OSCP Windows Privilege Escalation 2 — Questions and Answers
Question 1: What is DLL hijacking in the context of Windows privilege escalation?
- Modifying system DLL files in System32
- Placing a malicious DLL in a directory searched before the legitimate DLL location (Correct answer)
- Injecting shellcode into a running DLL in memory
- Replacing Windows Update DLLs with backdoored versions
Correct answer: Placing a malicious DLL in a directory searched before the legitimate DLL location
DLL hijacking exploits Windows's DLL search order by placing a malicious DLL with the correct name in a directory that is searched before the legitimate DLL's directory.
Question 2: What tool can dump Windows NTLM password hashes from the SAM database when running as SYSTEM?
- Hydra
- Mimikatz (Correct answer)
- Responder
- CrackMapExec
Correct answer: Mimikatz
Mimikatz's 'lsadump::sam' or 'sekurlsa::logonpasswords' commands can extract NTLM hashes and plaintext credentials from the SAM database and LSASS memory when run with SYSTEM privileges.
Question 3: What is the purpose of the 'AlwaysInstallElevated' Windows policy and how is it exploited?
- It allows all users to install updates without admin rights — exploited by creating malicious MSI packages (Correct answer)
- It ensures all services run with SYSTEM privileges
- It bypasses UAC for all signed applications
- It automatically elevates PowerShell sessions
Correct answer: It allows all users to install updates without admin rights — exploited by creating malicious MSI packages
When AlwaysInstallElevated is enabled in both HKCU and HKLM, any user can install MSI packages with SYSTEM privileges, allowing privilege escalation via a crafted malicious MSI file.
Question 4: Which PowerShell command checks whether the current user can modify a specific service's binary?
- Get-Acl -Path 'C:\path\to\service.exe' | Format-List (Correct answer)
- Test-Path -Service 'servicename'
- Get-Service -Name 'name' | Select-Object *
- icacls /check 'C:\path\to\service.exe'
Correct answer: Get-Acl -Path 'C:\path\to\service.exe' | Format-List
Get-Acl retrieves the security descriptor (ACL) of a file, revealing which users have read, write, or modify permissions on the service binary.
Question 5: What does the 'accesschk.exe' tool from Sysinternals help identify during Windows privilege escalation?
- Active network connections and their processes
- Permissions on files, registry keys, services, and other objects (Correct answer)
- All user accounts and their password policies
- Scheduled tasks and their execution history
Correct answer: Permissions on files, registry keys, services, and other objects
Accesschk.exe audits permissions on Windows objects (files, services, registry, kernel objects), making it essential for finding world-writable services, files, or registry keys.
Question 6: What Windows privilege escalation technique abuses the SeImpersonatePrivilege token right?
- Pass-the-Hash
- Juicy Potato / PrintSpoofer token impersonation (Correct answer)
- DLL hijacking via PATH
- UAC bypass via fodhelper
Correct answer: Juicy Potato / PrintSpoofer token impersonation
SeImpersonatePrivilege allows impersonating authentication tokens; tools like Juicy Potato, RoguePotato, and PrintSpoofer exploit this to impersonate the SYSTEM token and gain full privileges.
OSCP Windows Privilege Escalation 2
What is DLL hijacking in the context of Windows privilege escalation?