Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

During a routine internal audit of an enterprise infrastructure, a security analyst reviews a vulnerability scan report for an Active Directory server host. The scan highlights that a custom system service executable path is configured as C:\Program Files\Enterprise Apps\Service Manager\service.exe without quotation marks, and the directory C:\Program Files\Enterprise Apps has write permissions granted to unprivileged users. Which of the following host vulnerabilities does this specific configuration represent?

  1. Unquoted service path vulnerability enabling privilege escalation via executable hijackingAnswer
  2. B
    Perimeter network firewall misconfiguration permitting unauthorized inbound traffic
  3. C
    Web application input validation defect permitting database manipulation via SQL injection
  4. D
    Inappropriate selection of a network control to patch an application memory leak

Answer

Unquoted service path vulnerability enabling privilege escalation via executable hijacking
The correct answer identifies an unquoted service path vulnerability. When Windows launches a service whose file path contains spaces and lacks surrounding quotation marks, the Windows Service Control Manager interprets spaces as argument delimiters. It attempts to launch executable candidates in order, such as C:\Program.exe, C:\Program Files\Enterprise.exe, etc. Because unprivileged users have write access to the directory, an attacker can drop a malicious binary at one of those locations, achieving local privilege escalation when the service executes.

Step-by-Step Solution

1
Analyze the host configuration report
Identify that the service binary path contains spaces without quotes (C:\Program Files\Enterprise Apps\Service Manager\service.exe) and weak folder write permissions.
Windows service executable paths containing spaces without surrounding quotation marks cause the Service Control Manager to evaluate candidate paths prior to each space.
2
Determine the impact of user write permissions
Unprivileged users can write files to intermediate path folders such as C:\Program Files\Enterprise Apps.
If a user writes an executable named Enterprise.exe in that directory, the operating system will execute it under the service's privileges (typically SYSTEM) upon service start.
3
Match the weakness to host vulnerability definitions
Confirm that this specific flaw is classified as an unquoted service path privilege escalation vulnerability.
It represents a classic host service configuration vulnerability where path parsing behavior allows local binary hijacking.

Key Concept

Host Service Path Hardening and Privilege Escalation Vulnerabilities
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities