OSCP Windows Privilege Escalation

Question 1

What Windows command displays all locally stored credentials and cached tokens?

Accepted Answer

cmdkey /list

Answer

The 'cmdkey /list' command displays all credentials stored in the Windows Credential Manager, which may include domain accounts, RDP credentials, or service account passwords.

Question 2

What does the 'whoami /priv' command reveal that is useful for Windows privilege escalation?

Accepted Answer

The user's group memberships and enabled/disabled token privileges

Answer

The 'whoami /priv' command lists all privilege tokens assigned to the current user, revealing potentially exploitable privileges like SeImpersonatePrivilege or SeDebugPrivilege.

Question 3

Which tool is used during OSCP to enumerate misconfigured Windows services for privilege escalation?

Accepted Answer

WinPEAS

Answer

WinPEAS (Windows Privilege Escalation Awesome Script) automatically enumerates potential privilege escalation vectors including misconfigured services, DLL hijacking paths, and unquoted service paths.

Question 4

What is an 'unquoted service path' vulnerability in Windows?

Accepted Answer

A service with its binary path not enclosed in quotes, allowing path hijacking if the path contains spaces

Answer

When a Windows service's binary path contains spaces and is not enclosed in quotes, Windows tries multiple path interpretations, allowing an attacker to place a malicious executable in an intermediate path.

Question 5

What Windows command lists all services and their start types, useful for identifying auto-start services to target?

Accepted Answer

wmic service list brief

Answer

The 'wmic service list brief' command provides a concise list of all Windows services including their name, process ID, start mode, and status.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Windows Privilege Escalation