Unquoted Service Paths — escalation of privileges by abusing misconfigured services
Tags: Windows, Services, Microsoft

Unquoted Service Paths — escalation of privileges by abusing misconfigured services Maksym Aug 23·7 min read

The principle of the attack technique:

MITRE ID: T1574.009

https://attack.mitre.org/techniques/T1574/009/

Omitted “double quotes” in the path of the executable service is a common error when configuring services in Windows operating systems. During service startup, Windows determines the location of the executable file to be launched based on its full path. Typically, the full path of the service file is enclosed in double quotes and is treated as an integral path by the operating system.

If the path of the executable file is not contained in “double quotes” and contains at least one space, then Windows will try to find and run the executable file in each folder along the path, using the path before the “space” as the file name.

For example, the path to service is as follows:

The path of the service being started contains spaces in several places, which we marked with *.

In order to start SERVICE.EXE Windows will iterate over this path in the following order:

In the absence of an executable file, the system will move on in search of the next executable file.

If the attacker places their executable file on any of the stages — this will lead to an interception of the service startup process and to a successful implementation of the attack.

If an account has write permissions in one of the above directories, an attacker can use it to place a malicious executable file in this folder, which will be executed under the SYSTEM account.

By default, standard users are not allowed to write to the root directory of the C:\drive, however, there are Companies that remove these restrictions on some user hosts and servers to allow users’ work with various software products in a the “simpler” fashion.

In this case, any user can execute arbitrary code under SYSTEM rights.

In addition, as cyber investigations shows, a high number of Companies, grant local administrator rights to almost all users, without considering the implications and as a result, attackers can use Unquoted Service Paths using a local administrator account.

Why do cybercriminals need this if they already have local administrator rights?

1. Even the rights of local administrators have their own restrictions.

An attacker needs SYSTEM rights to disable any defence systems on the host: antivirus, firewall, etc.

These actions can go “unnoticed” for SIEM, since these actions will occur from SYSTEM which can be regarded as, for example, a system failure.

The priority of this event will not be high profile enough to be investigated immediately.

lost time will allow an attacker to download additional malicious modules, spread their influence over the infrastructure and cover their tracks on the host.

2. When configuring their SIEM systems, many Companies simply exclude events from the SYSTEM user from incidents and perform pre-filtering at the connector level in order to save both traffic costs and the number of false positives.

Assessment method

We suggest that you immediately check your computer for vulnerable services;

1. Start the system window “Run” in Windows by using the key combination Win + R

2. In the window that appears, enter the command “cmd”.

3. When the console opens, enter the following command:

If, as a result of the command execution, you have records and the path with the service contains spaces, then you are vulnerable to an attack.

A required nebula service has been detected on our host.

The service is loaded and running.

Proof of concept

Now we will try to check what the presence of such vulnerable services is laden with.

To do this, we will go through the process that penetration-testers or attackers usually follow when creating the described vulnerability.

For this test, we will use the LocalUser account that does not have administrative privileges on the host.

Check the access rights this user has to the root directory of the C:\drive

In our test, we were lucky.

The standard Users group has write permissions to the root directory of the C:\drive

Now we can create an executable file Program.exe and place it on the C:\drive, which, after rebooting the host, will be executed as SYSTEM.

After rebooting, Windows will display a message stating that the C:\Program.exe file may disrupt the system, but regardless of this file will be executed.

The attacker does not want the user to see this message after restarting the host, since this situation will raise an alarm and the user may contact the Company’s information security department.

Also, in the event of an investigation, cybersecurity specialists will be able to accurately determine the actions that the attacker performed by reverse engineering this application.

Let’s create a small application Program.exe which will be removed after execution.



Below are the main tasks of our application:

1. Creating a local user HiddenUser

2. Adding the user HiddenUser to the group of local administrators.

3. Compilation of additional file C:\Windows\Temp\officeclicktorun_streamserver.exe whose task will remove Program.exe

4. Shutdown and start officeclicktorun_streamserver.exe

Let’s check the existing users in the system.

The HiddenUser user does not exist.

Place the Program.exe program on the C:\drive as LocalUser.

Let’s reboot the host.

As you can see, the user HiddenUser appeared before any of the users entered the system.

During login, LocalUser will not see a warning window for a conflict in the C:\Program.exe file or the file itself.

Officeclicktorun_streamserver.exe is located in the C:\Windows\Temp folder, whose task was to remove Program.exe.

The real nebula service that should have started is in the “Stopped” state.

Check the presence of the HiddenUser user and his rights.

Administrative rights are required to view the Windows Security log.

To do this, use the created HiddenUser administrative account.

As you can see, the HiddenUser account was created from SYSTEM.

Protection recommendations

Let’s look at one example of how you can defend against this type of attack.

Information about all services that run in the Windows operating system are in the Windows registry:

Find our service nebula.

As you can see in ImagePath, the value (path) is specified without double quotes.

Let’s do the following:

Add double quotes to the path in ImagePath.

Delete user HiddenUser

Place the Program.exe application in the root directory C:\

• Let’s reboot the host.

After rebooting, you can see that the C:\Program.exe file is still present on the host and has not been started.

The user HiddenUser is not present on the system.

A test of the real nebula service has shown that the service is running and its path is now double-quoted and protected.

Reference Material:

1.https://medium.com/@orhan_yildirim/windows-privilege-escalation-unquoted-service-paths-61d19a9a1a6a

2.https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae

3.https://cwe.mitre.org/data/definitions/428.html

4.https://pentestlab.blog/2017/03/09/unquoted-service-path/

5.https://attack.mitre.org/techniques/T1574/009/