OS & Service Exploitation — Quick Reference¶

This is a quick reference page. For detailed exploitation steps, see the dedicated pages:

• Unquoted Service Paths — Exploiting unquoted paths with spaces
• Weak Service Permissions — Modifiable service config (binPath) and writable binaries
• DLL Hijacking — Search order abuse, missing DLLs, DLL proxying
• AlwaysInstallElevated & Tasks — Malicious MSIs and writable scheduled tasks
• UAC Bypass — fodhelper, eventvwr, UACME, token impersonation
• Kernel Exploits — Exploit suggesters, EternalBlue, PrintNightmare, HiveNightmare

Quick Detection Cheatsheet¶

1. Unquoted Service Paths¶

wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows" | findstr /i /v """

2. Modifiable Services (Requires PowerUp/accesschk)¶

# PowerUp
Get-ModifiableService
Get-ModifiableServiceFile

3. AlwaysInstallElevated¶

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
:: Both must be 1 (0x1)

4. Scheduled Tasks¶

schtasks /query /fo LIST /v | findstr /B /C:"TaskName" /C:"Run As User" /C:"Task To Run" | findstr -A 1 "SYSTEM"

5. Kernel Vulnerabilities (Requires wesng/Sherlock)¶

systeminfo > sysinfo.txt
:: Run wesng against sysinfo.txt on attacker machine