GPEN Domain Escalation and Persistence — 15 Questions

Question 1

Refer to the exhibit. As a penetration tester, you discover this registry key. What is the primary security implication of this finding regarding persistence?

Accepted Answer

The entry allows for persistent execution across user reboots.. The registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. Since it resides in HKLM, it runs for every user that logs into the system. Identifying this key allows a tester to confirm persistence on the target. If the current user has write access to the binary location, they can replace the legitimate executable with a malicious one, effectively escalating privileges upon the next system startup.

Answer

The entry only triggers when a specific user logs into the machine.

Answer

The service will only execute if the user has administrative privileges.

Answer

The key is invalid because it uses double backslashes in the path.

Question 2

Refer to the exhibit. What is the security concern regarding this service configuration?

Accepted Answer

The service runs with high privileges by default.. The service is configured as AUTO_START and runs as LocalSystem. If the binary path were replaced or if the service could be hijacked via DLL sideloading, an attacker would gain execution with SYSTEM privileges automatically upon boot. While the path points to a legitimate system binary, the configuration details suggest that any vulnerability in the associated service logic could lead to complete system compromise via persistence.

Answer

The service is disabled, so it poses no threat.

Answer

The binary path is invalid and will cause a crash.

Answer

The service name 'HiddenService' is illegal in Windows.

Question 3

During a penetration test on an Active Directory environment, you have compromised a workstation and want to maintain persistence across reboots without modifying the registry or creating scheduled tasks. You have local administrator rights. Which method is most appropriate?

Accepted Answer

Use a WMI event subscription to execute a payload on system startup.. WMI event subscriptions are stored in the WMI repository and can trigger on system startup without modifying the registry or creating scheduled tasks. This makes them a stealthy persistence mechanism that meets the scenario's constraints. They are often missed by rudimentary persistence checks that focus on Run keys or Task Scheduler, and they can execute arbitrary code with the privileges of the WMI service.

Answer

Install a Windows service that runs a custom binary as Local System.

Answer

Place a shortcut in the user's Startup folder that launches a reverse shell.

Answer

Create a new local user account and add it to the Administrators group.

Question 4

A penetration tester has gained Domain Admin access and wants to establish persistence on a Windows domain. The tester must ensure the persistence survives a reboot of the domain controller and remains undetected by standard security audits. Which TWO of the following techniques best meet these requirements? (Choose two.)

Accepted Answer

Deploy a Skeleton Key on the domain controller to allow authentication with a master password.. A Golden Ticket and a Skeleton Key both provide stealthy domain persistence. The Golden Ticket is forged from the krbtgt hash and remains valid until the krbtgt password is reset twice, surviving reboots without on-disk artifacts. A Skeleton Key patches LSASS to accept a master password, allowing access without changing accounts or ACLs. Both avoid the obvious indicators of new accounts, ACL changes, or scheduled tasks.

Answer

Create a scheduled task on the domain controller that runs a reverse shell every hour.

Answer

Create a new domain admin account with a name similar to a legitimate service account.

Answer

Modify the ACL of the Domain Admins group to grant full control to a controlled user account.

Question 5

During a penetration test, you gain access to a Linux server and want to establish persistence by creating a new user account with root privileges. Which of the following methods is most likely to succeed and remain stealthy?

Accepted Answer

Add a new user with UID 0 to /etc/passwd and set a password hash in /etc/shadow.. Creating a user with UID 0 is a stealthy persistence method because it grants root privileges without altering existing accounts or sudo configurations. It is less likely to be detected unless administrators specifically look for duplicate UID 0 entries.

Answer

Create a new user and set their shell to /bin/bash, then add them to the 'wheel' group.

Answer

Create a new user and add them to the sudoers file with NOPASSWD: ALL.

Answer

Modify the root user's password and store it for later use.

Question 6

During a penetration test on a Windows domain-joined workstation, you have obtained local administrator privileges. You want to establish persistence that survives reboots and allows you to execute a payload when any user logs on, while minimizing the chance of detection by common security tools. Which of the following methods best meets these requirements?

Accepted Answer

Create a WMI event subscription that triggers on user logon and executes your payload.. WMI event subscriptions provide a stealthy persistence mechanism that triggers on system events such as user logon. They are fileless, survive reboots, and are less likely to be flagged by common security tools because they reside in the WMI repository rather than the file system or registry. This makes them an effective choice for maintaining access while avoiding detection.

Answer

Create a new scheduled task that runs at logon of any user, with the action set to your payload.

Answer

Modify the ImagePath value of an existing service to point to your payload.

Answer

Add a registry value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that points to your payload.

Question 7

You have compromised a Windows workstation that is part of a domain. You want to establish persistence that survives reboots and does not require administrative privileges. Which of the following techniques is most appropriate?

Accepted Answer

Add a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.. For non-administrative persistence on Windows, the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is ideal because it is writable by the user and executes at logon. This survives reboots and does not require elevation. Other techniques like services, scheduled tasks as SYSTEM, or IFEO require administrative privileges and are not feasible.

Answer

Modify the Image File Execution Options registry key for a system process.

Answer

Create a new Windows service that runs a malicious executable.

Answer

Schedule a task using schtasks with the /RU SYSTEM flag.

Question 8

After exploiting a Linux server, you want to ensure that your backdoor remains accessible even if the system is rebooted. You decide to use a cron job. Which of the following cron locations would execute your job at system startup, regardless of which user is logged in?

Accepted Answer

A line in /etc/crontab using the @reboot keyword.. The system-wide /etc/crontab supports the @reboot keyword, which runs the specified command when the cron daemon starts at boot. This provides persistence that survives reboots and does not require a user to be logged in. Other locations like user crontabs, /etc/cron.d, or /etc/rc.local are either user-dependent, less reliable, or deprecated.

Answer

A script placed in /etc/cron.d/ with a @reboot schedule.

Answer

A user-specific crontab entry created with 'crontab -e'.

Answer

An entry in /etc/rc.local.

Question 9

You have compromised a Linux server and escalated to root. To maintain persistence, you want to create a backdoor that executes whenever a specific user logs in via SSH, but you want to avoid modifying system-wide files that might be monitored. Which of the following methods best achieves this?

Accepted Answer

Add a command to the user's ~/.ssh/rc file.. The ~/.ssh/rc file is a per-user configuration file executed by the SSH daemon after successful authentication, before the user's shell or command is run. Placing a command there ensures it executes on each SSH login for that user without altering system-wide files. This provides stealthy, user-specific persistence that is less likely to be monitored than global profile scripts.

Answer

Add a command to the user's ~/.bashrc file.

Answer

Add a command to /etc/profile.d/ script.

Answer

Create a systemd service that runs on user login.

Question 10

After compromising a Windows domain controller, you want to maintain persistent access even if your initial account password is changed. Which of the following techniques best achieves this while remaining relatively stealthy?

Accepted Answer

Deploy a Skeleton Key malware on the domain controller.. Skeleton Key is a memory-resident patch to LSASS that enables a master password for any domain account, providing persistent access that survives password changes. It is stealthy because it does not alter the directory or create new accounts, and it only affects authentication on the domain controller. This technique allows an attacker to maintain domain access without leaving obvious artifacts, making it suitable for the scenario.

Answer

Add your own SSH public key to the domain administrator's authorized_keys file on the domain controller.

Answer

Use Mimikatz to inject a golden ticket into the KRBTGT account.

Answer

Create a new domain admin account with a similar name to an existing service account.

Question 11

You have gained access to a Windows workstation that is part of an Active Directory domain. You want to establish persistence that leverages the domain infrastructure, allowing you to re-authenticate as the compromised user even if their password is changed. Which two of the following techniques best achieve this? (Choose two.)

Accepted Answer

Create a golden ticket using the KRBTGT account hash.. Golden tickets and silver tickets are both domain persistence techniques that use forged Kerberos tickets. Golden tickets require the KRBTGT hash and grant domain-wide access, while silver tickets require a service account hash and grant access to a specific service. Both survive password changes of the compromised user, as they are not tied to that user's credentials. They leverage Active Directory infrastructure and are effective for maintaining access.

Answer

DCSync to extract the user's password hash and use it for pass-the-hash.

Answer

Add a backdoor user account to the domain admins group.

Answer

Deploy a Skeleton Key on the domain controller.

Question 12

During a post-exploitation phase, you identify an unquoted service path vulnerability on a Windows target. What is the most reliable way to escalate privileges through this misconfiguration?

Accepted Answer

Place a malicious binary at the first detected space-delimited path segment.. Unquoted service paths exist when the service binary path contains spaces and lacks quotes. Windows interprets the path incorrectly, searching for intermediate executables. Placing a malicious binary at the identified path allows it to execute with SYSTEM privileges upon service restart. This technique is critical for privilege escalation as it exploits inherent Windows path resolution logic, often bypassing standard user restrictions if the directory has weak permissions.

Answer

Overwrite the existing service executable with a custom payload.

Answer

Modify the service configuration using the sc config command.

Answer

Inject a DLL into the running service process memory space.

Question 13

Which TWO of the following methods are commonly used by attackers to achieve persistence on a Linux system via cron jobs?

Accepted Answer

Creating a new file in /etc/cron.d/ with an execution trigger.. Cron is a time-based job scheduler. Attackers utilize /etc/crontab or specific user crontabs to execute malicious scripts at defined intervals. This ensures that even if a session is terminated, the attacker's payload re-executes. Monitoring cron directories and user-specific crontab files is essential for detection, as these are frequent targets for maintaining persistent access on Linux servers.

Answer

Modifying the /etc/shadow file to grant root access.

Answer

Replacing the bash shell binary with a malicious version.

Answer

Setting a boot-time delay in the global /etc/environment file.

Question 14

When attempting to escalate privileges on a Linux system, what is the significance of the SUID bit on a file owned by root?

Accepted Answer

It permits the file to execute with the owner's privileges.. The SUID (Set User ID) bit allows a file to execute with the permissions of the file owner rather than the user executing it. If an attacker identifies a SUID file owned by root, they can potentially manipulate the execution flow to gain a root shell. This is a primary target for privilege escalation, as it permits users to circumvent standard permission constraints during execution.

Answer

It forces the file to run within a restricted sandbox environment.

Answer

It enables the file to be readable by all users on the system.

Answer

It automatically encrypts the file contents at rest.

Question 15

Which technique is most effective for maintaining persistence on a Windows domain-joined machine while remaining stealthy by avoiding common registry keys?

Accepted Answer

Creating a WMI event subscription for system events.. Persistence is often detected via common registry keys like Run or RunOnce. Using Windows Management Instrumentation (WMI) event subscriptions allows for persistence that is harder to detect. By creating an EventFilter and EventConsumer, an attacker can trigger a malicious script based on system events, such as a specific time or system uptime, bypassing traditional registry-based forensic analysis and providing a robust, fileless-like execution method.

Answer

Adding a startup shortcut to the All Users Startup folder.

Answer

Modifying the existing service binary to include a backdoor.

Answer

Running a scheduled task with a visible command prompt window.