CCNA Escalation and Exploitation Questions

Group Policy Preferences stored credentials in cpassword fields encrypted with a static AES key that Microsoft published in MS14-025 documentation. Tools such as gpp-decrypt recover the plaintext instantly, and the recovered credential often belongs to a privileged account. Because the key is fixed and public, no cracking is required, making decryption the direct and effective escalation step.

xp_cmdshell is a powerful stored procedure in Microsoft SQL Server that spawns a Windows command shell and passes in a command string for execution. It is the primary target for testers attempting to escalate from SQL injection to remote code execution on the underlying database server host.

Using a benign DLL that launches a non-critical application or writes to a log file is the safest way to demonstrate the vulnerability. It proves code execution with SYSTEM privileges without causing service instability or creating a persistent backdoor that could be misused if detected by third parties.

Kernel exploits manipulate memory structures at a very low level. Small errors in memory alignment or incorrect assumptions about the OS state lead to immediate kernel panics or crashes. This downtime is a major business impact, making kernel exploits the highest-risk category of penetration testing activities.

Since the script is world-writable (777), you can edit it to execute arbitrary commands. The cron job runs as root every minute, so your modified script will execute with root privileges. Adding a reverse shell or copying /bin/bash with SUID will grant you root access. This is a direct and reliable escalation because you control the script's content and it runs as root without any additional checks.

SeImpersonatePrivilege lets a process impersonate a token handed to it by a client, and tools like PrintSpoofer or the Potato family coerce a SYSTEM-privileged service into authenticating so the token can be captured and reused. On Server 2019 the classic JuicyPotato CLSID path is patched, so PrintSpoofer or RoguePotato is the working variant here.

AccessChk allows efficient command-line auditing of DACLs on files, directories, and services. Identifying weak permissions where standard users hold write or modify rights on service binaries enables successful replacement of legitimate executables with malicious payloads.

A world-writable script executed by a root cron job is a classic privilege escalation vector. Since any user can modify the script, you can inject commands that will run as root when the cron job executes. This directly leads to privilege escalation. Defenders should ensure that scripts executed by privileged cron jobs are not writable by unprivileged users. This scenario is highly likely to allow escalation.

By prepending a user-controlled directory to the PATH variable, the system searches the attacker's directory first. If the binary calls 'date' and the attacker has placed a malicious file named 'date' in their directory, the system executes the malicious file with the privileges of the SUID binary.

A service unit that executes a script from a world-writable directory lets any local user replace that script with arbitrary code. Because the service runs as root under systemd, the replacement executes with root privileges on the next service start or restart. This is a direct and reliable escalation path from a standard user to root on the host.

Because the cron job executes the script as root every minute and the file is writable by www-data, modifying its contents means your injected commands run with root privileges at the next scheduled interval. Appending a reverse shell payload is a direct, reliable escalation path that requires no exploit or kernel vulnerability.

The core objective of exploitation is to turn a vulnerability into an active exploit, gaining unauthorized access or executing code. This validates the risk assessment and demonstrates the impact of the identified security flaws in a controlled, safe manner that is consistent with the test's scope.

Because the SUID binary invokes system() with a relative command name, the shell resolves cat using the inherited PATH. If you place a malicious cat earlier in PATH, it executes with the binary's effective root privileges. This is the classic PATH hijacking escalation for SUID programs that call commands without absolute paths.

Pass-the-hash exploits the fact that NTLM authentication accepts the hash itself as proof of identity, so the plaintext password is unnecessary. Tools such as Impacket's psexec or wmiexec accept an LM:NT hash pair and establish an authenticated session. Because the local administrator credential is reused, this yields access to many workstations without cracking the hash.

This module enumerates installed hotfixes on the target by querying the registry and WMI, then correlates them against the Microsoft vulnerability database to highlight missing patches. It runs safely without modifying the system, making it ideal for identifying kernel or component escalation candidates before attempting any exploit inside a production Windows Server 2016 engagement.

The 'exploit/windows/local' category contains local privilege escalation exploits for Windows, including kernel driver vulnerabilities. These modules are designed to run within an existing session to elevate privileges. By searching this category, you can find exploits that match the target's architecture and patch level. This is the correct place to look for kernel-based escalation modules in Metasploit.

Backup Operators hold SeBackupPrivilege and SeRestorePrivilege, which bypass file ACLs. By copying the SAM and SYSTEM hives with a tool that honors the backup privilege, then parsing them offline, you can recover local account hashes including the administrator's, then authenticate or pass the hash to escalate without writing custom exploits to disk.