Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/ivan-sincek/unquoted-service-paths
List unquoted service paths and start, stop, or restart services as needed.
https://github.com/ivan-sincek/unquoted-service-paths
bug-bounty ethical-hacking offensive-security penetration-testing powershell red-team-engagement restart security unquoted-services windows windows-penetration-testing
Last synced: about 2 months ago
JSON representation
List unquoted service paths and start, stop, or restart services as needed.
- Host: GitHub
- URL: https://github.com/ivan-sincek/unquoted-service-paths
- Owner: ivan-sincek
- License: mit
- Created: 2020-04-19T03:35:05.000Z (almost 5 years ago)
- Default Branch: master
- Last Pushed: 2021-07-14T18:02:27.000Z (over 3 years ago)
- Last Synced: 2024-10-17T16:21:18.142Z (3 months ago)
- Topics: bug-bounty, ethical-hacking, offensive-security, penetration-testing, powershell, red-team-engagement, restart, security, unquoted-services, windows, windows-penetration-testing
- Language: PowerShell
- Homepage:
- Size: 15.6 KB
- Stars: 4
- Watchers: 2
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Unquoted Service Paths
List unquoted service paths and start, stop, or restart services as needed.
Some services require administrative privileges.
Tested with PowerShell v5.1.18362.752 on Windows 10 Enterprise OS (64-bit).
Made for educational purposes. I hope it will help!
## How to Run
Open the PowerShell from [\\src\\](https://github.com/ivan-sincek/unquoted-service-paths/tree/master/src) and run the commands shown below.
Set the execution policy:
```pwsh
Set-ExecutionPolicy Unrestricted
```Run the script:
```pwsh
.\unquoted_service_paths.ps1
```Or, run the following command from either PowerShell or Command Prompt:
```pwsh
PowerShell -ExecutionPolicy Unrestricted -File .\unquoted_service_paths.ps1
```To run the PowerShell encoded command, run the following command from either PowerShell or Command Prompt ([minified script](https://github.com/ivan-sincek/unquoted-service-paths/blob/master/src/unquoted_service_paths_mini.ps1)):
```pwsh
PowerShell -ExecutionPolicy Unrestricted -EncodedCommand JABzAHMAIAA9ACAAJABuAHUAbABsADsAIAAkAGkAIAA9ACAAJABuAHUAbABsADsAIAB0AHIAeQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBGAGUAdABjAGgAaQBuAGcAIAB0AGgAZQAgAGwAaQBzAHQAIABvAGYAIABzAGUAcgB2AGkAYwBlAHMALAAgAHQAaABpAHMAIABtAGEAeQAgAHQAYQBrAGUAIABhACAAdwBoAGkAbABlAC4ALgAuACIAOwAgACQAcwBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAFMAZQByAHYAaQBjAGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AUABhAHQAaABOAGEAbQBlACAALQBpAG4AbwB0AG0AYQB0AGMAaAAgACIAYAAiACIAIAAtAGEAbgBkACAAJABfAC4AUABhAHQAaABOAGEAbQBlACAALQBpAG4AbwB0AG0AYQB0AGMAaAAgACIAOgBcAFwAVwBpAG4AZABvAHcAcwBcAFwAIgAgAC0AYQBuAGQAIAAoACQAXwAuAFMAdABhAHIAdABNAG8AZABlACAALQBlAHEAIAAiAEEAdQB0AG8AIgAgAC0AbwByACAAJABfAC4AUwB0AGEAcgB0AE0AbwBkAGUAIAAtAGUAcQAgACIATQBhAG4AdQBhAGwAIgApACAALQBhAG4AZAAgACgAJABfAC4AUwB0AGEAdABlACAALQBlAHEAIAAiAFIAdQBuAG4AaQBuAGcAIgAgAC0AbwByACAAJABfAC4AUwB0AGEAdABlACAALQBlAHEAIAAiAFMAdABvAHAAcABlAGQAIgApACAAfQA7ACAAaQBmACAAKAAkACgAJABzAHMAIAB8ACAATQBlAGEAcwB1AHIAZQApAC4AQwBvAHUAbgB0ACAALQBsAHQAIAAxACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAE4AbwAgAHUAbgBxAHUAbwB0AGUAZAAgAHMAZQByAHYAaQBjAGUAIABwAGEAdABoAHMAIAB3AGUAcgBlACAAZgBvAHUAbgBkACIAOwAgAH0AIABlAGwAcwBlACAAewAgACQAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAC0AUAByAG8AcABlAHIAdAB5ACAAUAByAG8AYwBlAHMAcwBJAGQALAAgAE4AYQBtAGUAIAB8ACAARgBvAHIAbQBhAHQALQBMAGkAcwB0ACAALQBQAHIAbwBwAGUAcgB0AHkAIABQAHIAbwBjAGUAcwBzAEkAZAAsACAATgBhAG0AZQAsACAARABpAHMAcABsAGEAeQBOAGEAbQBlACwAIABQAGEAdABoAE4AYQBtAGUALAAgAFMAdABhAHIAdABOAGEAbQBlACwAIABTAHQAYQByAHQATQBvAGQAZQAsACAAUwB0AGEAdABlADsAIAAkAG4AIAA9ACAAJAAoAFIAZQBhAGQALQBIAG8AcwB0ACAALQBQAHIAbwBtAHAAdAAgACIARQBuAHQAZQByACAAcwBlAHIAdgBpAGMAZQAgAG4AYQBtAGUAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgAGkAZgAgACgAJABuAC4ATABlAG4AZwB0AGgAIAAtAGwAdAAgADEAKQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBTAGUAcgB2AGkAYwBlACAAbgBhAG0AZQAgAGkAcwAgAHIAcQB1AGkAcgBlAGQAIgA7ACAAfQAgAGUAbABzAGUAIAB7ACAAJABlACAAPQAgACQAZgBhAGwAcwBlADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHMAIABpAG4AIAAkAHMAcwApACAAewAgAGkAZgAgACgAJABzAC4ATgBhAG0AZQAgAC0AZQBxACAAJABuACkAIAB7ACAAJABlACAAPQAgACQAdAByAHUAZQA7ACAAYgByAGUAYQBrADsAIAB9ACAAfQAgAGkAZgAgACgAJABlACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAWwAxAF0AIABTAHQAYQByAHQAIAAgACAAYABuAFsAMgBdACAAUwB0AG8AcAAgACAAIAAgAGAAbgBbADMAXQAgAFIAZQBzAHQAYQByAHQAIABgAG4ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7ACAAJABjACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAFkAbwB1AHIAIABjAGgAbwBpAGMAZQAiACkALgBUAHIAaQBtACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAaQBmACAAKAAkAGMAIAAtAGUAcQAgACIAMQAiACAALQBvAHIAIAAkAGMAIAAtAGUAcQAgACIAMgAiACAALQBvAHIAIAAkAGMAIAAtAGUAcQAgACIAMwAiACkAIAB7ACAAJABpACAAPQAgAEcAZQB0AC0AUwBlAHIAdgBpAGMAZQAgAC0ATgBhAG0AZQAgACQAcwAuAE4AYQBtAGUAOwAgAGkAZgAgACgAJABjACAALQBlAHEAIAAiADIAIgAgAC0AbwByACAAJABjACAALQBlAHEAIAAiADMAIgApACAAewAgAGkAZgAgACgAJABpAC4AUwB0AGEAdAB1AHMAIAAtAGUAcQAgACIAUwB0AG8AcABwAGUAZAAiACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBlAHIAdgBpAGMAZQAgAGkAcwAgAG4AbwB0ACAAcgB1AG4AbgBpAG4AZwAiADsAIAB9ACAAZQBsAHMAZQBpAGYAIAAoACQAcwAuAFMAdABvAHAAUwBlAHIAdgBpAGMAZQAoACkALgBSAGUAdAB1AHIAbgBWAGEAbAB1AGUAIAAtAG4AZQAgADAAKQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBDAGEAbgBuAG8AdAAgAHMAdABvAHAAIAB0AGgAZQAgAHMAZQByAHYAaQBjAGUAIgA7ACAAfQAgAGUAbABzAGUAIAB7ACAAZABvACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAyADAAMAA7ACAAJABpAC4AUgBlAGYAcgBlAHMAaAAoACkAOwAgAH0AIAB3AGgAaQBsAGUAIAAoACQAaQAuAFMAdABhAHQAdQBzACAALQBuAGUAIAAiAFMAdABvAHAAcABlAGQAIgApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBTAGUAcgB2AGkAYwBlACAAaABhAHMAIABiAGUAZQBuACAAcwB0AG8AcABwAGUAZAAgAHMAdQBjAGMAZQBzAHMAZgB1AGwAbAB5ACIAOwAgAH0AIAB9ACAAaQBmACAAKAAkAGMAIAAtAGUAcQAgACIAMwAiACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAfQAgAGkAZgAgACgAJABjACAALQBlAHEAIAAiADEAIgAgAC0AbwByACAAJABjACAALQBlAHEAIAAiADMAIgApACAAewAgAGkAZgAgACgAJABpAC4AUwB0AGEAdAB1AHMAIAAtAGUAcQAgACIAUgB1AG4AbgBpAG4AZwAiACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBlAHIAdgBpAGMAZQAgAGkAcwAgAGEAbAByAGUAYQBkAHkAIAByAHUAbgBuAGkAbgBnACIAOwAgAH0AIABlAGwAcwBlAGkAZgAgACgAJABzAC4AUwB0AGEAcgB0AFMAZQByAHYAaQBjAGUAKAApAC4AUgBlAHQAdQByAG4AVgBhAGwAdQBlACAALQBuAGUAIAAwACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIAB0AGgAZQAgAHMAZQByAHYAaQBjAGUAIgA7ACAAfQAgAGUAbABzAGUAIAB7ACAAZABvACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAyADAAMAA7ACAAJABpAC4AUgBlAGYAcgBlAHMAaAAoACkAOwAgAH0AIAB3AGgAaQBsAGUAIAAoACQAaQAuAFMAdABhAHQAdQBzACAALQBuAGUAIAAiAFIAdQBuAG4AaQBuAGcAIgApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBTAGUAcgB2AGkAYwBlACAAaABhAHMAIABiAGUAZQBuACAAcwB0AGEAcgB0AGUAZAAgAHMAdQBjAGMAZQBzAHMAZgB1AGwAbAB5ACIAOwAgAH0AIAB9ACAAfQAgAGUAbABzAGUAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIASQBuAHYAYQBsAGkAZAAgAGMAaABvAGkAYwBlACIAOwAgAH0AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBTAGUAcgB2AGkAYwBlACAAZABvAGUAcwAgAG4AbwB0ACAAZQB4AGkAcwB0AHMAIgA7ACAAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAcwBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAHMAcwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIAB9ACAAaQBmACAAKAAkAGkAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQAuAEMAbABvAHMAZQAoACkAOwAgACQAaQAuAEQAaQBzAHAAbwBzAGUAKAApADsAIAB9ACAAfQANAAoA
```To generate a PowerShell encoded command from a PowerShell script, run the following PowerShell command:
```pwsh
[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes([IO.File]::ReadAllText($script)))
```To decode a PowerShell encoded command, run the following PowerShell command:
```pwsh
[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($command))
```## Images
Figure 1 - Unquoted Service Paths