PT0-002 Attacks and Exploits Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  pth-winexe

  Why it's wrong here

  pth-winexe is a pass-the-hash tool from the Samba suite that authenticates to remote Windows hosts using NTLM hashes to execute commands, making it suitable for lateral movement or remote administration. It does not perform local privilege escalation because it requires existing credentials or hashes for a privileged account rather than exploiting a vulnerability or misconfiguration on the current host. Even if a hash is available, that is an authentication attack, not a privilege escalation technique.

• ✓

  PrintSpoofer

  Why this is correct

  PrintSpoofer is a local privilege escalation tool that abuses the SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege commonly granted to Windows service accounts. It leverages the Print Spooler service's named pipe to capture a SYSTEM token and then impersonates it, spawning a process as NT AUTHORITY\SYSTEM. This directly escalates the existing low-privilege shell to full system privileges on the same host, making it the correct choice for this scenario.

• ✗

  Responder

  Why it's wrong here

  Responder is a network poisoning tool that listens for LLMNR, NBT-NS, and mDNS broadcasts and responds to them to capture NTLMv2 hashes or credentials from other machines. It is used in the discovery or exploitation phase to gain initial access, not to escalate privileges on an already compromised local host. Its effectiveness depends on other systems generating broadcast traffic, so it has no role in escalating a low-privilege shell on the current machine.

• ✗

  CrackMapExec

  Why it's wrong here

  CrackMapExec is a post-exploitation framework that automates lateral movement by running commands across many hosts via SMB, WinRM, or LDAP using harvested credentials or hashes. It assumes you already have sufficient privileges or credentials to authenticate to remote systems, and it does not exploit local privilege escalation vectors. From a low-privilege shell on a single host, CrackMapExec cannot raise your privileges because it lacks any mechanism to elevate the current process or token.

Go deeper

Related to this question