CEH Enumeration and System Hacking Practice Question
A security analyst notices that an attacker has gained SYSTEM privileges on a Windows server after compromising a service running as LOCAL SYSTEM. The attacker then uses `whoami /priv` and finds the SeTcbPrivilege (Act as part of the operating system) is enabled. Which privilege escalation technique might the attacker use next?
⚠ Common exam trap
Candidates often confuse SeTcbPrivilege with SeDebugPrivilege or assume it only applies to kernel-level attacks, but CEH specifically tests that SeTcbPrivilege enables token impersonation via Windows API calls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Token impersonation
With SeTcbPrivilege enabled, the attacker can call the `CreateProcessAsUser` or `DuplicateTokenEx` API to impersonate any user token, including SYSTEM. This is a classic token impersonation attack, allowing the attacker to elevate from LOCAL SYSTEM to a higher-integrity context or move laterally by creating processes with arbitrary identities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sticky keys exploit
Why it's wrong here
The Sticky Keys exploit involves replacing the `sethc.exe` (Sticky Keys executable) with a command prompt or other utility. This allows an attacker to gain a SYSTEM-level shell by pressing the Shift key five times at the Windows login screen, even without authentication. While it grants high privileges and persistence, it is primarily a backdoor mechanism for system access and not directly related to leveraging the `SeTcbPrivilege` for token impersonation.
- ✓
Token impersonation
Why this is correct
Token impersonation is a direct privilege escalation technique enabled by the `SeTcbPrivilege`, also known as 'Act as part of the operating system'. This powerful privilege allows a process to create a new access token for any user or even the SYSTEM account, effectively assuming their security context. An attacker with this privilege can create a token representing a higher-privileged user and then execute commands or access resources with those elevated permissions.
- ✗
DLL injection
Why it's wrong here
DLL injection is a technique where an attacker forces a legitimate process to load a malicious Dynamic Link Library (DLL) into its address space. This allows the attacker to execute arbitrary code within the context of the target process, often used for hooking functions, bypassing security controls, or maintaining persistence. However, DLL injection is a code execution method and does not inherently rely on or directly leverage the `SeTcbPrivilege` for token manipulation or impersonation.
- ✗
Pass-the-hash
Why it's wrong here
Pass-the-Hash (PtH) is a lateral movement technique where an attacker authenticates to a remote system or service by reusing a stolen NTLM or Lan Manager (LM) hash of a user's password, rather than the plaintext password itself. This method exploits weaknesses in authentication protocols and is used to move across a network using compromised credentials. PtH is distinct from `SeTcbPrivilege` as it focuses on network authentication with stolen hashes, not on local token creation or impersonation capabilities.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.