PEN-200 Windows Privilege Escalation Practice Question
An attacker gains a low-privilege shell on a Windows 10 machine and discovers a third-party service named 'DataSync'. The attacker notes that the service runs as SYSTEM and they have 'FILE_WRITE_DATA' permissions on the service executable 'C:\Program Files\DataSync\sync.exe'. Which action is the most direct method to escalate privileges to SYSTEM?
⚠ Common exam trap
Candidates often confuse binary hijacking with DLL hijacking or unquoted service paths. They might look for missing quotes or library search orders instead of checking direct file permissions on the primary executable itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stop the service, replace 'sync.exe' with a malicious payload, and restart the service.
Service binary hijacking is a powerful technique where an attacker replaces a legitimate executable with a malicious one. Since the service runs as SYSTEM, the replaced binary will execute with those high privileges upon the next service start. This method is often more reliable than DLL hijacking because it directly controls the primary execution flow of the service, provided the attacker can restart the service or wait for a system reboot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place a malicious DLL named 'sync.dll' in the 'C:\Windows\System32' directory to intercept calls.
Why it's wrong here
Placing a DLL in System32 typically requires administrative privileges, which the attacker does not yet possess. Furthermore, there is no evidence that the service specifically looks for a DLL with that name in the system directory, making this approach highly unlikely to succeed in a standard escalation scenario.
- ✓
Stop the service, replace 'sync.exe' with a malicious payload, and restart the service.
Why this is correct
This is the most direct path to escalation when 'FILE_WRITE_DATA' is available. By replacing the service binary, the attacker ensures their code runs with the service's privileges. If the attacker has the rights to stop and start the service, they can trigger the payload execution immediately without needing a full system reboot.
- ✗
Modify the service configuration using 'sc config' to point to a different malicious executable.
Why it's wrong here
Using 'sc config' to change the binary path requires 'SERVICE_CHANGE_CONFIG' permissions on the service object itself. The scenario only specifies file system permissions on the executable file, not administrative rights over the service control manager configuration, so this command would likely fail with an access denied error message.
- ✗
Create a new service with the same name in the 'HKCU' registry hive to override the system service.
Why it's wrong here
Services are defined in the 'HKLM' hive, and a low-privilege user cannot override a SYSTEM service by creating entries in 'HKCU'. Windows service resolution does not look at the current user's registry hive for service definitions, so this action would have no impact on the running 'DataSync' service.
Visual reference
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.