CVE-2017-1000475: Freesshd Unquoted Service Path
Prove of concept
Windows 10 with freeSSHd 131, installed by default and with the option running as a system service
Command to check Unquoted Service Path The service is unquoted by default
The process is running as SYSTEM by default
Create a Reverse Shell with MSFVenom to check the connection against an attacker and ren