Powershell - Non-standard update service on host

I started HTB Academy a few weeks ago and started some of the Fundamentals Modules. In Windows Fundamentals, one of the questions there is to “Identify one of the Non-standard update service running on host”,but the module did not mention anything about a command line looking for it and I do not know what a non-standard update service is. From what I understand is that it’s something that didn’t come with the OS.

If someone can explain it to me further, that would be lovely.

Thank you

2 Likes

Is this any help?

2 Likes

Type your comment> @TazWake said:

Is this any help?

Window non-standard application concept - #2 by TazWake - Off-topic - Hack The Box :: Forums

I have a clearer understanding of it now, I will try it again. Thank you so much!

ScriptKiddy Giving away the answer does not direct your associates to discover the means of obtaining the answer by learning the right technique… lol

1 Like

So true. Post removed.

Please, @alex222 don’t just give away the answer. As explained in the post I responded to.

1 Like

This is all cool, of course, but can anyone suggest a detailed explanation with a solution?

1 Like

Hello, this would be the command for you to execute in PowerShell to see it in detail (open PowerShell as administrator).

get-process | Select-Object processname,path | fl

1 Like

Put the file extension after the name. Finally it worked for me.

3 Likes

For anyone going through this: Figured this out thanks to @KisBal 's suggestion.

The question reads:

Identify one of the non-standard update services running on the host. Submit the full name of the service executable (not the DisplayName) as your answer.

You need the file extension too.

I guess I never really learned to read questions properly myself.

Hi :wave:

It was also too complex for me to quickly understand the answer format. :crazy_face:

Some steps for execution:
First of all it came to me with an attempt to use applications in WINDOWS. Services app - it’s a table (knowing the answer, the key is on properties of the service, the path). It seems too simple and at that time impossible to get:

What was confusing at that time, needed service is located in “Extended” and “Standard” sort types. :poop:

Windows PowerShell:
Of course, without a Google & ChatGPT to get a correct command is no chance for the beginner. But I knew that here, as always, must be the request command:

Get-WmiObject -Class Win32_Service | Where-Object { $_.PathName -match "Update" } | Select-Object -Property Name, PathName

As a result, we have three answers. The last attempt was to add the extension.
It works for me :white_check_mark:

Conclusion:
Thinking logically, it is possible to find the answer: A service full name is name with extension name .exe

I use this command to get the services with display name includes “update”.

get-service | ? {$.Status -eq “Running”} | ? {$.DisplayName -match “update” | fl}