CompTIA PenTest+ (PT0-003) (PT0-003) — Questions 226–300

Hashcat mode 1000 is the designated mode for cracking NT/NTLM hashes, the MD4-based hash of the UTF-16LE password used by Windows for authentication. When an attacker captures NTLM hashes (e.g., from the SAM database or NTDS.dit), mode 1000 is required because the hash format is not a generic MD5 or another algorithm; it's a specific Windows-specific format. This mode directly processes the raw 32-character hexadecimal NTLM hash and is the correct choice for this scenario.

Under CVSS v3.x, a base score of 7.5 falls squarely within the High severity band, which spans 7.0 to 8.9. This score commonly results from a network attack vector, low user interaction, and a significant impact on one or more security objectives, though not enough to reach the near-maximum conditions of Critical. Assigning High is accurate and ensures the vulnerability is prioritized appropriately in remediation planning, in line with widely accepted scoring interpretations.

The command parses the /etc/shadow file, which stores user authentication data in colon-delimited fields. The first field is the username and the second is the password hash (or a placeholder like ! or * for locked accounts). By printing these two fields, the script effectively dumps every local user's account name alongside its cryptographic hash, enabling offline password cracking with tools like John the Ripper or Hashcat. This is a classic post-exploitation credential-gathering technique, but it requires root or CAP_DAC_READ_SEARCH privileges to read /etc/shadow.

A root-owned cron job executing a script stored in a world-writable directory is a classic privilege escalation path. Because the tester can overwrite the script's contents, the next scheduled execution runs the modified code with root privileges. Replacing the script body with a command that spawns a root shell directly leverages the misconfiguration found during enumeration.

The authentication script reads a flat-file credential store and lacks input sanitisation, so a path traversal payload in the HTTP request can escape the intended directory and return the password file contents, yielding credentials for the SSH-only server.

Demonstrating the exploit steps is essential for a technical audience because it proves the vulnerability is exploitable and shows the exact commands, tools, and conditions required to achieve the compromise. This hands-on walkthrough allows the defenders to understand the full kill chain—from initial access to privilege escalation—and to map those steps to their own detection and prevention controls. Seeing the exploit in action also removes any ambiguity about whether the finding is a false positive, because the tester can show the actual impact in a controlled environment.

Reflected XSS occurs when a user-controlled parameter is embedded into the HTTP response without proper encoding or sanitization, and the browser executes the injected script as part of the page. The script is triggered only when the victim clicks a crafted link, making the attack non-persistent. Since the parameter is directly reflected in the response and the server is echoing the input, this matches the classic signature of reflected XSS.

Wireshark is a network protocol analyzer that captures live traffic by putting the network interface into promiscuous mode via libpcap (or Npcap on Windows) and decoding frames from the data-link layer through the application layer. It is the standard tool for raw packet capture because it passively observes all packets on a network segment, regardless of transport protocol (TCP/UDP) or application (HTTP, SSH, DNS, etc.). Its dissectors, filters, and follow-stream capability directly support analyzing captured traffic, making it the correct choice for this task.

ss is the standard socket statistics utility in iproute2 and is almost always preinstalled on current Linux systems. The flags -t (TCP), -l (listening), -n (numeric), and -p (process) together precisely list listening TCP ports with numeric addresses and, when permitted, the owning process/PID. Because ss reads kernel socket information via netlink, it returns live results instantly and is the modern replacement for netstat.

Requiring a staging environment is the only option that truly eliminates production risk while preserving test depth. A well-configured staging environment, ideally deployed with the same versions, patches, and security controls as production, allows the tester to execute even destructive or high-impact exploits without violating the no-fail clause. This approach maintains test validity because the attacker's interaction with the system is functionally identical, assuming network segmentation and data fidelity are properly addressed. The key is to validate the staging environment's parity before testing.

A 403 Forbidden response indicates the server understood the request but refused it, typically because traversal sequences are filtered or the web server is patched against directory traversal. A missing file would return 404, and network failure would not yield an HTTP status.

A rate-limiting clause operationalizes a technical control by constraining packets per second, concurrent connections, or tool-specific throttling such as Nmap's `--max-rate`, `--max-parallelism`, or timing templates. This directly reduces the risk of resource exhaustion on stateful devices like firewalls, load balancers, and application servers that have limited session tables or timeouts. Because the tester often lacks full visibility into the client's device capacities, a conservative rate limit keeps scan traffic within a safe tolerance and prevents self-inflicted DoS, even when network details are unknown.

The client's non-disruption constraint governs the engagement, so the tester cannot unilaterally target production. Requesting a scope amendment through formal negotiation preserves the client relationship and ensures any production testing is authorised and documented, satisfying the realistic-simulation goal without breaching agreed boundaries.

Hashcat performs offline hash cracking and supports GPU acceleration through OpenCL and CUDA, making it suited to NTLM hashes at high speed. It also handles NTLM format directly, unlike tools built for network capture or online authentication attacks.

filetype:pdf restricts Google's index to files with the PDF extension, which is ideal for information gathering because PDFs published on a target domain—such as user guides, annual reports, or internal memos—frequently contain metadata, employee names, and technology stack details that are not visible in ordinary HTML pages. During passive reconnaissance, this operator narrows results to a discrete document format that often escapes normal web crawling and may reveal sensitive or forgotten disclosures.

socat relays raw TCP streams between two endpoints, so binding a listener on the compromised host and connecting back to the tester's machine tunnels traffic into the internal network — satisfying the pivot requirement without needing SSH or a full proxy tool.

Registering a look-alike domain and luring employees to a counterfeit login page to capture credentials is the defining pattern of a phishing simulation focused on credential harvesting. The objective is to measure human susceptibility and the effectiveness of awareness controls, which matches the approved scenario of tricking staff into revealing their login details.

This matches the purpose of the executive summary: concise, business-focused information that allows leadership to make informed decisions without needing technical expertise.

Reflected cross-site scripting (XSS) is confirmed because the tester's input is echoed back unharmed within the HTML response, and the response contains the script execution—typically the payload becomes part of the DOM and runs in the victim's browser. Unlike stored XSS, this reflected variant requires the user to click a crafted link with the payload in a parameter, and the server does not filter or encode the value before embedding it in the HTML. This direct reflection and subsequent client-side execution are the definitive markers of reflected XSS, not of SSRF, CSRF, or SQLi.

Mode 1000 is the correct Hashcat mode for cracking NTLM hashes, which are the legacy Windows authentication digests stored in SAM and NTDS.dit. Each NTLM hash is specifically a single MD4 hash of the user's password in UTF-16LE encoding, a design that makes these hashes extremely fast to brute-force.

The version of services running on each port is the critical missing piece because the penetration tester has already identified open ports, but without knowing the exact software release (e.g., Apache 2.4.49 vs. 2.4.50), they cannot map those services to specific CVEs and exploit modules. Banner grabbing or Nmap's -sV flag would supply this data, directly enabling vulnerability research and exploitation planning.

The script invokes FTP and Telnet client libraries (e.g., ftplib and telnetlib) to open connections and submit login credentials, iterating through password guesses for an identified account. Successful or failed login responses are monitored to determine valid credentials. This is a classic online brute-force attack: it relies on repeated authentication attempts against a live service rather than probing for vulnerabilities or passively observing banner data.

Written authorization from the third-party API provider is the only legally binding endorsement for testing infrastructure you do not own. It must be explicit about the scope, IP ranges, endpoints, methods, and time window to avoid exceeding authorized access. Without it, the tester risks criminal or civil liability regardless of the client's request, because the client lacks legal authority to deputize a tester on the provider's systems. A provider's documented permission also protects the client's future relationship and the tester's professional standing.

Bandit parses Python source into an abstract syntax tree and flags insecure patterns such as eval, weak hashing and shell injection without executing the code, satisfying the static analysis requirement. Generic scanners lack this language-specific depth.

This payload defines an external entity named 'xxe' that points to the link-local cloud metadata service at 169.254.169.254. When the vulnerable XML parser resolves the entity, it performs a server-side request to that URL, allowing the tester to access instance metadata like IAM credentials. This is both an XXE and an SSRF, specifically aimed at cloud environments.

This option is correct because an executive summary is engineered for decision-makers who need the outcome and strategic direction, not technical minutiae. Framing findings in business language with an overall risk rating and key findings allows leadership to grasp the organization's security posture quickly. Strategic recommendations tie the findings to actionable priorities, making the summary directly useful for approving budgets, prioritizing remediation, and setting security initiatives.

A SYN-ACK response is the second step in the standard TCP three-way handshake and is generated only by a service that is actively listening on that port. When the target replies with SYN-ACK, it affirms that the port is open and ready to accept a connection. This is the core evidence used in a SYN scan to distinguish open ports from closed or filtered ones.

The technical findings section is the authoritative repository for every vulnerability, misconfiguration, or security weakness discovered during the engagement. Each finding is documented with a detailed narrative, proof-of-concept steps, affected assets, severity rating (e.g., CVSS base score), and remediation guidance, enabling technical stakeholders to replicate and fix the issue. This is precisely where the granular evidence and exploit details are recorded, making it the correct place for full technical descriptions.

Raw sockets expose the IP and TCP headers to the application, enabling the attacker to craft arbitrary TCP packets with custom flags such as SYN, spoof source IP addresses, and bypass the kernel's TCP state machine. In a SYN flood, the attacker repeatedly sends SYN packets but never completes the handshake, exhausting the target's SYN backlog queue and denying service to legitimate clients. This requires socket.socket(AF_INET, SOCK_RAW, IPPROTO_TCP) plus IP_HDRINCL, capabilities that normal stream sockets (SOCK_STREAM) cannot offer.

The Conversations window aggregates captured traffic into endpoint pairs, showing byte counts, packet totals and duration per conversation. This satisfies the requirement to focus on specific communication types by revealing which hosts exchanged data and letting the tester drill into a chosen stream.

Hydra is a well-known network authentication cracker that performs online brute-force attacks by repeatedly submitting login credentials to a live service over the TCP/IP stack. For SSH specifically, Hydra invokes the SSH protocol handshake, supplies candidate username/password pairs, and inspects the server's authentication response to determine success. Its parallelism and modular protocol support (including the 'ssh' module) make it the appropriate choice for attacking a remote host where the password is guessed at the service itself.

Responder is the de facto tool for poisoning LLMNR, NBT-NS, and mDNS queries by answering them with the attacker's IP address, thereby causing clients to send SMB authentication attempts containing NTLMv2 hashes. It operates in the background, listens to broadcast name resolution requests, and tricks unsuspecting hosts into sending their credential material. Once captured, the hashes can be cracked offline with hashcat or relayed via ntlmrelayx, making Responder the correct initial-phase tool for this goal.

The useradd command creates a new user. The -m flag ensures a home directory is created, and -s /bin/bash sets the login shell to bash. This matches the requirement to create a user with a home directory and bash shell. After running this, the tester would set a password with passwd support. This is the standard and correct way to add a user on most Linux distributions.

The script uses Get-Credential to prompt for valid authentication, then Invoke-Command with a ScriptBlock that runs Get-ChildItem against C:\ on Server01. This is classic lateral movement: authenticating to a remote host over PowerShell Remoting (WinRM) and executing commands to access files. It moves the attacker's foothold from the current machine to Server01, rather than raising privileges on the local system.

Manually verifying a subset of the findings is the correct next step after an automated scan, because tools like Nikto rely on signature matching and often produce false positives that don't reflect the actual application behavior. By using techniques such as inspecting raw HTTP responses, confirming server headers, or re-checking vulnerable files with curl, the tester can confirm whether a finding represents a genuine vulnerability, gauge the scanner's accuracy, and prioritize remediation based on validated evidence.

The -z flag instructs netcat to scan for open ports by completing a TCP handshake and then closing the connection without transmitting payload data. If the handshake succeeds, the port is reported as open; otherwise it is reported as closed or filtered. Therefore the script checks whether each IP has port 22 open, which is a simple port availability test.

Feroxbuster is a Rust-based recursive content discovery tool designed specifically for brute-forcing web directories and files, including API endpoints. It uses dictionary-based wordlists, supports status-code and size filtering, and can recurse into discovered directories, making it effective for mapping undocumented API routes. Its speed and flexibility with custom headers, request methods, and extension fuzzing make it the correct tool for this task.

Chisel tunnels TCP over HTTP/WebSocket, creating a SOCKS proxy through the foothold host. This satisfies the requirement to reach the internal segment that is not directly accessible, and works where only HTTP egress is permitted.

SQL injection is the correct answer because the source code concatenates user-supplied input directly into a SQL query without using parameterized prepared statements or proper escaping. For example, a query built as "SELECT * FROM users WHERE username = '" . $_POST['user'] . "'" can be exploited with a payload like ' OR '1'='1 to bypass authentication or with UNION-based queries to extract sensitive data. This flaw allows an attacker to read, modify, or delete database contents, and in some cases execute stored procedures, depending on the database user's privileges. The remediation is to use prepared statements with bound parameters, which separate data from SQL code and prevent the attack.

Shodan continuously probes public IP ranges and collects response banners, including HTTP headers, SSH keys, and SNMP strings, which it indexes for instant querying. This enables a pen tester to identify specific device types, software versions, and open ports on a global scale, making it an invaluable reconnaissance tool prior to close-in testing. It allows searching by filter such as 'port:22', 'product:Apache', or 'country:US'.

Reflected XSS occurs when user-supplied input is immediately echoed back in the server's response without proper sanitization or encoding. The attacker crafts a malicious URL containing script payload and lures the victim into clicking it; when the page loads, the script runs in the victim's session. This allows the attacker to steal session cookies via document.cookie and send them off-site, facilitating session hijacking. Because the payload is not persisted on the server, delivery depends on the victim accessing the crafted link.

The number of critical and high-risk findings, paired with the average time to exploit them, directly conveys the organization's most urgent exposures in a business-relevant way. This metric tells executives how many vulnerabilities pose an immediate threat and how quickly an attacker could leverage them, which is more actionable than raw severity scores. It frames the summary around exposure and remediation urgency, allowing leadership to prioritize resources and track risk reduction.

On Linux, the kernel's access-control checks equate any effective UID of 0 with the superuser, regardless of the username associated with that UID. The account name is just a human-readable label; when jake's UID is 0, the system treats every jake-run process as a root-owned process, granting full control over files, processes, and devices. This is precisely why a UID-0 account is said to have the same privileges as root.

Hashcat mode 1000 targets raw NTLM hashes, matching the captured pass-the-hash material exactly. Unlike mode 5500, which expects NetNTLMv1 challenge-response pairs, mode 1000 parses the bare 16-byte NT hash directly, so the tester avoids format errors and cracks the captured credentials efficiently.

This scope correctly balances comprehensive internal testing with business continuity: it includes all network segments to simulate both external and internal attackers, but excludes the payment processing VLAN to protect cardholder data and PCI DSS-scoped systems. The immediate-stop rule serves as a safety kill switch, ensuring any sign of degradation halts testing before impact. This covers internal segmentation testing across VLANs, which is essential for a medium e-commerce company, while respecting the CISO's risk tolerance.

GDPR governs processing of EU residents' personal data, so the rules of engagement must include data protection and privacy clauses specifying lawful handling, storage, and disposal of any personal data encountered during testing across European systems.

A Data Protection Addendum (DPA) is a legally binding contract that mandates how sensitive information such as Protected Health Information (PHI) must be guarded, processed, and ultimately destroyed in accordance with regulations like HIPAA/HITECH. In a healthcare penetration test, the DPA requires specific technical safeguards—e.g., AES-256 encryption for data at rest and in transit, role-based access limits, and NIST SP 800-88-compliant wiping before return or disposal. This precision and enforceability make the DPA the correct instrument for defining data handling, unlike broader scoping or authorization documents.

This is the correct approach because the captured NetNTLMv2 challenge-response can be forwarded to a target server as part of an SMB authentication sequence. When SMB signing is not enforced, the target server cannot detect that the relayed response is not associated with the original client, so it accepts the authentication as if it came from the legitimate user. The tester can then gain access to file shares, services, or even remote code execution depending on the privileges of the captured user account, and this bypasses the need to crack the password.

Shodan is a search engine for internet-connected devices that continuously crawls the web and stores service banners, including HTTP Server headers, from historical scans. Querying Shodan by the target's IP address or domain is a purely passive reconnaissance technique because it retrieves already-collected data without sending a single packet to the target. This makes it ideal for stealthy initial fingerprinting, as it reveals the web server software and version without any risk of detection or direct interaction.

Kerberoasting correctly involves requesting service ticket (TGS) hashes for Service Principal Names (SPNs), then transferring them to an offline workstation. Because the TGS is encrypted with the target service account's NTLM hash, an attacker can run hashcat or John the Ripper against it to recover the plaintext password, especially if the password is weak or reused. The offline cracking step is what makes the attack low-risk and highly successful.

The primary purpose of the pre-engagement authorization letter is to protect the penetration tester from allegations of unauthorized access. Without it, a client or a third party monitoring network traffic—such as an ISP or law enforcement—could reasonably perceive the scanning and exploitation activity as malicious and pursue criminal or civil charges. The letter documents informed consent, defines the exact scope, and names the responsible parties, thereby converting what might look like an attack into an authorized security assessment.

This is the core of a penetration test report, providing detailed descriptions of discovered vulnerabilities, including affected systems, exploitation steps, and impact. It must also include actionable remediation steps, such as patching, configuration changes, or code fixes, so the client can address risks. Without this, the report would not meet the engagement's objective of enabling the client to reduce risk.

The -sS option, Nmap's default SYN scan, transmits a raw TCP packet with only the SYN flag set to each port; an open port replies with a SYN/ACK, a closed port with an RST, and a filtered port drops the packet or returns an ICMP unreachable. Because Nmap aborts the handshake immediately upon receiving SYN/ACK, it determines TCP port state without ever completing a full connection, making it fast and relatively unobtrusive.

This is the correct placement because professional penetration test reporting conventions, such as those in PTES and OWASP guidance, require remediation instructions to be embedded within each finding. Each vulnerability finding should include a clear remediation subsection—often with specific code examples, configuration changes, or patches—immediately following the evidence and impact. This inline approach ensures the development team sees the problem and the fix together, reducing ambiguity and preventing loss of context, and it also makes the report a single, self-contained reference for the entire remediation process.

DNS tunneling tools like dnscat2, iodine, and dns2tcp encode arbitrary data inside DNS queries and responses, which are allowed outbound on UDP/53 by the firewall. The tester controls an authoritative DNS server for a domain, so every DNS query from the compromised host to that domain carries a payload and the responses carry instructions, establishing a command-and-control channel that blends in with normal DNS traffic.

Password protection plus a digital signature satisfies the client-delivery constraint: encryption guards report confidentiality in transit, while the signature lets the client verify authenticity and detect tampering. A plain PDF or unprotected archive fails both requirements, so this format is the most appropriate for the final penetration test report.

NoSQL injection is the correct technique because MongoDB directly interpolates user-supplied input into its query objects. By submitting input such as username[$ne]=null or password[$gt]=, an attacker can inject MongoDB query operators that alter the intended logic, often bypassing authentication or extracting data. More dangerous is the $where operator, which can execute arbitrary JavaScript expressions, making injection possible without SQL syntax.

This command recursively enumerates every subkey under the Services registry key and requests the ImagePath value for each service/driver, producing the full command line or binary path that Windows will execute. Because a standard, low-privileged user can read HKLM\SYSTEM (CurrentControlSet), this is a practical enumeration step. An attacker can then identify entries whose paths contain spaces and lack surrounding quotes, setting up an unquoted-service-path privilege escalation attack by placing a crafted executable in a writable directory earlier in the path.

CVSS base scores assume no environmental mitigations, so the tester must report 9.8 unchanged and add a note describing the compensating controls. Recalculating or lowering the base score would misrepresent the vulnerability; the note preserves accuracy while acknowledging the client's controls.

CrackMapExec accepts an NTLM hash via its -H flag and passes it directly during SMB or WinRM authentication, so no plaintext password is needed. This exploits NTLM's design, where the hash itself is the credential, enabling lateral movement across Windows hosts.

Executives need a single comparable measure of exposure rather than technical detail. An overall risk score or posture rating aggregates individual findings into one business-readable metric, letting leadership judge severity and prioritise remediation budget without interpreting CVSS vectors or exploit mechanics.

Registry Run keys are a classic Windows persistence mechanism where an attacker adds a value to a run key such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Any executable referenced by these keys launches automatically when the designated user logs on, requiring minimal privileges for the HKCU variant and no need for a service or scheduled trigger. This is a straightforward, widely used persistence method that directly survives a reboot and re-authentication of the compromised user account.

Querying certificate transparency logs is passive because these logs are publicly auditable ledgers of all issued TLS/SSL certificates, maintained by independent log operators like Google and Cloudflare. An attacker can query them via services such as crt.sh or the ct.googleapis.com API to discover subdomains and certificate details without ever sending a packet to the target's own infrastructure, thereby leaving no trace in the target's logs.

The -T5 flag applies the 'insane' timing template, which aggressively reduces timeouts and increases probe parallelism to maximize scanning speed. The -F flag limits the scan to the top 100 most commonly open ports (per Nmap's services database), ensuring that only high-probability targets are probed. Together, these options provide the fastest method to discover which of the top ports are listening, which matches the penetration tester's objective.

A debugger such as GDB allows the tester to step through execution, inspect registers and memory, and set breakpoints on functions that handle input. With plugins like peda or gef, anti-debugging techniques can be bypassed or neutralized. This dynamic analysis reveals the actual validation logic as it runs, including comparisons and branching. It is the most effective way to understand a stripped binary's algorithm when static analysis is hindered.

The listener IP defines the interface on which the malicious SMB server awaits the victim's connection and must be set to an address owned by the attacker and routable from the victim's network. If it is misconfigured, the victim's SMB client cannot establish the TCP session, so no NTLM handshake occurs and no hash is ever transmitted. Correctly setting this IP is therefore the primary requirement for hash capture.

find / -perm /4000 recursively traverses the entire filesystem and matches files whose mode contains the SUID bit, expressed by the octal value 4000. The leading slash in -perm /4000 tells find to match when any of the specified permission bits are set, which is exactly the SUID bit (the normal execute bits don't need to be checked). This finds every SUID binary, including non-root-owned ones, making it the standard way to enumerate SUID files for privilege escalation.

The Rules of Engagement (RoE) is the core pre-engagement document that formalizes the client's authorization, defining the exact scope of target systems, allowed testing windows, permissible exploitation techniques, and emergency contact procedures. It serves as a legal safeguard for both the tester and the client, ensuring that all activity is explicitly sanctioned and that any deviation from the agreed terms is documented. Without a signed RoE, any penetration testing activity would be considered unauthorized access, exposing both parties to legal liability.

Scanner severity is only a baseline; the actual remediation priority must combine it with exposure and real-world threat data. For example, a medium-severity flaw on an internet-facing asset that is actively exploited in the wild requires faster action than a high-severity issue isolated in a lab with no reachable attack path. Thus, prioritization is a risk-based decision that weighs likelihood and impact, not just the static CVSS label.

Nikto is a lightweight, open-source web server scanner specifically built to quickly identify known vulnerabilities, outdated server software, and insecure files. It performs fast, signature-based checks without requiring a database setup or extensive configuration, making it ideal for a preliminary assessment. Its speed and focus on web server misconfigurations align directly with the need to 'quickly identify known vulnerabilities.'

Correct. The limitations section, often called constraints or rules of engagement, explicitly documents activities that are excluded from the authorized testing, such as no denial-of-service (DoS) testing, no social engineering, or no physical intrusion. This is a contractual safeguard that clearly defines prohibited actions to prevent accidental service disruption or legal overreach. Without a clear limitations section, the tester might assume an action is permitted simply because it is not prohibited elsewhere, leading to unintended consequences.

Black box is a type of penetration testing where the tester has no prior knowledge of the target's internal structure, architecture, or credentials. This approach simulates an external, unprivileged attacker and forces testers to rely entirely on reconnaissance and vulnerability discovery from the outside. It is one of the three knowledge-based categories, alongside white box and gray box.

This command is correct because -sV triggers version detection, and --script ssl-enum-ciphers explicitly invokes the Nmap script that enumerates SSL/TLS ciphers, protocols, and known weaknesses such as BEAST, POODLE, or weak key exchange. The script sends probe connections to the HTTPS service on port 443 and reports the strength of each cipher, which is precisely what a vulnerability scan of a web service requires. Restricting the scan to -p 443 focuses it on the SSL/TLS endpoint without extraneous traffic.

An unquoted service path occurs when the ImagePath registry value for a service contains spaces but is not enclosed in quotes. When Windows starts the service, it attempts to locate the executable by splitting the path at each space and trying the resulting filenames, moving from left to right. If an attacker has write access to a directory earlier in that sequence, they can drop a malicious executable (e.g., C:\Program.exe or C:\Program Files\Vendor.exe) that Windows will execute with the service's SYSTEM privileges. This is the correct exploitation method because it directly abuses the service's own path configuration to achieve code execution as SYSTEM.

Cookie tampering is the correct classification: the tester captures the session cookie, decodes it (e.g., Base64 or URL-decoded JSON), changes a value such as a role, privilege level, or account identifier, and re-encodes it before sending it back to the server. This attack is successful only when the server fails to encrypt or cryptographically sign the cookie, allowing a client-side alteration to be accepted. The result is privilege escalation through direct manipulation of the session token itself, distinguishing it from attacks that leave the token unchanged.