PEN-200 Public Exploits Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Upload the DLL to C:\Windows\Temp on the target using an existing low-privilege session.

  Why it's wrong here

  Placing the DLL in C:\Windows\Temp does not satisfy the exploit because the Spooler service loads the library from the attacker-specified UNC path, not a local path. The PoC's AddPrinterDriverEx call references a remote share. Uploading locally would only work with a different exploitation technique that the described PoC does not implement.

• ✗

  Start a Metasploit handler on port 445 to catch the reverse shell from the Spooler service.

  Why it's wrong here

  Port 445 is SMB and cannot serve as a generic reverse-shell listener. The exploit's payload is a DLL executed by the Spooler, which initiates its own callback based on the DLL's logic. Starting a handler on 445 would conflict with SMB services and does not align with how the PrintNightmare PoC delivers its payload.

• ✓

  Configure a Samba share on your Kali machine with anonymous read access that hosts the malicious DLL.

  Why this is correct

  The PrintNightmare PoC relies on the target loading a DLL from a UNC path over SMB. You must host the DLL on an accessible SMB share (e.g., via impacket-smbserver or Samba) with anonymous read so the target's Spooler service can fetch and load it. Without this share, the exploit has no payload delivery mechanism.

• ✗

  Disable Windows Defender Real-Time Protection on the target through a registry remoting call.

  Why it's wrong here

  Disabling Defender is neither required nor possible with the described PoC without prior administrative access. The exploit achieves privilege escalation by abusing the Spooler's driver installation, not by evading Defender first. Attempting registry remoting from an unprivileged context would fail and is not a prerequisite step for this attack.