Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 14)

Questions 66–70

1. 66application · medium

   You have discovered a critical remote code execution vulnerability in a product during a security assessment. The development team needs to understand the risk and how to fix it. What should you include in your report?

   • AA high-level summary of the vulnerability without technical details to avoid overwhelming the developers.
   • BOnly the proof-of-concept code and a note that the vulnerability is critical.
   • CA detailed technical description of the vulnerability, proof-of-concept code, and step-by-step remediation guidance.
   • DA recommendation to deploy a web application firewall as a mitigation instead of fixing the code.
   Reveal Solution Discussion Select an answer first
2. 67application · medium

   You have compromised a Windows service running as a low-privileged user but with the SeDebugPrivilege enabled. You need to escalate to SYSTEM to complete the assessment. Which technique is most appropriate?

   • AUse a kernel exploit to gain SYSTEM privileges.
   • BCreate a new local user and add it to the Administrators group using net user commands.
   • CDump the password hashes from the SAM database and use pass-the-hash to authenticate as SYSTEM.
   • DUse the SeDebugPrivilege to open a SYSTEM process and inject a malicious DLL to execute code in its context.
   Reveal Solution Discussion Select an answer first
4. 68application · medium

   A penetration tester is performing a red team exercise against a Windows 10 endpoint that has an EDR solution with kernel-level callbacks and user-mode API hooking. The tester needs to execute a custom C# payload that will run in the context of a legitimate signed Microsoft binary to avoid application whitelisting. Which approach would most effectively achieve the objective while minimizing EDR detection?

   • AUse a PowerShell script to download and execute the payload in memory, avoiding touching the disk.
   • BCompile the C# payload as a standalone executable and run it directly from a network share.
   • CRename the compiled payload to a Microsoft-signed filename and place it in the Windows System32 folder.
   • DUse a reflective loader to inject the C# payload into a running signed Microsoft process, then unhook the EDR user-mode hooks before executing.
   Reveal Solution Discussion Select an answer first
5. 69application · medium

   You have compromised a Windows service account that has the SeImpersonatePrivilege enabled. The service runs on a server where you need to escalate to SYSTEM to access a protected configuration file. You have already confirmed that the local admin account password is unknown and that the server is fully patched. Which approach is most appropriate to escalate privileges?

   • ASearch for scheduled tasks that run as SYSTEM and modify one to execute your payload.
   • BRun a kernel exploit that targets a known Windows vulnerability to gain SYSTEM privileges.
   • CDump the SAM database to recover the local admin password and use it to escalate.
   • DUse a potato-style attack (e.g., JuicyPotato) to exploit the SeImpersonatePrivilege and obtain a SYSTEM token.
   Reveal Solution Discussion Select an answer first
6. 70application · medium

   A software company is integrating security testing into its development lifecycle. The team wants to identify design-level threats early in the SDLC before code is written. Which activity should be performed first?

   • ADevelop a proof-of-concept exploit for a known vulnerability.
   • BPerform a source code review to find vulnerabilities in the existing codebase.
   • CConduct a threat modeling session to identify potential threats and mitigations.
   • DRun a fuzzing campaign against the product's network interfaces.
   Reveal Solution Discussion Select an answer first