PEN-200 Windows Privilege Escalation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Leverage the setting to bypass UAC and run any executable as an administrator without an MSI package.

  Why it's wrong here

  AlwaysInstallElevated does not bypass UAC for arbitrary executables; it only elevates MSI installations. UAC bypass techniques are separate and typically involve other mechanisms. This setting cannot be used to directly run a standalone executable with elevated privileges.

• ✓

  Create a malicious MSI package and execute it with `msiexec /quiet /qn /i malicious.msi` to run with SYSTEM privileges.

  Why this is correct

  When AlwaysInstallElevated is enabled in both HKLM and HKCU, any MSI package installed by the user runs with elevated (SYSTEM) privileges. You can generate a malicious MSI that executes a command, for example adding a user to the Administrators group, and then install it using `msiexec` with quiet flags to avoid user interaction.

• ✗

  Use `reg add` to modify the service binary path of a running service to point to a malicious executable.

  Why it's wrong here

  Modifying service binary paths requires administrative privileges or write access to the service configuration, neither of which is granted by AlwaysInstallElevated. This setting specifically affects MSI installation behavior, not service configurations, so this approach is unrelated and would likely fail.

• ✗

  Extract the MSI to a writable directory and replace a DLL to achieve privilege escalation.

  Why it's wrong here

  While MSI packages can contain DLLs, the AlwaysInstallElevated setting does not inherently involve DLL hijacking. The direct exploitation is to run a malicious MSI, not to extract and replace files. This method adds unnecessary complexity and does not leverage the setting as intended.