>Once you have identified a vulnerable service, you can query to confirm that the path is indeed unquoted.</p>
<p><img src="Resources/Images/USP/Unquoted%20Service%20Path.png" alt="" /></p>
<p><img src="Resources/Images/USP/Query%20unquotedsvc.png" alt="" /></p>
<p>Let's check our access to the possible directories that will be probed by Windows:</p>
<pre><code class="language-powershell">accesschk.exe /accepteula -uwdq &lt;directory&gt;
</code></pre>
<p><img src="Resources/Images/USP/Check%20Directory%20Pe