Windows Exploitation and Privilege Escalation CPENT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the key condition that makes a scheduled task vulnerable to privilege escalation?

   • AThe task is configured to run as the SYSTEM account.
   • BThe task is scheduled to run at logon.
   • CThe task runs with the highest privileges available.
   • DThe task's executable or its configuration is writable by a standard user.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   You have a low-privilege shell on a Windows server. You find a service 'VulnSvc' with the following characteristics: the binary path is C:\Program Files\Vendor\VulnSvc.exe, and the directory C:\Program Files\Vendor is writable by Users. The service runs as SYSTEM. However, the service is currently running and you do not have permission to restart it. Which technique is most likely to succeed?

   • AReplace the service binary and wait for a reboot or service restart.
   • BUse the unquoted path to execute a payload.
   • CModify the service's ImagePath in the registry and then restart the service.
   • DKill the service process and then replace the binary.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You have a low-privilege shell on a Windows server. You enumerate scheduled tasks and find a task named 'Cleanup' that runs as SYSTEM. The task executes C:\Scripts\cleanup.bat. You check permissions and find that the file C:\Scripts\cleanup.bat is writable by the Authenticated Users group. What is the most direct way to escalate privileges?

   • ADelete the scheduled task and create a new one that runs your payload.
   • BUse schtasks /run /tn Cleanup to execute the task immediately.
   • CAppend a reverse-shell command to cleanup.bat and wait for the task to run.
   • DReplace cleanup.bat with a symbolic link to cmd.exe.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   You have a standard user shell on a Windows 10 21H2 system that is fully patched. You need to escalate to SYSTEM. You have limited time and cannot risk crashing the system. Which approach is the best first step?

   • ARun a public kernel exploit for CVE-2021-21551.
   • BRun WinPEAS to enumerate common misconfigurations.
   • CImmediately attempt a potato attack using PrintSpoofer.
   • DUse mimikatz to dump credentials from LSASS.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You have a shell as a service account on a Windows server. The account has the SeImpersonatePrivilege enabled. You need to escalate to SYSTEM. Which tool or technique is most appropriate?

   • ARun a kernel exploit such as MS17-010 to gain SYSTEM.
   • BUse a tool like JuicyPotato or PrintSpoofer to impersonate a SYSTEM token.
   • CUse PowerShell to modify the service registry key for a SYSTEM service.
   • DUse mimikatz to dump LSASS and extract the SYSTEM account hash.
   Reveal Solution Discussion Select an answer first