Certified Ethical Hacker CEH · Free Practice Question Medium
Question 39
Jason is conducting a penetration test against an organization's Windows network. He then enters a command into the shell and receives the following output:
-=-=-=-=-=-
C:\Users\jason\Desktop> wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
VulnerableService Some Vulnerable Service C:\Program Files\A Subfolder\B Subfolder\SomeExecutable.exe
-=-=-=-=-=-
Based on the output above, which of the following types of vulnerabilities does this Windows system contain?
- A Writeable services
- B Clear text credentials in LDAP
- C Unquoted service path
- D Unsecure file/folder permissions
Reveal correct answer
Correct answer: C
Explanation
OBJ-2.3: This Windows machine contains an unquoted service path vulnerability, as shown in the output. If a service is created with an executable path that contains spaces and is not enclosed within quotes, then an unquoted service path vulnerability exists. In Windows, if the service is not enclosed within quotes and is having spaces, it would handle the space as a break and pass the rest of the service path as an argument. If the service involved has SYSTEM privileges, an attacker could exploit this vulnerability and gain SYSTEM level access. This command finds the service name, executable path, the display name of the service, and auto starts in all the directories except C:\Windows\ (since by default there is no such service that has spaces and is unquoted in this folder). As shown in the output, the service called "VulnerableService" has an unquoted service path.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
