René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"PowerUp Get-UnquotedService doesn't check correct paths","articleBody":"Specifically this line: https://github.com/PowerShellMafia/PowerSploit/blob/dev/Privesc/PowerUp.ps1#L2072\r\n\r\n```\r\n$ModifiableFiles = $Service.pathname.Split(' ') | Get-ModifiablePath\r\n```\r\nFor a path like \"C:\\Program Files\\VMware Workstation\\test.exe\":\r\n\r\nGet-ModifiablePath expects: @(\"C:\\Program\", \"C\\Program Files\\VMware\", \"C:\\Program Files\\VMware Workstation\\test.exe\")\r\n\r\nHowever, it receives: @(\"C:\\Program\", \"Files\\VMware\", \"Workstation\\test.exe\").  Get-ModifiablePath checks to see if each of those directories is writable, which returns nothing for \"Files\\VMware\" and \"Workstation\\test.exe\" because it doesn't obviously exist without the prefix of \"C:\\Program\".\r\n\r\nScreenshot proof:  http://i.imgur.com/8thoDIe.png\r\n\r\n\r\nBetter code drop-in replacement (but someone better at PowerShell than me can probably do better since I have 0 PowerShell background aside from stumbling through):\r\n\r\n```\r\n$SplitPath = $Service.pathname.split(' ')\r\n$PossiblePaths = @()\r\n$PathStart = \"\"\r\nForEach ($chunk in $SplitPath) {\r\n      if ($PathStart -ne \"\") {\r\n         $PathStart += \" \"\r\n      }\r\n     $PathStart  += $chunk\r\n     $PossiblePaths += $PathStart\r\n}\r\n$ModifiableFiles = $PossiblePaths | Get-ModifiablePath\r\n```\r\n\r\n\r\nIt looks like this issue affects both master and dev branches.","author":{"url":"https://github.com/Raikia","@type":"Person","name":"Raikia"},"datePublished":"2017-07-17T18:36:31.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/248/PowerSploit/issues/248"}