CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Local exploit in a service

  Why this is correct

  A local exploit in a service directly targets vulnerabilities within a running Windows service, such as the Print Spooler. These services often operate with elevated privileges, like SYSTEM, and a successful exploit can allow an attacker to execute arbitrary code with those higher permissions. This method directly leverages a flaw in the service's code or configuration to escalate privileges from a low-privileged user account. PrintNightmare is a prime example, exploiting a vulnerability in the Print Spooler service to achieve SYSTEM-level access.

• ✗

  DLL hijacking

  Why it's wrong here

  DLL hijacking involves manipulating a legitimate application to load a malicious Dynamic Link Library (DLL) instead of a legitimate one, often by exploiting predictable search paths or insecure application configurations. While it can lead to privilege escalation if the compromised application runs with elevated rights, it is a specific execution technique rather than the direct exploitation of a vulnerability *within* a Windows service itself. The question specifically points to an attacker exploiting a *service*, making this a less direct fit for the initial privilege escalation mechanism.

• ✗

  SUID abuse

  Why it's wrong here

  SUID (Set User ID) is a file permission attribute found exclusively in Unix-like operating systems, such as Linux. When an executable with the SUID bit set is run, it executes with the permissions of the file's owner, regardless of the user who invoked it. Since the question explicitly states the attacker is on a Windows system, SUID abuse is entirely irrelevant and impossible to perform, as Windows uses a fundamentally different security model based on Access Control Lists (ACLs) and tokens.

• ✗

  Token impersonation

  Why it's wrong here

  Token impersonation is a post-exploitation technique where an attacker steals or duplicates an existing access token from a process running with higher privileges, typically SYSTEM or an administrator. This allows the attacker to execute commands or spawn new processes with the stolen token's security context, effectively impersonating the higher-privileged user. However, this method relies on *obtaining* an existing token and does not involve exploiting a vulnerability *within* a Windows service to gain initial elevated access, which is what the question describes.

Go deeper

Related to this question