0

Unquoted service paths might be used as a privilege escalation vector after an attacker gains access to a Windows host.

Given Hector's answer in the following question: "Windows Unquoted Search" Fix?

I understand some software may break down if Microsoft disables it.

But is there any option for Windows users to disable it (Of course, they would assume the risk of anything breaking down)? Would it be actually useful for hardening?

4d4143
  • 133
  • 1
  • 8

1 Answers1

2

No you cannot "disable" unquoted service paths. I am not exactly sure what your threat model is here but the best advice I can give in response to your question is to check your system(s) for any instances of unquoted service paths.

wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

Instances of this are commonly raised on pentests via this command and similar tooling for unquoted service path discovery.

J--
  • 278
  • 1
  • 12