Like any service created with CreateService() , if the path to the executable contains spaces and is not enclosed in quotes, Windows will try to interpret each space-separated token as an executable. For example:
The vulnerability is located in the service.c file, within the nssm_config function. The function reads the service configuration file and parses its contents without proper validation. An attacker can exploit this by creating a malicious configuration file containing specially crafted commands, which will be executed by the service manager. nssm-2.24 exploit
is a legitimate tool for running any executable as a Windows service. Version 2.24 is old (released around 2014–2015) but still widely used in production. Like any service created with CreateService() , if
, any user on that machine can potentially "hijack" the service for full administrative access. Odoo 12.0.20190101 - 'nssm.exe' Unquoted Service Path An attacker can exploit this by creating a
sc config binpath= "\"C:\Program Files\NSSM\nssm.exe\"" Use code with caution. Copied to clipboard Restrict Permissions
If a service using NSSM is configured with an unquoted path containing spaces (e.g., C:\Program Files\App\nssm.exe ), an attacker can place a malicious executable at C:\Program.exe . Windows will attempt to execute Program.exe first when starting the service. Persistence and Malware:
The nssm-2.24 exploit typically involves the following steps:
Для улучшения работы сайта мы используем файлы cookie. Нажимая кнопку «Принять», Вы даете согласие на обработку файлов «Cookie» в соответствии с Политикой конфиденциальности. Вы можете отключить файлы cookie в настройках Вашего браузера