Escalation and Exploitation GPEN Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   You are on a penetration test and have gained access to a Windows server as a local user. You discover that the 'SeDebugPrivilege' is enabled for your user. You need to escalate privileges to SYSTEM. Which of the following is the most appropriate technique?

   • AModify the service configuration to run as SYSTEM
   • BUse a kernel exploit to gain SYSTEM privileges
   • CUse a potato attack to exploit SeImpersonatePrivilege
   • DUse a tool like Mimikatz to inject a token from a SYSTEM process into your current process
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   During a penetration test, after completing the objectives, the tester removes any files uploaded to the target and deletes temporary accounts created during the engagement. Which post-exploitation phase does this represent?

   • AEnumeration
   • BLateral movement
   • CCleanup
   • DPersistence
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a penetration test, you need to avoid detection by endpoint protection while running a post-exploitation script. Which approach is most effective?

   • AUse in-memory execution with PowerShell and reflective DLL injection.
   • BDisable the antivirus service using sc stop.
   • CEncrypt your payload with a simple XOR cipher.
   • DRun the script from a network share.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   You have a low-privilege shell on a Linux server. During enumeration, you find that the '/usr/bin/find' binary has the SUID bit set and is owned by root. You need to escalate to root. Which command would achieve this?

   • Afind / -perm -4000 -exec ls -la \;
   • Bsudo find / -exec whoami \;
   • Cfind / -exec /bin/sh -p \;
   • Dcp /bin/sh /tmp/sh && chmod u+s /tmp/sh
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a penetration test, you gain access to a Windows workstation as a standard domain user. You discover that the local 'Backup Exec' service runs as SYSTEM and its installation directory is writable by the Everyone group. You want to escalate privileges to SYSTEM. Which action is most appropriate?

   • AReplace the service executable with a reverse shell binary and restart the service.
   • BModify the service's registry key to point to a malicious DLL and reboot the system.
   • CCreate a scheduled task that runs as SYSTEM and execute it.
   • DUse 'runas' to execute a command as SYSTEM using cached credentials.
   Reveal Solution Discussion Select an answer first