Privilege Escalation (Windows)

Question 1

Cpassword (Windows Escalation)

Answer 1

• name of attribute storing passwords in Group Policy preference item
• easily decrypted by any authenticated user in the domain

Question 2

Clear Text Credentials LDAP (Windows Escalation)

Answer 2

• if SSL not enabled for LDAP, credentials are sent over the network in clear text

Question 3

Kerberoasting (Windows Escalation)

Answer 3

• any domain user account that has a service principle name SPN set can have a service ticket TGS
• ticket can be requested by any user in the domain and allows for offline cracking of the service account plaintext password

Question 4

Credentials in LSASS (Windows Escalation)

Answer 4

• LSASS Local Security Authority Subsystem Service
• process in windows that enforces the security policy of the system, verifies users when logging onto computer/server, performs password changes, creates access tokens

Question 5

Unattended Installation (Windows Escalation)

Answer 5

• cleartext credentials of Preboot Execution Environment PXE can be captured using network sniffers

Question 6

SAM Database (Windows Escalation)

Answer 6

• Security Account Manager is a databse file that stores user passwords in windows as LM hash or NTLM hash
• passwords can be cracked offline if the SAM file is stolen

Question 7

DLL Hijacking (Windows Escalation)

Answer 7

*DLL provides a mehtod for sharing code and allows a program to upgrade its functionality without requring re linking or re compiling of the application, hijacking used to load malicious DLL in place of accepted DLL

Question 8

Exploitable Services (Windows Escalation)

Answer 8

• attacker uses way a service normally operates to cause unintended program to run

Question 9

Unsecure File and Folder Permissions (Windows Escalation)

Answer 9

• can lead to malicious file installations and DLL hijacking on a non admin user files and folders

Question 10

Keylogger (Windows Escalation)

Answer 10

• surveillance technology used to monitor and record keystrokes of user, software or hardware based

Question 11

Scheduled Tasks (Windows Escalation)

Answer 11

• attacker uses windows task scheduler to create callbacks and retain persistence, arbitrary code can be executed at a certain time or in response to an event