PT0-002 Attacks and Exploits Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Mimikatz

  Why it's wrong here

  Mimikatz is incorrect because its primary function is extracting credentials, such as NTLM hashes and Kerberos tickets, from memory (specifically the LSASS process), not directly exploiting the SeImpersonatePrivilege for local SYSTEM escalation. This privilege requires a tool capable of creating a new process with an impersonated token, such as RottenPotato or JuicyPotato. Mimikatz is tempting as a widely recognised post-exploitation tool for privilege escalation, and would be the correct choice if the objective was to dump credentials for lateral movement or further access within a network.

• ✗

  Windows-Exploit-Suggester

  Why it's wrong here

  Windows-Exploit-Suggester is a script that inventories the target's operating system build and installed hotfixes, then compares them against a vulnerability database to suggest kernel or local service exploits that match missing patches. While useful for finding kernel exploits like MS18-102, it does not analyze token privileges such as SeImpersonatePrivilege, so it would not identify or exploit the specific privilege-abuse vector that PrintSpoofer targets.

• ✓

  PrintSpoofer

  Why this is correct

  PrintSpoofer is the correct choice because it directly abuses SeImpersonatePrivilege by creating a named pipe and then coercing a SYSTEM-level process, typically the print spooler, to connect to it. Once the connection occurs, the tool impersonates the SYSTEM token from the named pipe connection, allowing the attacker to spawn a new process as SYSTEM. This is a textbook token impersonation attack, not a kernel exploit, making it the precise tool for the described privilege escalation attempt.

• ✗

  PowerUp

  Why it's wrong here

  PowerUp is a PowerShell-based privilege escalation scanner that focuses on common Windows misconfigurations, such as weak service permissions, unquoted service paths, DLL hijacking, and unattended credentials. It can report that a user has SeImpersonatePrivilege, but it does not contain the token-impersonation attack logic necessary to convert that privilege into a SYSTEM shell. Thus, while PowerUp is a legitimate post-exploitation tool, it is not the tool that would directly escalate via SeImpersonatePrivilege as PrintSpoofer does.

Go deeper

Related to this question