Powershell - Non-standard update service on host

I started HTB Academy a few weeks ago and started some of the Fundamentals Modules. In Windows Fundamentals, one of the questions there is to “Identify one of the Non-standard update service running on host”,but the module did not mention anything about a command line looking for it and I do not know what a non-standard update service is. From what I understand is that it’s something that didn’t come with the OS.

If someone can explain it to me further, that would be lovely.

Thank you

2 Likes

Is this any help?

2 Likes

Type your comment> @TazWake said:

Is this any help?

Window non-standard application concept - #2 by TazWake - Off-topic - Hack The Box :: Forums

I have a clearer understanding of it now, I will try it again. Thank you so much!

ScriptKiddy Giving away the answer does not direct your associates to discover the means of obtaining the answer by learning the right technique… lol

1 Like

So true. Post removed.

Please, @alex222 don’t just give away the answer. As explained in the post I responded to.

1 Like

This is all cool, of course, but can anyone suggest a detailed explanation with a solution?

1 Like

Hello, this would be the command for you to execute in PowerShell to see it in detail (open PowerShell as administrator).

get-process | Select-Object processname,path | fl

1 Like

Put the file extension after the name. Finally it worked for me.

3 Likes

For anyone going through this: Figured this out thanks to @KisBal 's suggestion.

The question reads:

Identify one of the non-standard update services running on the host. Submit the full name of the service executable (not the DisplayName) as your answer.

You need the file extension too.

I guess I never really learned to read questions properly myself.

Hi :wave:

It was also too complex for me to quickly understand the answer format. :crazy_face:

Some steps for execution:
First of all it came to me with an attempt to use applications in WINDOWS. Services app - it’s a table (knowing the answer, the key is on properties of the service, the path). It seems too simple and at that time impossible to get:

What was confusing at that time, needed service is located in “Extended” and “Standard” sort types. :poop:

Windows PowerShell:
Of course, without a Google & ChatGPT to get a correct command is no chance for the beginner. But I knew that here, as always, must be the request command:

Get-WmiObject -Class Win32_Service | Where-Object { $_.PathName -match "Update" } | Select-Object -Property Name, PathName

As a result, we have three answers. The last attempt was to add the extension.
It works for me :white_check_mark:

Conclusion:
Thinking logically, it is possible to find the answer: A service full name is name with extension name .exe

I use this command to get the services with display name includes “update”.

get-service | ? {$.Status -eq “Running”} | ? {$.DisplayName -match “update” | fl}

For anyone who got stomp like me and had no where to begin, here is how I went with the question. All this is a longer route, but easier to explain the thought process.

The hint said it involved PDF editing and to use powershell. So you can expect it to be some software. So you can backtrack (“cd …”) all the way until you find the Program Files (x86). Once you follow the Program Files (x86) path, there is a software there that is different from the rest. From that point, you follow the path all the way until you see multiple directories and executables. Then finding one that specifically has the “updateservice” as its name. Because the question was looking for the update service.

Hope that helped breakdown the process for the ones who did not have any know how to use commands apart from the basic ones like me.