During a penetration test, a tester has a low-privileged Windows account. Which technique would MOST likely allow privilege escalation to SYSTEM?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you can escalate to SYSTEM by replacing the executable of a Windows service that runs as SYSTEM and has a writable binary path or weak ACL. When that service restarts, your payload runs with SYSTEM privileges.
Full Explanation
The correct technique is exploiting a misconfigured service with a writable binary path or weak ACL to replace the service executable with a malicious payload. Windows services often run as SYSTEM, and if a low-privileged account can modify the service binary or its path, the attacker can substitute a payload that executes when the service restarts, resulting in local privilege escalation to SYSTEM. Kerberoasting against Active Directory service accounts with SPNs is wrong because it obtains password hashes for offline cracking to access other service accounts, not necessarily SYSTEM on the local machine. Pass-the-hash to authenticate to a remote system with a captured hash is wrong because it targets remote systems for lateral movement, not local privilege escalation. SQL injection on the organization's public web application is wrong because it addresses a different attack surface entirely.