A library Windows service uses an unquoted binary path containing spaces, and an intermediate folder is writable by the foothold user. What misconfiguration class is this?
Select an answer to reveal the explanation.
Short Explanation
Unquoted paths with spaces are the Windows equivalent of a confusing street address—the OS may knock on the wrong door first. If you can write to an earlier folder in that path, you get a classic service misconfig lead. It is about path parsing, not DNS or SMBv1.
Full Explanation
A library Windows service with an unquoted binary path containing spaces, plus an intermediate folder writable by the foothold user, is a classic unquoted service path privilege issue: the service manager may execute an attacker-placed binary when resolving the path.
This is not DNS cache poisoning for external resolution. It does not prove SMBv1 must remain enabled. It is not certificate pinning failure limited to browser admin portals.
Exam caveat: both the unquoted path and writable intermediate directory matter; quoting alone or ACL hardening alone may be incomplete depending on layout.
Operational check: enumerate service ImagePath values, identify unquoted paths with spaces, test writable segments within RoE, and recommend quoted paths plus locked-down directories for library Windows services. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.