discover Unquoted Service Paths that can be abused to escalate privileges

lpe_svcs.ps1

#Requires -RunAsAdministrator

$services = Get-WmiObject win32_service  | select Name, PathName

Foreach ( $entry in $services ) {
    if ( $entry.PathName -match "Program" ) {
            if ( $entry.PathName -notmatch "\`"*\`"" -and  $entry.PathName -match " ") {
            Write-Host "Potentially Vulnerable Service: $($entry.Name) with Path: $($entry.PathName)" -BackgroundColor DarkGreen
        }
    }
}