender/AV/EDR and AMSI react to well known tools like PowerSploit and default payloads from msfvenom as they would likely cause an alert to the blue team or be blocked entirely in many situations.

[@8080VB]

God tier explanation. Thank you!

[@madhavnakar9396]

Another great video, thank you. Any tips about how to use this when powershell is not available on a box? I frequently come across boxes that when I run powershell commands, the reverse shell drops, which can be frustrating.

[@c0nd4]

Thank you! If you don't have powershell available, you can find services that have unquoted paths with a wmic command. I don't remember the syntax off the top of my head, but I'm sure you can find out online. Good luck!

[@slythx5231]

Hi@@c0nd4, that must be "wmic service get pathname,startname", right? But this is manual checking. How can we automate this or at least lessen the output for the unquoted path services only?

[@c0nd4]

Try this command: wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

[@slythx5231]

I think this will work: wmic service get pathname,startmode | findstr /V "C:\Windows\\" | findstr /i /v "c:\" | findstr /i /v """

[@c0nd4]

Great minds think alike 😉

[@volodymyrgorbachov]

That was perfect! Thank you!

[@c0nd4]

Thanks!

[@ajaykumark107]

Keep them coming!

[@bernietamberg8581]

excellent video.

[@scout17s17]

Thank you very much!

[@c0nd4]

No problem!

[@aryavrata4542]

I don't have vulnservice running in my services.

[@c0nd4]

Sorry if it that wasn't clear. Windows does not come with a service called "VulnService". I created that for the video. You can create this service using the "sc create" command if you'd like to try it. Good luck!

[@ytg6663]

Gow can i automate it using c++ programmatically ?

[@skyredfive]

Very nicely explained! Came across this video while researching for my assignment. Can I confirm what is the CVE for this vulnerability and which Microsoft patch remediates this vulnerability? This information would be useful for my assignment and my own try out on my VM. Thanks!

[@Saw-o3h]

why you didnt do last part in terminal? we dont have access to the rdp. this part wasnt good actually. I know how to do that but many people dont and come here to leran mate. I wish you did last part in terminal too. thanks

[@koushiksuthar95]

Very helpful 👍

[@c0nd4]

Glad to hear. Thanks!

[@MrJingy08]

excellent stuff

[@c0nd4]

Thank you!

[@taiquangong9912]

Done this on THM and was missing a step.

[@jamalnasir5648]

So how do you fix this? Should have explained that as well

[@c0nd4]

Put quotes around the service path

[@jamalnasir5648]

@@c0nd4 Thanks. I found the settings in the registry to change to quotes

[@Waseemakram-eb9ws]

awesome man

[@c0nd4]

Thanks!

[@roya2045]

Hi if i have the domain admin password i can access the local systems in my domain using the password. But if i want to access a system that is connected to local Lan but without being in domain how can I gain access to that system I tried using my domain admin password on that system but seems like that does not work. Please reply

[@c0nd4]

A domain administrator password will only work on domain joined machines

[@icarus1656]

good video

[@c0nd4]

Thanks!

[@anntakamaki1960]

Why does Windows look for the file like that? Seems kind of dumb for Windows to do that.

[@aulisarinili7297]

Windows part seemed so hard to me.

[@xcets.]

i just played you in modern warfare. gg

[@c0nd4]

GG

[@syd824]

duuuuuuuude.......leker content. Well explained.