OSCP Windows Privilege Escalation

Question 1

What Windows command displays all locally stored credentials and cached tokens?

Accepted Answer

cmdkey /list

Answer

net user /all

Answer

whoami /priv

Answer

systeminfo /creds

Question 2

What does the 'whoami /priv' command reveal that is useful for Windows privilege escalation?

Accepted Answer

The user's group memberships and enabled/disabled token privileges

Answer

The current user's password hash

Answer

All users on the local system

Answer

Currently running services and their permissions

Question 3

Which tool is used during OSCP to enumerate misconfigured Windows services for privilege escalation?

Accepted Answer

WinPEAS

Answer

Mimikatz

Answer

PowerSploit

Answer

BloodHound

Question 4

What is an 'unquoted service path' vulnerability in Windows?

Accepted Answer

A service with its binary path not enclosed in quotes, allowing path hijacking if the path contains spaces

Answer

A service running without any authentication

Answer

A service that does not encrypt its network communications

Answer

A service with a default password that is not changed

Question 5

What Windows command lists all services and their start types, useful for identifying auto-start services to target?

Accepted Answer

wmic service list brief

Answer

sc query type= all

Answer

net start /all

Answer

tasklist /svc

Question 6

Which registry hive contains Windows auto-run entries that execute programs at system startup, useful for persistence?

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_USERS\Default\Run

Answer

HKEY_CURRENT_CONFIG\System\Run

Answer

HKEY_CLASSES_ROOT\CLSID\Run