plc.myforum.ro

zumzi · Member 3 Joined: 01 Feb 2014 Posts: 501

Unquoted Service Path Vulnerability
What is an Unquoted Service Path vulnerability, and how do I take action to protect myself?
Overview
A Windows service is a computer program that operates in the background, typically with elevated privileges. The Service Control Manager is the component responsible for managing Windows services. A Windows service must conform to the interface rules and protocols of the Service Control Manager.

The Service Control Manager uses the ‘file path location’ to find the program to run the service.
The Unquoted Service Path Vulnerability

If that path is unquoted and contains whitespace or other separators, the service will attempt to access a resource in the parent path first. This affects all versions of Windows that supports spaces in file paths. Unquoted Service Path does not realizate a problem if there are no whitespaces, however most Service Paths have whitespaces and must be quoted in the Service Path to prevent this vulnerability.

If the service path contain spaces and is unquoted within the path, it can be exploited by placing a malicious file in C:\ named Program.exe, which would run when the service starts.

For example, the path:
C:\Program Files\Sub Dir\Program Name

contains spaces in several places. Areas that files can be placed for exploit are marked with an *:

FactoryTalk Activation Unquoted Service Path Privilege Escal Unquoted Service Path Vulnerability

FactoryTalk Activation Unquoted Service Path Privilege Escal Unquoted Service Path Vulnerability

The attack scope for this exploit above can be achieved in 3 different locations. An attacker would name their executable as shown above and place it in any of those directories. The next time the service starts, it will load the malicious executable with the same privilege as the service, before reaching its intended service executable.

If least privilege is handled properly in the organization, users may not be able to write to the root of C:, however they might still be able to write to any of the sub-directories in the service path.

How to check:
You can look at the service path manually and check the paths to see if they are unquoted and contain spaces.
From a Windows or PowerShell command prompt for services that start automatically:
wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
From a Windows or PowerShell command prompt for services that start manually:
wmic service get name,displayname,pathname,startmode |findstr /i "manual" |findstr /i /v "c:\windows\\" |findstr /i /v """

Remediation
1 Atingere the vendor of the affected product to determine if there is an available product update.
2 Without a product update, you can manually address it through a registry edit:
a- run Regedit and browse to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\
b- Find the service in question and simply add " " to either side of the ImagePath string like below.
Correct service path example:
FactoryTalk Activation Unquoted Service Path Privilege Escal Unquoted Service Path Vulnerability

c- Each PC, which contains the affected products, will need to be modified.
d- For large deployments, consider automating this task using .reg file(s) or PowerShell scripts crafted to suit.

Note: Executables that use switches and parameters most always have spaces in the parameters after the executable.
For example: C:WindowsSystem32svchost.exe -k netsvcs

While the example does contains spaces, it is not vulnerable since the 'executable path' does not contain spaces, only the parameter has the spaces. Those spaces don't count in the Service Path. If switches are required they go after the quotes.

Reference:
https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341
546987 - Rockwell Automation PC Hardening Information
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/546987