Windows Exploitation and Privilege Escalation CPENT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary condition that makes an application vulnerable to DLL hijacking?

   • AThe application loads DLLs from a remote network share.
   • BThe application is running with elevated privileges.
   • CThe application uses absolute paths to load its DLLs.
   • DThe application does not specify the full path to a DLL, allowing Windows to search directories in a predictable order.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   You have a standard user shell on a Windows 10 machine. An application installed in C:\Program Files\LegacyApp runs as SYSTEM and loads a DLL named helper.dll. You discover that helper.dll is not present in the application's directory, and the directory C:\Program Files\LegacyApp is writable by Users. Which technique would allow you to execute code as SYSTEM?

   • AUse process injection to inject code into the running application.
   • BPlace a malicious helper.dll in C:\Program Files\LegacyApp and wait for the application to start.
   • CCreate a junction from the application directory to a directory you control.
   • DAdd C:\Users\Public to the PATH environment variable and place helper.dll there.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You have obtained a low-privileged shell on a Windows domain-joined workstation. You need to find credentials that could grant access to other systems. Which approach is most likely to yield usable credentials without requiring immediate SYSTEM privileges?

   • ASearch for plaintext credentials in files, scripts, and the registry (e.g., unattend.xml, PowerShell history, saved credentials).
   • BDump the SAM and SYSTEM hives to crack local account hashes offline.
   • CRun Mimikatz sekurlsa::logonpasswords to extract plaintext passwords from LSASS.
   • DCheck for cached credentials in the registry using reg.exe.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   You are on a Windows 7 SP1 host with a standard user shell. The host is not fully patched. You need SYSTEM access. Which approach is most appropriate?

   • AModify the service registry key for a vulnerable service.
   • BUse Windows-Exploit-Suggester to identify a kernel exploit such as MS16-032 and run it.
   • CUse PrintSpoofer to impersonate a SYSTEM token.
   • DUse Mimikatz to extract the administrator password from LSASS.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You are on a fully patched Windows 10 22H2 host with a standard user shell. You want to escalate to SYSTEM. Which approach is most appropriate?

   • AEnumerate for misconfigured services, writable scheduled tasks, or token impersonation opportunities.
   • BImmediately dump SAM and SYSTEM hives using reg.exe save.
   • CUse Metasploit's exploit/windows/local/ms16_032_secondary_logon_handle_privesc.
   • DRun Windows-Exploit-Suggester to identify a kernel vulnerability and then use a public exploit.
   Reveal Solution Discussion Select an answer first