You discover that a Windows service is configured with a weak service path that includes spaces and is not quoted. The service runs as SYSTEM. What is the most likely privilege escalation technique?

Modify the service's ImagePath registry key to point to a payload.

Use `taskkill` to stop the service and then replace the executable.

Place an executable in a directory that matches the first part of the unquoted path.

Use `sc start` to start the service and hope it runs a payload.

You have a foothold on a Windows domain-joined host as a low-privileged user. You need to enumerate privileges that could lead to lateral movement or domain escalation. Which command or tool would provide the most comprehensive view of your current privileges and group memberships?

Run `powershell -c "Get-Process | Select-Object Name,Id"` to list running processes.

Run `net localgroup administrators` to list local administrators.

Run `whoami /all` to display all current user privileges and group memberships.

Run `wmic useraccount get name,sid` to list all user accounts.

You have a low-privilege shell on a Windows host. Enumeration shows that the current user has `SeRestorePrivilege` enabled. You need to escalate to SYSTEM, but you want to avoid modifying the registry or creating new services to minimize detection. What is the most effective approach?

Use `sc create` to create a new service that runs as SYSTEM.

Use `SeRestorePrivilege` to overwrite a system binary or DLL with a payload, then trigger its execution.

Use `runas /user:SYSTEM` to launch a command as SYSTEM.

Use `reg save` to back up the SAM and SYSTEM hives and extract hashes offline.

You have a low-privilege shell on a Windows host. You find a service that runs as SYSTEM with a weak service path that includes spaces and is not quoted. However, the service is already running. What is the most effective way to escalate privileges?

Modify the service's ImagePath registry key to point to a payload.

Use `taskkill` to stop the service and then replace the executable.

Stop the service, place a malicious executable in the path, and restart the service.

Place a malicious executable in the path and wait for the service to restart.

GIAC Red Team Professional

Domain 2Objective 3

Enumerating and Attacking Privileges GRTP Practice Questions (Page 8)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

4concepts

Questions 36–40

36application · medium
You discover that a Windows service is configured with a weak service path that includes spaces and is not quoted. The service runs as SYSTEM. What is the most likely privilege escalation technique?
Select an answer first
37application · medium
You have a foothold on a Windows domain-joined host as a low-privileged user. You need to enumerate privileges that could lead to lateral movement or domain escalation. Which command or tool would provide the most comprehensive view of your current privileges and group memberships?
Select an answer first
38foundation · easy
Which third-party tool is commonly used on Linux to enumerate the privileges and capabilities of the current user, including sudo rights and file capabilities?
Select an answer first
39expert · hard
You have a low-privilege shell on a Windows host. Enumeration shows that the current user has `SeRestorePrivilege` enabled. You need to escalate to SYSTEM, but you want to avoid modifying the registry or creating new services to minimize detection. What is the most effective approach?
Select an answer first
40expert · hard
You have a low-privilege shell on a Windows host. You find a service that runs as SYSTEM with a weak service path that includes spaces and is not quoted. However, the service is already running. What is the most effective way to escalate privileges?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.