> For the complete documentation index, see [llms.txt](https://heinosass.gitbook.io/leet-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heinosass.gitbook.io/leet-sheet/post-exploitation/untitled/windows-privilege-escalation/unquoted-service-paths.md).

# Unquoted Service Paths

{% embed url="<https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#unquoted-service-paths>" %}

If the path to a service (which runs on SYSTEM, for example) doesn’t have quotes around it, then it’s vulnerable. Let’s say there’s a program called program.exe with the path

```
C:\PROGRAM FILES\SUB DIR\PROGRAM NAME
```

Then in the below path, the asterisks are all places you can put your own program.exe to have it get executed when the service gets restarted.

```
C:\PROGRAM*FILES\SUB*DIR\PROGRAM*NAME
```

Note that you might need to be an admin to write under C:\\, but who knows, maybe the subdirectories will allow it.

One-liner to check existence:

```
wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
```

Metasploit module: `exploit/windows/local/trusted_service_path`