All right.
Unquote.
Service parts.
What is it unquote in service bad.
So if you have a service executable which path is not enclosed in quotation marks and contains a space
then you're going to have an issue.
So let's go ahead and take a look and explain what that means.
We scroll up just a little bit to these unquote IT service path that was identified here by power up.
You could see and ignore this AWOL light agent.
We're actually looking for this encoded service right here.
So what do I mean.
Well if you see the path see.
Program Files.
There's a space in the program files there's also a space in the past services common files.
Lot of spaces here no quotes no quotes.
And let's go ahead and take a look at what I mean by no quotes.
If we go to reject it we just say Reg edit and hit enter in here.
If you go down to the H KLM system current controls set services and I'll scroll up just a little bit
for you.
So we're in H K L L N H key local machine system current controls set services what we're looking for
here is if we scroll down and we go to the unquote quoted service path unquote ID service right.
Look at this path this image path here remember we discussed the image path look at it we've got no
quotes around it meaning that we can modify this and get malicious because this isn't actually quoted
OK so what's going to happen now is Windows is going to attempt to run this service and when they attempt
to run the service it's going to look through each of the parts in order so it's gonna say Hey C program
files or C program that E C C program files I c c program files and is going to look for unquote a taxi
encoded path that you see unquote of service that you see so forth.
So what we're going to do is we're going to put a file here that's called common dot XY and it's going
to try to run that so again remember it's going to say hey because there's no quotes around this it's
going to go see program that you see program files are XY encoded at XY all the way through.
So we can place this file maliciously anywhere we want in here but we're gonna put it in common just
a proof concept and you're going to see that common is going to execute before this unquote service
path actually executes and we're going to get a shell off of this.
So let's go ahead and attempt to do that.
So what I want to do is I want to do another maternal critter type shell so we're gonna go in here and
we're just going to call out and we're going to say something along the lines of we've actually got
one here I'm going to exit off of this shell and I'm going to do a run in our multi handler actually
I'll kill this for a second.
Let me show the options our multi handler again same thing where we should have windows mature operator
reverse DCP running here with our l host and then we can just do a run and this will get a mature British
shell.
Now if you don't want a mature British shell you can absolutely do this with something like net cat
and get the same type of results.
But for now we're just going to utilize the maturity or method.
So we're going to come through here.
I'm going to hit control c I'm going to generate the same thing I did before.
So if you tap up a couple times you should have the same type of payload I'm using to call this common
that e XY and I'm just showing this for proof of concept since we've already got it on the machine a
few times but just repeating the process over and over.
Now if you wanted this to not be a Windows interpreter you could totally do just a Windows and then
say something like reverse DCP and do that and then you would get your shell as well so you would just
run that cat with that instead of running the interpreter.
Now I challenge you to try to do that see if you get a shell back but we're going to utilize this one
more time so go ahead and start up your simple server.
I'm going to load up this and navigate out to ten eleven forward at 114 when I download common that
EMC.
I'm going to save it and I'm going to actually save it to C program files encoded path service and then
we're just in call it common that you see.
Now you could see common files is in here.
We're going to Trickett and go come and see first hit save and close that out and now if we restart
the service or we actually start the service you'll see that we go ahead and execute this.
Let's do a command at XY and then I'm just going to say SC start unquote quoted service
and if we check our shell over here we just got a mature procession get you idea and you see we are
authorities system.
So we do not have to be anybody here we can be the regular user and we're abusing this path because
this path is going to run as the system when it starts.
So we just took full control of this because of a basic basic mistake with the path quoting now again
you would expect to see it in the registry here and you're going to catch this very very easily with
something like power up.
Now this eight of us light agent is actually not intentional.
So don't attack this.
I think this has to do with the labs but this looks like it could be on its own something that we could
write to as well if this directory was right able say it's going out and checking program files.
Right.
So we could write maybe to Amazon that EMC or even programmed out EMC and drop it in C we could write
in to see and put program we might be we'll take over this as well.
So think about that when you're thinking through this from here.
Congratulations we've made it through pretty much all of the lab.
What I want to show you really quick is that we have a few down here that are included in this lab that
you can take advantage of.
Now there are the kernel exploits hot potato and then there's some password mining exercises we've already
covered all of this so I'm not going to go back and cover this again.
However I do encourage you to come through here click on it and kind of just follow your way through
and exploit this have fun with this lab completed all the way through and enjoy your experience here.
From here we're going to move on and we're going to actually perform a couple more boxes.
So we're gonna do two more boxes and we're going to use try to hack me to do that.
The next box is going to be a encoded service path escalation.
So great practice.
So we're gonna meet you in the next video and we're going to talk about the next box so we're gonna
cover and we'll walk through that one.
So I will see you in the next video.