PEN-200 Windows Privilege Escalation Practice Question
You have a low-privileged shell on a Windows Server 2016 host and run `whoami /priv`. The output shows `SeImpersonatePrivilege` enabled. You also notice that the `Print Spooler` service is running. Which technique would most directly allow you to escalate to NT AUTHORITY\SYSTEM?
⚠ Common exam trap
The trap here is assuming that any privilege escalation requires a service misconfiguration or weak file permissions, overlooking that `SeImpersonatePrivilege` alone can be abused via token coercion techniques like `PrintSpoofer`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the `PrintSpoofer` tool to coerce the Print Spooler service into authenticating to a named pipe under your control, then impersonate the SYSTEM token.
When `SeImpersonatePrivilege` is enabled and the Print Spooler service is running, coercing a SYSTEM authentication to a controlled named pipe allows token impersonation. `PrintSpoofer` automates this by triggering the spooler to connect to a malicious pipe, then impersonating the resulting token. This yields a direct SYSTEM shell without needing additional misconfigurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exploit an unquoted service path in the Print Spooler service binary path to plant a malicious executable.
Why it's wrong here
The Print Spooler service binary path is typically quoted and resides in a protected directory. Unquoted service path vulnerabilities require a specific misconfiguration in the service path, which is not indicated here. The presence of `SeImpersonatePrivilege` and a running spooler strongly suggests a token impersonation attack instead.
- ✗
Use `RottenPotato` to relay NTLM authentication from the spooler to an attacker-controlled SMB server and capture the SYSTEM token.
Why it's wrong here
`RottenPotato` is an older technique that relies on the Windows Token Broker and may not work on Server 2016. `PrintSpoofer` is specifically designed for modern Windows versions and directly exploits the Print Spooler's named pipe impersonation. The scenario does not mention an SMB relay setup, making `RottenPotato` less appropriate.
- ✓
Use the `PrintSpoofer` tool to coerce the Print Spooler service into authenticating to a named pipe under your control, then impersonate the SYSTEM token.
Why this is correct
`PrintSpoofer` leverages the Print Spooler service to force a SYSTEM-level authentication to a named pipe you create. With `SeImpersonatePrivilege`, you can capture and impersonate that token, gaining SYSTEM. This is a direct and reliable escalation when the spooler is running and your account holds the privilege.
- ✗
Abuse the `SeBackupPrivilege` to copy the SAM and SYSTEM registry hives, then extract local password hashes offline.
Why it's wrong here
`SeBackupPrivilege` is not listed in the scenario; only `SeImpersonatePrivilege` is enabled. Even if it were, copying hives yields hashes that must be cracked or passed, which is not a direct escalation to SYSTEM in this context. The spooler and impersonation privilege point to a different technique.
About these practice questions
This PEN-200 question is part of Courseiva's 285-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.