CEH Enumeration and System Hacking Practice Question
After gaining initial access, an attacker attempts to escalate privileges by exploiting a misconfigured service running as SYSTEM. They find that the service's binary path is writable by the Everyone group. Which privilege escalation technique is the attacker MOST likely using?
⚠ Common exam trap
Test-takers frequently confuse 'weak service permissions' (writable binary path) with 'unquoted service path' (missing quotes in the path), but the question explicitly states the binary path is writable, not that it contains spaces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Weak service permissions
The attacker can exploit weak service permissions where the binary path of a service running as SYSTEM is writable by the Everyone group. This allows the attacker to replace the legitimate service binary with a malicious executable, and when the service restarts (or the system reboots), the malicious code executes with SYSTEM privileges, achieving privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SUID/GUID abuse
Why it's wrong here
SUID (Set User ID) and SGID (Set Group ID) are special permissions on Unix/Linux executables that allow a user to run a program with the permissions of the file's owner or group, respectively. Attackers exploit misconfigured SUID/GUID binaries, such as `find` or `nmap`, to execute commands with elevated privileges. This method is specific to Unix-like operating systems and is not directly applicable to Windows environments, which often feature in initial access scenarios without OS specification.
- ✗
Unquoted service path
Why it's wrong here
An unquoted service path vulnerability occurs when a Windows service executable's path contains spaces and is not enclosed in quotation marks. The operating system attempts to execute the first valid path segment it encounters, allowing an attacker to place a malicious executable (e.g., `Program.exe`) in an earlier directory to be executed instead of the legitimate service binary. While a privilege escalation technique, it exploits path parsing logic rather than direct write permissions on the service binary itself.
- ✓
Weak service permissions
Why this is correct
Weak service permissions refer to overly permissive access control lists (ACLs) on a Windows service executable or its configuration, allowing non-privileged users to modify or replace the service binary. If an attacker can write to the service executable, they can replace it with a malicious payload, which will then execute with the service's elevated privileges (often `SYSTEM`) upon the next service restart or system reboot. This direct manipulation of the service binary is a classic and highly effective privilege escalation method.
- ✗
Token impersonation
Why it's wrong here
Token impersonation involves an attacker leveraging an existing access token, typically from a privileged process, to execute commands or access resources with the associated security context. This technique does not involve modifying or replacing service binaries; instead, it exploits the ability to duplicate or steal an active token to elevate privileges within the current session. While a valid privilege escalation method, it operates on in-memory tokens rather than file system permissions on service executables.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.