Windows Privilege Escalation OSCP Quiz

1. Which Mimikatz module is used to extract plaintext passwords from memory?

Sekurlsa::logonpasswords

Crypto::certificates

Vault::list

Token::list

2. What is the primary purpose of post-exploitation enumeration after gaining initial access?

Identify vectors for privilege escalation to SYSTEM

Delete log files

Disable all security features

Encrypt user data

3. Which vulnerability allows privilege escalation through incorrect file permissions on system executables?

Weak NTFS permissions

Registry key permissions

Service permission misconfiguration

UAC bypass

4. What is the significance of the 'Administrators' group in Windows?

Members have full system control and SYSTEM privileges

Members can only read files

Members can modify network settings only

Members have guest-level access

5. Which tool is commonly used to identify misconfigurations in Windows systems?

Nmap

Metasploit

PowerUp.ps1

Wireshark

6. What information does the 'whoami /all' command reveal?

Current user, groups, and available privileges

System network configuration

Running processes and services

Installed applications

7. Which vulnerability allows code execution through DLL loading from insecure paths?

DLL hijacking

Buffer overflow

SQL injection

Cross-site scripting

8. What is the primary goal of enumerating Windows groups and group policies?

Identify permission assignments and escalation paths

Disable antivirus software

Steal encryption keys

Modify network settings

9. Which Windows feature allows elevation of privilege through auto-elevation?

Windows Defender

Built-in administrator tasks

Task Scheduler

Print Spooler service

10. What does UAC (User Account Control) primarily protect against?

Unauthorized privilege escalation without user consent

Network-based attacks

Malware signature detection

Brute-force login attempts

11. Which Windows service runs with SYSTEM privileges and is commonly targeted for privilege escalation?

Windows Update (WUpdate)

Task Scheduler

Print Spooler

Windows Defender

12. What vulnerability exists when a service has weak file permissions on its executable?

The executable can be replaced with malicious code

The service configuration can be read

The service port becomes exposed

The registry key becomes writable

13. Which technique involves leveraging a higher-privileged process to execute arbitrary code?

Token impersonation

Process injection

DLL hijacking

Registry manipulation

14. What is a common vulnerability in custom Windows services?

Running with unnecessary SYSTEM privileges

Using weak encryption

Storing passwords in environment variables

Allowing remote connections

15. Which Windows feature allows scheduled tasks to run with elevated privileges?

Windows Services

Task Scheduler

Group Policy

Event Viewer

16. What does the 'SeDebugPrivilege' token allow an attacker to do?

Debug and inject code into any running process

Access encrypted files

Modify firewall rules

Change system time

17. Which registry hive contains stored credentials and cached login information?

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_PERFORMANCE_DATA

18. What is the primary vulnerability in unquoted service paths?

Allows DLL injection attacks

Allows arbitrary executable execution due to space in path

Exposes plaintext credentials

Enables registry modification

19. Which tool is commonly used to enumerate Windows privileges and token information?

Mimikatz

WinPEAS

BloodHound

Responder

20. What does the 'SeImpersonatePrivilege' token permission allow a user to do?

Impersonate other user tokens to gain their privileges

Read protected registry keys

Install unsigned drivers

Bypass UAC prompts

OSCP Windows Privilege Escalation Quiz

1. Which Mimikatz module is used to extract plaintext passwords from memory?

2.

What first name or nickname would you like us to use?

2. What is the primary purpose of post-exploitation enumeration after gaining initial access?

3. Which vulnerability allows privilege escalation through incorrect file permissions on system executables?

4. What is the significance of the 'Administrators' group in Windows?

5. Which tool is commonly used to identify misconfigurations in Windows systems?

6. What information does the 'whoami /all' command reveal?

7. Which vulnerability allows code execution through DLL loading from insecure paths?

8. What is the primary goal of enumerating Windows groups and group policies?

9. Which Windows feature allows elevation of privilege through auto-elevation?

10. What does UAC (User Account Control) primarily protect against?

11. Which Windows service runs with SYSTEM privileges and is commonly targeted for privilege escalation?

12. What vulnerability exists when a service has weak file permissions on its executable?

13. Which technique involves leveraging a higher-privileged process to execute arbitrary code?

14. What is a common vulnerability in custom Windows services?

15. Which Windows feature allows scheduled tasks to run with elevated privileges?

16. What does the 'SeDebugPrivilege' token allow an attacker to do?

17. Which registry hive contains stored credentials and cached login information?

18. What is the primary vulnerability in unquoted service paths?

19. Which tool is commonly used to enumerate Windows privileges and token information?

20. What does the 'SeImpersonatePrivilege' token permission allow a user to do?