You have a low-privilege shell on a Windows server. You discover that the 'MSSQLSERVER' service runs as SYSTEM and is configured with 'xp_cmdshell' enabled. You have access to the SQL Server with 'sa' credentials. Which action is most appropriate to escalate privileges?

Use the sa account to add a new Windows user to the Administrators group.

Use xp_cmdshell to execute commands as the SQL Server service account, which runs as SYSTEM.

Use a kernel exploit to escalate from the SQL Server service account.

Use the sa account to read the Windows SAM file.

During a penetration test, an attacker gains access to a standard user account on a Windows workstation and then exploits a misconfigured service to obtain SYSTEM privileges. Which type of privilege escalation does this describe?

Horizontal privilege escalation

You have captured an NTLM hash of a domain admin from a compromised workstation. You need to access a file server using that hash without cracking it. Which technique should you use?

Use the hash to create a new domain admin account.

Perform a brute-force attack to recover the plaintext password.

Pass-the-hash with PsExec or Metasploit's psexec module.

Use the hash in a Kerberos ticket request.

You have a low-privilege shell on a Windows server. You discover that the 'Spooler' service is running and vulnerable to a known privilege escalation exploit. Which action is most appropriate?

Modify the Spooler service's registry key to run your payload.

Delete the Spooler service and create a new one with your payload.

Use a Metasploit module that targets the Print Spooler vulnerability to gain SYSTEM privileges.

Restart the Spooler service and hope it runs as SYSTEM.

You have a low-privilege shell on a Linux server. You find a cron job that runs a script as root every minute. The script is writable by your user. However, the script is executed via a relative path from the cron job's working directory. You need to escalate to root without disrupting the cron job's normal function. Which action is most appropriate?

Create a symlink in the cron directory that points to your payload.

Change the permissions of the script to include the SUID bit.

Delete the script and wait for the cron job to fail, then create a new script.

Replace the script with a malicious one that creates a SUID root shell, but preserve the original functionality by calling the original script from your payload.

GIAC Penetration Tester (GPEN)

Domain 2Objective 2

Escalation and Exploitation GPEN Practice Questions (Page 6)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 26–30

26expert · hard
You have a low-privilege shell on a Windows server. You discover that the 'MSSQLSERVER' service runs as SYSTEM and is configured with 'xp_cmdshell' enabled. You have access to the SQL Server with 'sa' credentials. Which action is most appropriate to escalate privileges?
Select an answer first
27foundation · easy
During a penetration test, an attacker gains access to a standard user account on a Windows workstation and then exploits a misconfigured service to obtain SYSTEM privileges. Which type of privilege escalation does this describe?
Select an answer first
28application · medium
You have captured an NTLM hash of a domain admin from a compromised workstation. You need to access a file server using that hash without cracking it. Which technique should you use?
Select an answer first
29application · medium
You have a low-privilege shell on a Windows server. You discover that the 'Spooler' service is running and vulnerable to a known privilege escalation exploit. Which action is most appropriate?
Select an answer first
30expert · hard
You have a low-privilege shell on a Linux server. You find a cron job that runs a script as root every minute. The script is writable by your user. However, the script is executed via a relative path from the cron job's working directory. You need to escalate to root without disrupting the cron job's normal function. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.