OSCP Windows Privilege Escalation 1 — Questions and Answers
Question 1: What Windows command displays all locally stored credentials and cached tokens?
- cmdkey /list (Correct answer)
- net user /all
- whoami /priv
- systeminfo /creds
Correct answer: cmdkey /list
The 'cmdkey /list' command displays all credentials stored in the Windows Credential Manager, which may include domain accounts, RDP credentials, or service account passwords.
Question 2: What does the 'whoami /priv' command reveal that is useful for Windows privilege escalation?
- The current user's password hash
- The user's group memberships and enabled/disabled token privileges (Correct answer)
- All users on the local system
- Currently running services and their permissions
Correct answer: The user's group memberships and enabled/disabled token privileges
The 'whoami /priv' command lists all privilege tokens assigned to the current user, revealing potentially exploitable privileges like SeImpersonatePrivilege or SeDebugPrivilege.
Question 3: Which tool is used during OSCP to enumerate misconfigured Windows services for privilege escalation?
- Mimikatz
- WinPEAS (Correct answer)
- PowerSploit
- BloodHound
Correct answer: WinPEAS
WinPEAS (Windows Privilege Escalation Awesome Script) automatically enumerates potential privilege escalation vectors including misconfigured services, DLL hijacking paths, and unquoted service paths.
Question 4: What is an 'unquoted service path' vulnerability in Windows?
- A service with its binary path not enclosed in quotes, allowing path hijacking if the path contains spaces (Correct answer)
- A service running without any authentication
- A service that does not encrypt its network communications
- A service with a default password that is not changed
Correct answer: A service with its binary path not enclosed in quotes, allowing path hijacking if the path contains spaces
When a Windows service's binary path contains spaces and is not enclosed in quotes, Windows tries multiple path interpretations, allowing an attacker to place a malicious executable in an intermediate path.
Question 5: What Windows command lists all services and their start types, useful for identifying auto-start services to target?
- sc query type= all
- net start /all
- tasklist /svc
- wmic service list brief (Correct answer)
Correct answer: wmic service list brief
The 'wmic service list brief' command provides a concise list of all Windows services including their name, process ID, start mode, and status.
Question 6: Which registry hive contains Windows auto-run entries that execute programs at system startup, useful for persistence?
- HKEY_USERS\Default\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Correct answer)
- HKEY_CURRENT_CONFIG\System\Run
- HKEY_CLASSES_ROOT\CLSID\Run
Correct answer: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key contains entries that execute programs at system startup for all users, making it a common persistence and privilege escalation target.
OSCP Windows Privilege Escalation 1
What Windows command displays all locally stored credentials and cached tokens?