Question

During a host-based assessment of a Windows server, you obtain a low-privileged shell. Enumerating services, you find one running as LocalSystem with the following configuration:

BINARY_PATH_NAME : C:\Program Files\Acme Data\Sync Agent\agent.exe

The service path is not enclosed in quotation marks. You also confirm you have write access to C:\Program Files\Acme Data\. Which action most directly exploits this misconfiguration to escalate privileges?

Accepted Answer

Place a malicious executable named Sync.exe in C:\Program Files\Acme Data\ and restart the service so it runs as SYSTEM

Answer

Place a malicious executable named Acme.exe in C:\Program Files\ so Windows executes it before resolving the full path

Answer

Replace agent.exe directly with a payload since the service already runs as LocalSystem

Answer

Modify the service's BINARY_PATH_NAME with sc config to point to your payload