During a penetration test, a tester has a low-privileged Windows account. Which technique would MOST likely allow privilege escalation to SYSTEM?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because Windows services running as SYSTEM with weak ACLs on their binary paths allow a low-privileged attacker to replace the executable. When the service restarts, the payload runs as SYSTEM, achieving local privilege escalation.
Full explanation below image
Full Explanation
A is correct because Windows services running as SYSTEM with weak ACLs on their binary paths allow a low-privileged attacker to replace the executable. When the service restarts, the payload runs as SYSTEM, achieving local privilege escalation. B is wrong because Kerberoasting obtains password hashes for offline cracking to access other service accounts, not necessarily SYSTEM on the local machine. C is wrong because pass-the-hash targets remote systems for lateral movement, not local privilege escalation. D is wrong because SQL injection on a web application addresses a different attack surface entirely.