OSCP Windows Privilege Escalation 3

Question 1

What is a 'scheduled task' privilege escalation in Windows and what must be true for it to work?

Accepted Answer

The task runs under a higher-privileged account and the current user can modify the task's action or its script/binary

Answer

Scheduled task escalation works when a task runs as a privileged user (e.g., SYSTEM) and the current user can overwrite the script or binary that the task executes.

Question 2

What command in Windows lists all scheduled tasks with their run-as users?

Accepted Answer

schtasks /query /fo LIST /v

Answer

The 'schtasks /query /fo LIST /v' command lists all scheduled tasks in verbose list format, showing the task name, run-as user, schedule, and the program being executed.

Question 3

What is User Account Control (UAC) bypass and why is it important during OSCP?

Accepted Answer

Elevating from a medium-integrity admin account to a high-integrity process without triggering UAC prompts

Answer

UAC bypass techniques allow an already-administrative but medium-integrity process to elevate to high integrity without displaying a UAC consent prompt, completing the privilege escalation.

Question 4

Which Windows registry key stores hashed credentials for locally cached domain accounts?

Accepted Answer

HKLM\SECURITY\Cache

Answer

The HKLM\SECURITY\Cache registry key stores NL$Cache entries, which are MS-Cache v2 hashes of domain user credentials cached for offline login.

Question 5

What is the significance of finding 'SeBackupPrivilege' on a Windows account during OSCP?

Accepted Answer

It allows bypassing filesystem ACLs to read any file, including the SAM and SYSTEM hives

Answer

SeBackupPrivilege allows reading any file on the system regardless of ACLs, enabling an attacker to copy the SAM and SYSTEM registry hives and extract all local password hashes offline.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Windows Privilege Escalation 3