Windows Privilege Escalation: Weak Service Permissions

Windows operating systems use background services to run administrative tasks. If local users possess write permissions to these service binaries, the host is vulnerable.

1. Unquoted Service Paths

If a service path contains spaces and is not enclosed in quotation marks, Windows attempts to execute files at intermediate directories first:

C:\Program Files\Weak Folder\Service.exe

Windows will try to load: `C:\Program.exe`, then `C:\Program Files\Weak.exe` before reaching the service. If users possess write permissions to `C:\`, they can place a payload there.

2. Remediating Service Paths

Always enclose service binaries in quotation marks inside registry values:

"C:\Program Files\Weak Folder\Service.exe"