CEH Enumeration and System Hacking Practice Question
During a penetration test, you discover a Windows service running with SYSTEM privileges that has a weak file permission allowing the 'Everyone' group to modify its executable. Which privilege escalation technique is MOST directly applicable here?
⚠ Common exam trap
EC-Council often tests the distinction between modifying the service binary itself (weak binary permissions) versus exploiting path parsing (unquoted service path) or dependency loading (DLL hijacking), so candidates must focus on the specific permission weakness described.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Weak service binary permissions
The scenario describes a Windows service executable with weak file permissions that allow the 'Everyone' group to modify it. This directly enables an attacker to replace the legitimate executable with a malicious one, which will then be executed with SYSTEM privileges when the service starts. This is the classic 'weak service binary permissions' privilege escalation vector, often exploited using tools like `icacls` or `accesschk` to identify the vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Token impersonation
Why it's wrong here
Token impersonation is a post-exploitation technique where an attacker leverages an existing security token from a higher-privileged process or user session to perform actions with those elevated privileges. This method typically involves stealing or duplicating an active token, often through named pipes or specific API calls, rather than modifying file system permissions or replacing service binaries. Therefore, it is distinct from vulnerabilities related to weak file permissions on service executables.
- ✓
Weak service binary permissions
Why this is correct
Weak service binary permissions represent a critical privilege escalation vulnerability where an attacker possesses write access to the executable file of a Windows service. By replacing the legitimate service binary with a malicious payload, such as a reverse shell or a user-creation script, the attacker can achieve elevated privileges. When the compromised service is subsequently started or restarted by the operating system, it will execute the attacker's code, typically under the SYSTEM account, granting full control over the machine.
- ✗
DLL hijacking
Why it's wrong here
DLL hijacking exploits how Windows services and applications load dynamic-link libraries. If a service attempts to load a DLL that is missing from its expected search paths, an attacker can place a malicious DLL with the same name in a directory that is searched earlier, such as the application's current working directory. When the service next starts, it loads and executes the attacker's malicious DLL, often with the service's elevated privileges, which is fundamentally different from directly replacing the primary service executable.
- ✗
Unquoted service path
Why it's wrong here
An unquoted service path vulnerability arises when a Windows service's executable path contains spaces and is not enclosed within quotation marks in its registry entry. When the Service Control Manager attempts to execute such a service, it parses the path segment by segment, looking for an executable at each space. For instance, "C:\Program Files\My Service\service.exe" could lead to attempts to execute "C:\Program.exe" or "C:\Program Files\My.exe". An attacker can exploit this by placing a malicious executable at one of these intermediate, higher-priority paths, which is a path parsing flaw, not a direct file permission issue on the ultimate service binary.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.