Wiki : ./Security/Windows/Privilege Escalation/Unqoted Service Paths.md

  • Paths for services always need to be quoted.
wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

Consider a service called MyService with the following executable:

C:\Program Files\My Service\service.exe

This would result in the following lookup:

C:\Program.exe
C:\Program Files\My.exe
C:\Program Files\My Service\service.exe
i4