Windows Exploitation and Privilege Escalation CPENT Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   You have SYSTEM access on a Windows 10 workstation that is not domain-joined. You need to obtain credentials for a local administrator account. Which approach is most effective?

   • AUse Mimikatz to extract Kerberos tickets and perform pass-the-ticket.
   • BRun net user administrator /domain to reset the password.
   • CUse Windows-Exploit-Suggester to find a kernel exploit.
   • DDump the SAM and SYSTEM hives and crack the NTLM hashes offline.
   Reveal Solution Discussion Select an answer first
2. 12application · hard

   You have a standard user account on a Windows 10 machine with UAC set to 'Always Notify'. You need to run an administrative command without triggering a UAC prompt. Which technique is most likely to succeed?

   • AUse the 'runas' command with /savecred to run the command as administrator.
   • BDisable UAC by modifying the registry key EnableLUA.
   • CUse a kernel exploit to gain SYSTEM and then run the command.
   • DUse the FodHelper UAC bypass by modifying the registry key HKCU\Software\Classes\ms-settings\Shell\Open\command.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary vulnerability in an unquoted service path that allows privilege escalation?

   • AWindows interprets spaces in the path as separators, allowing an attacker to place an executable in a directory that will be executed.
   • BThe service is configured to start automatically, allowing the attacker to trigger it easily.
   • CThe service binary is stored in a world-writable directory, allowing the attacker to replace it.
   • DThe service runs with SYSTEM privileges, allowing the attacker to execute code as SYSTEM.
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   You have a low-privileged shell on a Windows Server 2016 host. You find a scheduled task 'UpdateTask' that runs as SYSTEM. The task action is 'powershell.exe -File C:\Scripts\update.ps1'. You have write access to C:\Scripts\ but the task's security descriptor prevents modification. The task is scheduled to run every hour. What is the best way to escalate privileges?

   • AModify the task's XML to point to your payload.
   • BUse schtasks /run /tn UpdateTask to trigger it immediately.
   • COverwrite update.ps1 with a reverse-shell payload and wait for the next trigger.
   • DCreate a new scheduled task that runs your payload as SYSTEM.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You have administrative access to a Windows server but need to move laterally to a domain controller. You want to extract credentials from the local machine. Which approach is most effective?

   • ARun Windows Credential Editor (WCE) to inject a Kerberos ticket.
   • BUse the Windows exploit suggester to find a local privilege escalation.
   • CCopy the SAM and SYSTEM files from C:\Windows\System32\config.
   • DUse mimikatz to dump credentials from LSASS.
   Reveal Solution Discussion Select an answer first