Files
oscp/Windows/Services/Unquoted Service Paths.md
2025-11-21 17:17:42 +01:00

10 lines
643 B
Markdown
Raw Permalink Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
### Let's show this in an example with the unquoted service binary path **C:\Program Files\My Program\My Service\service.exe**### . When Windows starts the service, it will use the following order to try to start the executable file due to the spaces in the path.
`C:\Program.exe
C:\Program Files\My.exe
C:\Program Files\My Program\My.exe
C:\Program Files\My Program\My service\service.exe
`*Listing 66 - Example of how Windows will try to locate the correct path of an unquoted service*
Get-CimInstance -ClassName win32_service | Select Name,State,PathName
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """