> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/weak-permissions/un-quoted-service-paths.md).

# Un-quoted Service Paths

When Windows installs a service, it stores the executable path in the registry. If that path contains spaces and is not wrapped in quotes, Windows may parse it incorrectly and check multiple locations for a matching executable. Consider the path below.

```shell-session
C:\Program Files (x86)\Fun Apps\service\FunService.exe
```

Windows will decide the execution method of a program based on its file extension, so it's not necessary to specify it. Windows will attempt to load the following potential executables in order on service start, with a .exe being implied:

* `C:\Program`
* `C:\Program Files`
* `C:\Program Files (x86)\Fun`
* `C:\Program Files (x86)\Fun Apps\service\FunService`

If we can create the following files, we would be able to hijack the service binary and gain command execution in the context of the service, in this case, `NT AUTHORITY\SYSTEM`.

* `C:\Program.exe\`
* `C:\Program Files (x86)\Fun.exe`

{% code title="Query for services with unquoted binpaths" %}

```bat
wmic service get name,displayname,pathname,startmode |findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """
```

{% endcode %}