Windows Exploitation and Privilege Escalation CPENT Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which Windows process is commonly targeted to extract credentials from memory?

   • Alsass.exe
   • Bwinlogon.exe
   • Cexplorer.exe
   • Dsvchost.exe
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You are on a Windows Server 2016 host with a low-privileged shell. You enumerate scheduled tasks and find a task named 'CleanupTask' that runs as SYSTEM. The task's action is to execute C:\Scripts\cleanup.bat. You have write access to the C:\Scripts folder but not to the task definition itself. What is the most effective way to escalate privileges?

   • AModify the task's XML definition to point to your payload.
   • BReplace the task's executable with a malicious binary in C:\Windows\System32.
   • COverwrite cleanup.bat with a reverse-shell payload and wait for the task to trigger.
   • DUse schtasks /create to create a new task that runs your payload as SYSTEM.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of the Windows Exploit Suggester tool?

   • ATo bypass UAC on the target system.
   • BTo suggest potential privilege escalation exploits based on the system's patch level.
   • CTo automatically exploit known Windows vulnerabilities.
   • DTo extract password hashes from the SAM database.
   Reveal Solution Discussion Select an answer first
5. 39application · hard

   You have a standard user account that is a member of the Administrators group on a Windows 10 machine. UAC is set to default (notify me only when apps try to make changes). You need to run an elevated command silently. Which UAC bypass technique is most likely to work?

   • AUse the 'runas' command with /savecred.
   • BUse a kernel exploit to gain SYSTEM.
   • CSet EnableLUA to 0 in the registry.
   • DUse the eventvwr.exe auto-elevation bypass by modifying HKCU\Software\Classes\mscfile\shell\open\command.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You have a standard user account on a Windows server. You enumerate scheduled tasks and find a task that runs as SYSTEM with the following action: 'Run program: C:\Tools\backup.exe'. You have write access to C:\Tools. What is the most effective way to escalate privileges?

   • AModify the task's action to run your payload.
   • BCreate a new scheduled task that runs your payload as SYSTEM.
   • CUse schtasks /run /tn 'taskname' to run the task immediately.
   • DReplace backup.exe with a malicious executable and wait for the task to trigger.
   Reveal Solution Discussion Select an answer first