You have compromised a Windows system and have SeImpersonatePrivilege. You need to escalate to SYSTEM, but the system is running an EDR that monitors for known potato exploits and blocks them. Which technique would you use to bypass the EDR and still exploit SeImpersonatePrivilege?

Use a named pipe impersonation technique with a custom tool that mimics the potato exploit but uses a different named pipe.

Use the PrintSpoofer tool, which is a newer technique that may not be blocked by the EDR.

Use a custom token impersonation script that manually creates a named pipe and triggers a SYSTEM process to connect to it, avoiding known signatures.

Use the JuicyPotato tool with a different COM object.

You have a low-privilege shell on a Linux server. Enumeration shows the `docker` group membership for your user and a running container with a mounted host filesystem. What is the most direct way to escalate to root on the host?

Run `docker run -v /:/mnt --privileged -it alpine chroot /mnt` to access the host filesystem.

Use `sudo -l` to check for passwordless sudo entries.

Run `docker exec -it /bin/bash` to get a shell inside the container.

Exploit a SUID binary like `/usr/bin/find` to spawn a root shell.

You are on a Linux host and need to enumerate all files with the SUID bit set, as these may be exploitable for privilege escalation. Which command would you use?

find / -perm -4000 -type f 2>/dev/null

You have enumerated that a Windows service runs with SYSTEM privileges and has a weak service permission that allows you to change its configuration. What is the immediate next step to escalate privileges?

Restart the service to see if it crashes.

Stop the service and then start it again.

Check the service's dependencies for other weak services.

Change the service's binPath to a command that adds your user to the local Administrators group.

You have write access to a user's home directory on a Linux system, and that user has a cron job that runs a script from their home directory. What is the most likely privilege escalation vector?

Change the permissions of the home directory to world-writable.

Replace the script with a malicious version that runs when the cron job executes.

Create a symlink in the home directory to /etc/shadow.

Modify the user's .bashrc to execute a reverse shell on next login.

GIAC Red Team Professional

Domain 2Objective 3

Enumerating and Attacking Privileges GRTP Practice Questions (Page 5)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

4concepts

Questions 21–25

21expert · hard
You have compromised a Windows system and have SeImpersonatePrivilege. You need to escalate to SYSTEM, but the system is running an EDR that monitors for known potato exploits and blocks them. Which technique would you use to bypass the EDR and still exploit SeImpersonatePrivilege?
Select an answer first
22application · medium
You have a low-privilege shell on a Linux server. Enumeration shows the `docker` group membership for your user and a running container with a mounted host filesystem. What is the most direct way to escalate to root on the host?
Select an answer first
23application · medium
You are on a Linux host and need to enumerate all files with the SUID bit set, as these may be exploitable for privilege escalation. Which command would you use?
Select an answer first
24application · medium
You have enumerated that a Windows service runs with SYSTEM privileges and has a weak service permission that allows you to change its configuration. What is the immediate next step to escalate privileges?
Select an answer first
25application · medium
You have write access to a user's home directory on a Linux system, and that user has a cron job that runs a script from their home directory. What is the most likely privilege escalation vector?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.