Enumerating and Attacking Privileges GRTP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   You have a foothold on a Windows host and need to identify potential privilege escalation paths, but you want to minimize the number of commands executed to avoid detection. Which single command or tool would provide the most comprehensive enumeration of privileges and misconfigurations?

   • ARun `whoami /all` to display all current user privileges and group memberships.
   • BRun `wmic service get name,startname,pathname` to list services and their executable paths.
   • CRun `net localgroup administrators` to list local administrators.
   • DRun `winPEAS.exe` to enumerate privileges, services, and other misconfigurations in one pass.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common misconfiguration that can be exploited to escalate privileges on a Windows system?

   • AA user having the SeShutdownPrivilege enabled
   • BA service configured to restart automatically on failure
   • CA user being a member of the Remote Desktop Users group
   • DA service running as SYSTEM with an unquoted path containing spaces
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You discover a Windows service running as SYSTEM with a weak file permission on its executable. The service is stopped. What is the most reliable way to escalate privileges?

   • AModify the service's binPath to point to a payload using `sc config`.
   • BCreate a scheduled task that runs the payload as SYSTEM.
   • CReplace the executable with a reverse shell payload and start the service.
   • DUse `runas /user:Administrator` to execute the payload.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You have a low-privilege shell on a Linux host. Enumeration shows that the current user is a member of the `sudo` group, but the `sudoers` file does not grant any specific rights to the user. However, you notice that the `sudoers` file includes a rule that allows members of the `sudo` group to run any command as root without a password. What is the most effective way to escalate privileges?

   • ARun `sudo -l` to confirm the rule, then run `sudo -u root /bin/bash` to get a root shell.
   • BUse `chmod` to make a SUID copy of `/bin/bash`.
   • CUse `pkexec` to run a command as root.
   • DUse `su -` to switch to the root user.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are on a Windows system and have enumerated that a service runs as SYSTEM but has a weak permission that allows you to modify its binPath. However, the service is set to 'Disabled' and cannot be started by your user. What is the most likely way to escalate privileges?

   • AUse a different privilege escalation technique, such as token impersonation.
   • BModify the service's dependencies to trigger its start.
   • CEnable the service using 'sc config' and then start it.
   • DReboot the system to force the service to start.
   Reveal Solution Discussion Select an answer first