Windows Privilege Escalation Quiz

Q1. Meterpreter's `getsystem` typically becomes SYSTEM via:

DCSync Named-pipe impersonation / token duplication A kernel 0-day Password spraying

Q2. SeImpersonatePrivilege is most famously abused by which family of exploits to become SYSTEM?

BlueKeep Pass-the-Hash Potato attacks (JuicyPotato/PrintSpoofer/RoguePotato) Kerberoasting

Q3. DLL hijacking (search-order abuse) works when a privileged program:

Loads a DLL by name from a directory the attacker can write to Has ASLR enabled Uses full signed paths for every DLL Runs at low integrity

Q4. Unattended-install artifacts (unattend.xml, sysprep.inf, autounattend.xml) often contain:

Only timezone settings Base64 or cleartext local administrator credentials BitLocker recovery keys only Kerberos tickets

Q5. winPEAS, PowerUp and Seatbelt are used to:

Relay NTLM Automatically enumerate local Windows privilege-escalation vectors Sniff the network Crack NTLM hashes

Q6. A writable startup-folder entry or Run key belonging to a higher-priv user lets an attacker:

Read their email Dump the SAM Reset UAC Execute code in that user's context at their next logon

Q7. PowerShell console history and transcript logs are worth checking because they can leak:

Kerberos keys Only aliases The SAM hive Credentials or secrets typed on the command line

Q8. Dumping LSASS memory (e.g., via comsvcs.dll MiniDump or Task Manager) is done to:

Reset passwords Recover cached credentials/hashes/tickets for lateral movement Crash the machine Read the SAM

Q9. AlwaysInstallElevated allows any user to install an MSI as SYSTEM only when the value is set:

In BOTH HKLM and HKCU In HKCU only In HKLM only In Group Policy comments

Q10. SeDebugPrivilege primarily allows an attacker to:

Edit any registry key Mount shadow copies Open and read other processes' memory, such as dumping LSASS Create services

Q11. Token impersonation (e.g., Incognito) abuses:

A cracked password An available delegation/impersonation token on the host to act as another user A Kerberos TGT on disk A writable service

Q12. A scheduled task that runs as SYSTEM is exploitable for privesc when:

It has a long name It is disabled The script or binary it executes is writable by a low-priv user It runs hourly

Q13. Windows autologon can leak a cleartext password stored where?

In the Winlogon 'DefaultPassword' registry value In the SAM hive In unattend.log In LSASS only

Q14. A directory the attacker can write to that appears EARLY in the system PATH enables:

Disabling Defender Reading LSASS Planting an executable a privileged process launches by name Kernel patching

Q15. A UAC bypass (e.g., fodhelper/eventvwr) is best described as:

Escalating from a different user's account Moving an admin user from medium to high integrity without a consent prompt Cracking the local hash A remote exploit