CEH Enumeration and System Hacking Practice Question
An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?
⚠ Common exam trap
EC-Council often tests the distinction between Windows token impersonation attacks (SeImpersonatePrivilege) and Linux SUID abuse, leading candidates to mistakenly select SUID abuse when the question explicitly mentions a Windows system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Token impersonation using RottenPotato
The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Token impersonation using RottenPotato
Why this is correct
Token impersonation using RottenPotato is a highly effective local privilege escalation technique on Windows systems. It exploits the `SeImpersonatePrivilege`, often held by services like IIS or SQL Server, by leveraging NTLM relay attacks against local COM/DCOM services. This allows an attacker to trick a privileged process, typically running as `NT AUTHORITY\SYSTEM`, into authenticating to a malicious listener, enabling the attacker to impersonate the resulting SYSTEM token and gain full administrative control.
- ✗
Pass-the-hash attack
Why it's wrong here
Pass-the-hash (PtH) is an attack technique where an attacker authenticates to a remote system using a user's NTLM password hash instead of the plaintext password. This method is primarily used for lateral movement within a network, allowing an attacker to access other machines or services without knowing the actual password. It does not directly elevate privileges on the *local* system where the hash was initially obtained, making it unsuitable for initial privilege escalation on the compromised host.
- ✗
Kerberoasting
Why it's wrong here
Kerberoasting is an attack targeting Active Directory service accounts by requesting Kerberos Ticket Granting Service (TGS) tickets for Service Principal Names (SPNs). These tickets, encrypted with the service account's NTLM hash, can be extracted and cracked offline to reveal the plaintext password. This technique is used for lateral movement or domain privilege escalation by gaining credentials for other services, not for local privilege escalation on an initially compromised Windows workstation.
- ✗
SUID abuse
Why it's wrong here
SUID (Set User ID) is a special permission bit found exclusively in Unix-like operating systems, such as Linux. When set on an executable file, it allows the program to run with the privileges of the file's owner, regardless of who executes it. This concept is entirely foreign to the Windows operating system architecture, which uses a different security model based on access tokens and privileges, rendering SUID abuse irrelevant for Windows privilege escalation.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.