Windows Privilege Escalation

Question 1

You have a low-priv shell. A service runs as LocalSystem and its binary directory is writable by Users. What is the likely privesc?

Answer 1

Service binary replacement/hijack to execute as SYSTEM (with caution).

Question 2

You find an unquoted service path: C:\Program Files\Vuln Service\service.exe. What’s the exploitation concept?

Answer 2

Drop an executable in a higher-precedence path segment (e.g., C:\Program.exe) if writable, then start service.

Question 3

A scheduled task runs a PowerShell script in C:\Scripts\backup.ps1 that you can edit. Next step?

Answer 3

Modify script for benign SYSTEM proof action/shell and wait/trigger task as permitted.

Question 4

You see a service loads a DLL from a directory writable by you. What is this?

Answer 4

DLL hijacking: replace the loaded DLL to execute code as the service account.

Question 5

You’re in Administrators group but whoami /groups shows medium integrity. What does that suggest?

Answer 5

UAC: you’re not fully elevated; need an elevation path or SYSTEM via service/task misconfig.

Question 6

You find cleartext creds in C:\Windows\Panther\Unattend.xml. What should you do?

Answer 6

Use creds to pivot/escalate, then document chain and capture proof.

Question 7

WinRM (5985) is open and you obtained valid creds. What’s the next move?

Answer 7

Use WinRM for stable remote shell (authorized) and then enumerate privesc/AD.

Question 8

You dump a hash but plaintext isn’t available. What OSCP-relevant technique might still work?

Answer 8

Use hash-based auth where applicable (PtH) within allowed tool rules.

Question 9

You identify SeImpersonatePrivilege. Why do you care?

Answer 9

Some privesc techniques exploit impersonation privileges to get SYSTEM.

Question 10

A service has weak registry permissions. How can that lead to privesc?

Answer 10

Modify service parameters (ImagePath) or related settings to execute code as service account.

Question 11

You can write to C:\ProgramData\ but not service directories. What should you hunt?

Answer 11

Other privileged auto-runs: tasks, startup folders, writable scripts/configs referenced by SYSTEM processes.

Question 12

You got SYSTEM but haven’t captured proof.txt screenshot. What’s the immediate priority?

Answer 12

Capture required proof evidence (type proof.txt from original location + screenshot).

Question 13

You suspect AV blocks your payload. What’s an OSCP-safe approach?

Answer 13

Prefer living-off-the-land and minimal custom payloads; document failures and use alternate methods.