PEN-200 Windows Privilege Escalation Practice Test 2 — 15 Questions

Question 1

You have gained access to a Windows workstation as a standard user. You want to identify installed applications that might have known privilege escalation vulnerabilities. Which command-line tool is specifically designed to list installed software and their versions on a Windows system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

wmic product get name,version. The `wmic product get name,version` command queries the Windows Installer provider to list installed MSI applications along with their versions. This provides a quick inventory of software that may have known vulnerabilities, aiding in privilege escalation research. Although it may not list all applications, it is a built-in command-line tool specifically designed for this purpose.

Answer

dir /s /b "C:\Program Files"

Answer

Get-WmiObject -Class Win32_Product

Answer

systeminfo

Question 2

During enumeration on a Windows Server 2016 host, you find that the service 'CustomSvc' runs as LocalSystem and its binary path is 'C:\Program Files\CustomSvc\svc.exe'. The directory 'C:\Program Files\CustomSvc' has default permissions (Administrators: Full Control, SYSTEM: Full Control, Users: Read & Execute). However, you notice that the service has an unquoted path with a space: 'C:\Program Files\CustomSvc\svc.exe'. Which attack is most likely to succeed?

Accepted Answer

Place a malicious 'CustomSvc.exe' in C:\Program Files\ and restart the service.. Unquoted service paths with spaces cause Windows to search for executables in parent directories. For 'C:\Program Files\CustomSvc\svc.exe', the system tries 'C:\Program.exe', then 'C:\Program Files\CustomSvc.exe'. If an attacker can write to 'C:\Program Files', they can place 'CustomSvc.exe' there. When the service restarts, it executes the malicious binary as LocalSystem. The other options fail due to insufficient permissions or requiring administrative rights.

Answer

Modify the service's registry key to point to a malicious binary in a writable location.

Answer

Place a malicious 'Program.exe' in C:\ and restart the service.

Answer

Place a malicious 'svc.exe' in C:\Program Files\CustomSvc\ and restart the service.

Question 3

You have gained access to a Windows Server 2019 host as a low-privileged user. You discover that the system has the SeBackupPrivilege and SeRestorePrivilege enabled for your user account. You want to extract the SAM and SYSTEM registry hives to obtain password hashes for offline cracking. Which command should you use to copy the SAM hive to a location where you can access it?

Accepted Answer

reg save HKLM\SAM C:\Temp\sam.hiv. With SeBackupPrivilege, you can use `reg save` to export a copy of the SAM and SYSTEM hives. This command leverages backup semantics to read locked registry files. Direct copy or robocopy may not work without proper flags, and esentutl is for different file types. The saved hives can then be parsed with tools like secretsdump to extract hashes.

Answer

copy C:\Windows\System32\config\SAM C:\Temp\sam.hiv

Answer

robocopy /b C:\Windows\System32\config C:\Temp SAM

Answer

esentutl /y C:\Windows\System32\config\SAM /d C:\Temp\sam.hiv

Question 4

You have a low-privileged shell on a Windows host and want to enumerate potential privilege escalation vectors. Which TWO of the following commands or techniques are effective for discovering weak service permissions? (Choose two.)

Accepted Answer

Run 'accesschk.exe -uwcqv "Everyone" *' to list services where Everyone has write or config permissions.. Effective enumeration for weak service permissions involves checking both service configuration permissions and file system permissions on service binaries. AccessChk can directly list services with weak ACLs, while icacls on program directories reveals writable folders. The other commands provide service status, paths, or require elevated rights, and do not directly identify weak permissions exploitable by a low-privileged user.

Answer

Use 'sc query state= all' to list all services and their current status.

Answer

Run 'wmic service get name,displayname,pathname,startmode' to list service paths and start modes.

Answer

Use 'Get-Service | Get-Acl' in PowerShell to inspect service permissions.

Question 5

You have gained a low-privileged shell on a Windows system and discovered a service running as 'LocalSystem' with an unquoted executable path containing spaces. Which action is the most direct way to escalate privileges?

Accepted Answer

Place a malicious binary at a location in the unquoted path that the user can write to.. Unquoted service paths are vulnerable because Windows attempts to resolve the path by interpreting spaces as delimiters. By placing a malicious executable at an intermediate folder in the path, the service manager executes your binary with SYSTEM privileges upon restart. Identifying and exploiting these paths is a foundational skill for post-exploitation, allowing attackers to elevate from standard user to the highest possible integrity level without needing complex kernel exploits.

Answer

Restart the service immediately to trigger a buffer overflow.

Answer

Overwrite the existing service executable with your payload.

Answer

Modify the Windows Registry to point the service to a new location.

Question 6

Refer to the exhibit. What can you conclude about the security of this service binary?

Accepted Answer

The binary can be replaced by any local user to achieve privilege escalation.. The icacls output shows that 'BUILTIN\Users' has '(M)' or Modify permissions on the binary. This means a low-privileged user can replace the legitimate service executable with a malicious one. Because services run as SYSTEM, replacing this file allows for immediate privilege escalation upon the next service restart. This is a common misconfiguration where excessive folder or file permissions enable attackers to gain total control over the host.

Answer

The service is vulnerable to a DLL hijacking attack.

Answer

The service is secure because only SYSTEM and Administrators have full access.

Answer

The service cannot be stopped by a standard user.

Question 7

You have identified an AlwaysOn service running with SYSTEM privileges. The service binary is read-only, but you have write access to its directory. What is the most likely escalation vector?

Accepted Answer

DLL Hijacking.. If the binary is read-only but the directory is writable, you may be able to perform DLL hijacking. Windows applications often look for DLLs in the application directory before searching system folders. By placing a malicious DLL with the same name as a dependency into the application's folder, you can force the application to load your code when it starts, gaining SYSTEM privileges.

Answer

Exploiting the unquoted service path.

Answer

Modify the service binary directly.

Answer

Overwriting the service configuration file.

Question 8

What is the primary purpose of using 'accesschk' during the enumeration phase of Windows privilege escalation?

Accepted Answer

To identify files and services with weak permissions.. Accesschk is a powerful tool from the Sysinternals suite used to check the permissions of files, directories, registry keys, and services. In privilege escalation, it allows an attacker to quickly find misconfigured resources that the current user can modify. By identifying these 'weak' permissions, the attacker can pinpoint specific targets for exploitation, such as replacing a service binary or modifying a sensitive script.

Answer

To bypass Windows Firewall rules.

Answer

To dump the SAM database for password hashes.

Answer

To automate the deployment of kernel exploits.

Question 9

Refer to the exhibit. What is the most likely goal of this command execution in a privilege escalation context?

Accepted Answer

To perform automated enumeration for privilege escalation.. This command downloads and executes a PowerShell script directly into memory from a remote server. This is a common technique for running automated enumeration scripts like PowerUp or WinPEAS without writing them to the disk. By executing in memory, the attacker minimizes their footprint on the host system, avoiding detection by file-based signature scanning while gathering information about potential escalation vectors.

Answer

To install a persistent backdoor on the system.

Answer

To escalate privileges to SYSTEM directly.

Answer

To exfiltrate sensitive files from the system.

Question 10

When exploiting a service via 'Modify' permissions on its binary, why is it necessary to restart the service?

Accepted Answer

To trigger the execution of the new binary.. Services run as long-lived processes. When the service starts, the binary is loaded into memory and executed. If you replace the binary while the service is running, the old process remains active. Restarting the service forces the Service Control Manager to stop the original process and start the new, modified binary, thereby executing your malicious code in the process space of the service.

Answer

To refresh the file system cache.

Answer

To bypass the Windows Service integrity check.

Answer

To allow the service to read the new configuration.

Question 11

Which of the following describes the danger of a service that runs as 'LocalSystem' but does not have the 'Interactive' flag enabled?

Accepted Answer

The service is still fully capable of performing administrative actions.. Even without the 'Interactive' flag, a service running as 'LocalSystem' has the highest possible privileges on the local machine. The flag only determines if the service can display a GUI to the logged-in user. Attackers can still interact with these services via command-line exploits or by injecting code into them, making the 'Interactive' flag irrelevant for determining the security risk of the service account.

Answer

The service is immune to DLL hijacking.

Answer

The service cannot be exploited.

Answer

The service only runs when a user is logged in.

Question 12

Refer to the exhibit. What is the primary vulnerability shown here?

Accepted Answer

The task executes a batch file that may be writable by users.. The scheduled task '\SystemTask' runs as 'SYSTEM' and executes 'C:\scripts\run.bat'. If a standard user has write access to 'run.bat' or the directory 'C:\scripts', they can modify the script to run any command. Since the task runs as SYSTEM, the modified command will also run as SYSTEM, leading to a simple and effective privilege escalation path via scheduled task hijacking.

Answer

The task is not running, so it is secure.

Answer

The task name '\SystemTask' is too generic.

Answer

Scheduled tasks cannot be used for privilege escalation.

Question 13

During a PEN-200 lab engagement, you obtain a low-privileged shell on a Windows machine and discover an unquoted service path containing spaces in its directory name. The service runs as Local System, but the parent folder has overly permissive discretionary access control lists granting standard users Full Control. How should you exploit this misconfiguration to escalate your privileges?

Accepted Answer

Upload your malicious executable to the vulnerable intermediate directory using the exact intermediate folder name expected by the path parser.. Placing a malicious executable with a name matching the fragmented path segment allows you to hijack the service binary resolution process when the service restarts. Windows searches for spaces sequentially from left to right, executing your payload with Local System privileges. This technique is a fundamental Windows privilege escalation vector taught in the PEN-200 curriculum.

Answer

Modify the Windows Registry ImagePath entry directly using standard user credentials to append your custom payload path.

Answer

Replace the existing service executable file directly inside the protected system folder to hijack execution upon the next reboot.

Answer

Send a malformed buffer overflow payload directly to the service network port to achieve remote code execution as Local System.

Question 14

When auditing a Windows host for privilege escalation vectors during a PEN-200 assessment, you discover that the machine has AlwaysInstallElevated enabled in the Windows Registry. Which TWO conditions must be verified simultaneously to successfully weaponize this misconfigured policy?

Accepted Answer

The AlwaysInstallElevated value must be set to 1 in HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer.. AlwaysInstallElevated allows low-privileged users to install malicious MSI packages with elevated NT AUTHORITY\SYSTEM privileges. However, exploitation requires both registry hive keys to be properly configured to enabled values. Verifying both keys ensures the Windows Installer service honors the elevated installation flag for all packages regardless of user context.

Answer

The local security policy must allow standard users to bypass User Account Control prompts via group policy objects.

Answer

The target user account must possess local Administrator group membership prior to executing the malicious MSI package.

Answer

The Task Scheduler service must be configured to permit interactive logons for disabled service accounts.

Question 15

An attacker gains a low-privilege shell on a Windows 10 machine and discovers a third-party service named 'DataSync'. The attacker notes that the service runs as SYSTEM and they have 'FILE_WRITE_DATA' permissions on the service executable 'C:\Program Files\DataSync\sync.exe'. Which action is the most direct method to escalate privileges to SYSTEM?

Accepted Answer

Stop the service, replace 'sync.exe' with a malicious payload, and restart the service.. Service binary hijacking is a powerful technique where an attacker replaces a legitimate executable with a malicious one. Since the service runs as SYSTEM, the replaced binary will execute with those high privileges upon the next service start. This method is often more reliable than DLL hijacking because it directly controls the primary execution flow of the service, provided the attacker can restart the service or wait for a system reboot.

Answer

Place a malicious DLL named 'sync.dll' in the 'C:\Windows\System32' directory to intercept calls.

Answer

Modify the service configuration using 'sc config' to point to a different malicious executable.

Answer

Create a new service with the same name in the 'HKCU' registry hive to override the system service.