Technical Blog

Daily stories at Systems MW – Wadih Maalouf

If you deploy a Windows Service, and the binary path doesn’t contain double-quotes, you just created a vulnerability on the system. 

This vulnerability is called “unquoted service path”.

E.g., if your

BINARY_PATH_NAME = C:\Program Files\Dir1\Dir2\serv.exe -service

A user can create an execuable in the C drive called : 

C:\Program.exe

And that will get executed instead of serv.exe when the service starts. 

Ensure to have double quotes in your BINARY_PATH_NAME to avoid creating this vulnerability.