Unquoted service path (DOS)

Unquoted service path (DOS)

# Get service names without admin access (wmic)
sc query | findstr SERVICE_NAME >> test.txt

# process the file service names for unquoted service path
# tokens=2 will take the second delimited value and put it in %A
for /F "tokens=2 delims=:" %A in (test.txt) do sc qc%A | findstr BINARY_PATH_NAME >> unquoted.txt

# Once we determine which application is vulnerable to this exploit, we then check for write permission 
# on that particular folder so we can replace application with our own in hope of getting privilege escalation.
BINARY_PATH_NAME   : C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

# in older system we use cacls (XP & below), icacls (Integrity Control Access List) on newer systems.
# note the '\' in folder path. 
'''
Inherited folder permissions are displayed as:
 OI - Object inherit    - This folder and files. (no inheritance to subfolders)
 CI - Container inherit - This folder and subfolders.
 IO - Inherit only      - The ACE does not apply to the current file/directory
 ID - Inherited         - The ACE was inherited from the parent directory's ACL.

These can be combined as folllows:
 (OI)(CI)      This folder, subfolders, and files.
 (OI)(CI)(IO)  Subfolders and files only.
     (CI)(IO)  Subfolders only.
 (OI)    (IO)  Files only. 
 '''
 
C:\Users\bob>cacls "Program Files"

C:\Program Files NT SERVICE\TrustedInstaller:F
                 NT SERVICE\TrustedInstaller:(CI)(IO)F
                 NT AUTHORITY\SYSTEM:C
                 NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                 BUILTIN\Administrators:C
                 BUILTIN\Administrators:(OI)(CI)(IO)F
                 BUILTIN\Users:R
                 BUILTIN\Users:(OI)(CI)(IO)(special access:)
                                           GENERIC_READ
                                           GENERIC_EXECUTE

                 CREATOR OWNER:(OI)(CI)(IO)F
                 APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R
                 APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(special access:)
                                                                                    GENERIC_READ
                                                                                    GENERIC_EXECUTE

                 APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:R
                 APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(OI)(CI)(IO)(special access:)
                                                                                       GENERIC_READ
                                                                                       GENERIC_EXECUTE