During a routine internal audit of an enterprise infrastructure, a security analyst reviews a vulnerability scan report for an Active Directory server host. The scan highlights that a custom system service executable path is configured as C:\Program Files\Enterprise Apps\Service Manager\service.exe without quotation marks, and the directory C:\Program Files\Enterprise Apps has write permissions granted to unprivileged users. Which of the following host vulnerabilities does this specific configuration represent?
- Unquoted service path vulnerability enabling privilege escalation via executable hijackingCevap
- BPerimeter network firewall misconfiguration permitting unauthorized inbound traffic
- CWeb application input validation defect permitting database manipulation via SQL injection
- DInappropriate selection of a network control to patch an application memory leak
Cevap
Unquoted service path vulnerability enabling privilege escalation via executable hijacking
The correct answer identifies an unquoted service path vulnerability. When Windows launches a service whose file path contains spaces and lacks surrounding quotation marks, the Windows Service Control Manager interprets spaces as argument delimiters. It attempts to launch executable candidates in order, such as C:\Program.exe, C:\Program Files\Enterprise.exe, etc. Because unprivileged users have write access to the directory, an attacker can drop a malicious binary at one of those locations, achieving local privilege escalation when the service executes.
Adım Adım Çözüm
Anahtar Kavram
Host Service Path Hardening and Privilege Escalation Vulnerabilities