GPEN Escalation and Exploitation — 15 Questions

Question 1

During an internal network penetration test, you compromise a Linux workstation and discover plaintext credentials for a domain service account cached in memory. You want to move laterally to a critical database server using Pass-the-Hash without triggering Kerberos logging anomalies. Which technique is most appropriate for establishing this lateral movement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authenticating to the Server Message Block (SMB) service using the retrieved NTLM password hash directly.. Utilizing NTLM hashes directly via Pass-the-Hash bypasses the requirement for plain-text passwords during authentication. This technique is favored in penetration testing because service accounts often retain local administrator privileges across multiple internal systems, enabling rapid expansion of access without generating new Kerberos ticket-granting ticket requests that might alert monitoring analysts.

Answer

Injecting the cleartext password into the LSASS process memory of the remote database server.

Answer

Generating a golden ticket using the krbtgt hash obtained from a compromised domain controller.

Answer

Requesting a Kerberos service ticket for the target database using the cached NTLM hash.

Question 2

You are assessing a Linux web server and have discovered a local file inclusion (LFI) vulnerability in a parameter used to load template files. The application runs with standard web user privileges, but you notice that cron is executing a script owned by root every minute. How can you leverage this situation for privilege escalation?

Accepted Answer

Inject PHP code into the Apache access logs and use the LFI to include the log file for execution.. Local File Inclusion vulnerabilities can sometimes be escalated to remote code execution or local privilege escalation if they permit reading configuration files or logs that interact with system processes. When cron jobs execute scripts insecurely or depend on world-writable include files, local users can exploit these conditions to execute arbitrary commands.

Answer

Use the LFI to read /etc/shadow directly and crack the root password hash offline.

Answer

Overwrite the cron daemon binary directly through the web application upload mechanism.

Answer

Modify the crontab configuration file directly using standard web user privileges.

Question 3

During an assessment of a corporate Active Directory environment, you discover that a user account has the GenericAll access right over a specific security group. What does this permission enable the penetration tester to achieve?

Accepted Answer

The authority to modify the group membership and add any user account to that security group.. GenericAll is a powerful Active Directory extended access right that grants full control over an object, equivalent to ownership. When applied to a security group, it allows the attacker to modify group membership directly, granting themselves or an accomplice access to sensitive domain resources associated with that group.

Answer

The ability to read the password hashes of all group members stored in the Active Directory database.

Answer

Automatic inheritance of Domain Admin privileges due to cascading access control list permissions.

Answer

The capability to decrypt all Kerberos ticket-granting tickets issued to members of the target group.

Question 4

You are performing a post-exploitation task on a Windows host and successfully obtain a user's cleartext password from LSASS memory. Which technique is most appropriate to leverage this credential to move laterally to a remote target using only standard Windows authentication protocols?

Accepted Answer

WinRM remote command execution. Pass-the-Hash (PtH) and Pass-the-Ticket (PtT) are common, but since you have the cleartext password, Pass-the-Password is not a standard protocol term. Executing a remote process via WinRM or SMB with credentials is the standard approach. This matters because knowing the difference between cleartext capabilities and hash-based capabilities allows testers to select the most reliable authentication method for lateral movement without alerting defensive monitoring systems.

Answer

Golden Ticket injection

Answer

Pass-the-Hash via Mimikatz

Answer

Overpass-the-Hash

Question 5

Which TWO of the following Linux configuration files or directories, if writable by a low-privileged user, represent a critical privilege escalation vector?

Accepted Answer

/etc/passwd. Writable system files allow an attacker to inject malicious code or configurations that execute with root privileges upon system events. Identifying these vectors is crucial for penetration testers because they often provide the most direct path to full system compromise. If a user can modify these files, they can effectively bypass all standard Linux permission controls and establish persistence or gain elevated access during the next service restart.

Answer

/etc/shadow

Answer

/var/log/syslog

Answer

/usr/bin/ls

Question 6

When attempting to escalate privileges on a Windows system, what is the significance of the 'AlwaysInstallElevated' registry setting?

Accepted Answer

It allows MSI files to be installed with SYSTEM privileges.. The 'AlwaysInstallElevated' registry key, when set to 1 for both the Local Machine and Current User hives, allows any user to run Microsoft Installer (MSI) files with elevated SYSTEM privileges. This is a classic misconfiguration that testers look for because it provides an trivial path to privilege escalation by simply running a custom, malicious MSI package that executes a payload during installation.

Answer

It forces all user applications to run as an administrator.

Answer

It enables the installation of unsigned drivers.

Answer

It bypasses User Account Control (UAC) for all tasks.

Question 7

Which THREE of the following are common indicators that a service is vulnerable to an Unquoted Service Path escalation attack?

Accepted Answer

The service path contains spaces.. Unquoted service paths occur when a service executable path contains spaces and is not enclosed in quotes. Windows attempts to execute files by resolving the path incrementally. If an attacker can place a malicious executable in a directory that matches the partial path, the system will execute the attacker's file instead of the actual service binary, leading to privilege escalation when the service restarts.

Answer

The service binary is located in a protected directory.

Answer

The service uses a remote network share.

Question 8

While exploiting a vulnerable web application on a Windows host, you achieve remote code execution and want to establish a reliable, encrypted command-and-control channel that survives intermittent connectivity. Which Meterpreter payload characteristic best supports this requirement?

Accepted Answer

The payload is a reverse TCP Meterpreter that encrypts the session with TLS and supports automatic reconnection and migration.. Meterpreter reverse TCP encrypts its transport with TLS and its session supports automatic reconnection, while migration into a stable process keeps the channel alive across process restarts. Those traits directly satisfy the need for an encrypted, resilient command-and-control channel. Bind shells, staged-only delivery, and fire-and-forget command payloads do not provide equivalent resilience or encryption.

Answer

The payload uses staged delivery, where a small stager downloads the full Meterpreter DLL into memory after connecting back.

Answer

The payload executes a single command and exits immediately, returning only the command output to the tester.

Answer

The payload is a bind shell that listens on a chosen port and accepts a single inbound connection from the tester.

Question 9

During a penetration test on a Windows Server 2019 host, you gain a low-privileged shell as the user 'webuser'. You discover that the service 'Apache2.4' runs as LocalSystem and its binary path is 'C:\Program Files\Apache Group\Apache2\bin\httpd.exe'. You have write access to the 'C:\Program Files\Apache Group\Apache2\bin' directory. What is the most reliable way to escalate privileges to SYSTEM?

Accepted Answer

Replace the httpd.exe binary with a malicious executable and restart the service.. The most reliable escalation is to replace the service binary because you have write access to the directory containing the executable. When the service restarts, it executes your malicious binary with SYSTEM privileges. Other methods either require administrative rights or do not apply due to the service path being properly quoted. This technique is a standard Windows privilege escalation vector when service directories are writable.

Answer

Modify the service's registry key to point to a malicious executable and restart the service.

Answer

Create a new service with the same name using sc.exe create.

Answer

Use the unquoted service path vulnerability by placing a malicious executable in C:\Program Files\Apache Group\Apache2\bin.

Question 10

You have a Meterpreter session on a Windows host running as a service account with SeImpersonatePrivilege enabled. You want to elevate to SYSTEM. Which two techniques are valid for abusing this privilege on a modern Windows system? (Choose two.)

Accepted Answer

Run the PrintSpoofer or RogueWinRM technique to capture a token from the Spooler or WinRM service. SeImpersonatePrivilege permits a process to take on the identity of tokens it can capture. Potato-family tools and PrintSpoofer or RogueWinRM coerce a SYSTEM service into authenticating to an attacker-controlled endpoint, yielding a token that can be impersonated. Both approaches fit the described privilege and work across many supported Windows builds.

Answer

Load a vulnerable signed driver to execute kernel code and disable token checks

Answer

Enable the built-in Administrator account by writing to the SAM registry hive directly from the service context

Answer

Invoke a named pipe impersonation attack against the LSASS process to duplicate its token

Question 11

You have gained access to a Windows domain workstation as a standard user. You discover that the user account has the 'SeImpersonatePrivilege' enabled. Which technique can you use to escalate privileges to SYSTEM?

Accepted Answer

Use the Rotten Potato exploit to impersonate a token from a privileged process.. SeImpersonatePrivilege allows a user to impersonate tokens. The Rotten Potato exploit leverages this by tricking a privileged service into authenticating to a local listener, then capturing and using its token to gain SYSTEM. While other variants like Juicy Potato and PrintSpoofer exist, Rotten Potato is the classic and most direct method for this privilege. It is a well-known escalation technique in Windows environments.

Answer

Use the Sweet Potato exploit to combine Juicy Potato and PrintSpoofer techniques.

Answer

Use the Juicy Potato exploit to relay NTLM authentication to an external server.

Answer

Use the PrintSpoofer exploit to abuse the SeImpersonatePrivilege by coercing the Print Spooler service.

Question 12

During an internal penetration test you compromise a Linux host and obtain a low-privileged shell. You notice that the current user belongs to the docker group. What is the most direct way to escalate to root on this host?

Accepted Answer

Run a container that mounts the host root filesystem and chroot into it to read /etc/shadow.. Membership in the docker group is effectively equivalent to root because the daemon executes as root and honors user-supplied bind mounts. Launching a container that mounts / and chrooting into it exposes the host filesystem, allowing reads of /etc/shadow or writes of SUID binaries. This path is deterministic, requires no exploit development, and matches the docker group finding described.

Answer

Add the current user to /etc/sudoers using a writable /etc/sudoers.d drop-in file.

Answer

Inspect /var/run/docker.sock permissions and, if world-writable, use curl to pull a privileged image.

Answer

Exploit a known kernel vulnerability in the host's Linux kernel version to obtain a root shell.

Question 13

You have a low-privileged shell on a Windows Server 2019 host. Enumeration shows the machine has the SeImpersonatePrivilege assigned to your service account and runs an outdated build. Which TWO techniques are most appropriate to escalate to SYSTEM? (Choose two.)

Accepted Answer

Run a GodPotato-style exploit that leverages DCOM/RPC to obtain a SYSTEM token for impersonation.. SeImpersonatePrivilege lets a process impersonate tokens it can obtain, and Potato-family tools exploit this by coercing a privileged service to authenticate to an attacker-controlled endpoint. JuicyPotato and RoguePotato target older builds, while GodPotato's DCOM/RPC approach works on newer builds. Both options align with the privilege and the outdated-build context, producing a SYSTEM shell without a kernel exploit.

Answer

Abuse the SeBackupPrivilege to read the SAM and SYSTEM registry hives and extract local account hashes.

Answer

Deploy PrintSpoofer against the Spooler service to capture a SYSTEM token over a named pipe.

Answer

Use the SeTcbPrivilege to add your account to the local Administrators group directly.

Question 14

While exploiting a Linux web application, you find a page that passes a user-supplied filename directly to a PHP include() call. You want to convert this local file inclusion into remote code execution. Which approach is most reliable?

Accepted Answer

Inject a PHP filter chain that generates arbitrary PHP code from a controlled string.. PHP filter chains use the php://filter wrapper to synthesize executable PHP from an attacker-controlled string, and include() evaluates the result. This works regardless of allow_url_include and does not require a writable upload directory, which makes it the most reliable method for turning a confirmed local file inclusion into remote code execution on current PHP deployments.

Answer

Point the parameter at /proc/self/environ and inject code through the User-Agent header.

Answer

Set the parameter to a data:// URI containing the PHP payload.

Answer

Use php://input to supply the payload in the request body.

Question 15

You have gained standard user execution rights on a hardened Windows 10 enterprise workstation and need to enumerate local privilege escalation vectors. Which TWO methods are most effective for identifying insecure file permissions or unquoted service paths? (Choose two)

Accepted Answer

Executing AccessChk from the Sysinternals suite to review discretionary access control lists on service executables.. Discovering unquoted service paths and vulnerable file permissions represents a foundational step in local Windows privilege escalation. Penetration testers leverage tools and native commands to locate binaries running with SYSTEM privileges that can be modified or hijacked, allowing arbitrary code execution upon service restart.

Answer

Querying the root certificate store via PowerShell to check for untrusted root certification authorities.

Answer

Inspecting the local security policy database using the auditpol utility to check account lockout thresholds.

Answer

Reviewing the Active Directory group policy object inheritance tree using the Resultant Set of Policy tool.