PEN-200 Windows Privilege Escalation Practice Question
You have obtained a low-privileged shell on a Windows Server 2016 machine. While enumerating, you notice that the 'SeImpersonatePrivilege' is enabled for your user account. You also find that the machine is running a service with a named pipe '\\.\pipe\svcctl' that is accessible. Which tool is specifically designed to exploit this privilege to escalate to SYSTEM?
⚠ Common exam trap
A common mix-up: candidates confuse enumeration tools like WinPEAS or PowerUp with exploitation tools that actually leverage SeImpersonatePrivilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
JuicyPotato
JuicyPotato is designed to exploit SeImpersonatePrivilege by coercing a privileged process to authenticate to a malicious named pipe, then impersonating its token. This allows escalation to SYSTEM. PowerUp and WinPEAS are enumeration tools, and Mimikatz is for credential dumping, not privilege escalation via token impersonation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WinPEAS
Why it's wrong here
WinPEAS is an enumeration script that searches for privilege escalation vectors, including checking for SeImpersonatePrivilege. However, it does not exploit the privilege; it only reports it. To actually escalate, you need a tool like JuicyPotato that performs token impersonation.
- ✓
JuicyPotato
Why this is correct
JuicyPotato exploits SeImpersonatePrivilege by tricking a privileged process into connecting to a malicious named pipe, then impersonating its token. It is specifically designed for Windows systems where SeImpersonate is enabled. The tool leverages COM object hijacking and is effective on many Windows versions, including Server 2016. It directly addresses the scenario.
- ✗
PowerUp
Why it's wrong here
PowerUp is a PowerShell script for enumerating common Windows privilege escalation vectors, such as unquoted service paths and weak service permissions. It does not exploit SeImpersonatePrivilege directly; it only identifies potential misconfigurations. While useful for enumeration, it would not escalate privileges in this scenario.
- ✗
Mimikatz
Why it's wrong here
Mimikatz is a credential dumping tool that extracts plaintext passwords, hashes, and Kerberos tickets from memory. It does not exploit SeImpersonatePrivilege to escalate privileges. While it can be used after escalation, it is not the tool to leverage this specific privilege for SYSTEM access.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.