Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp's lobby. He checks his current SID, which is S-1-5-21-1223352397-1872883824- 861252104-501. What needs to happen before Matthew has full administrator access?

Question

Accepted Answer

B. He must perform privilege escalation. In Windows, the final component of a SID is the Relative Identifier (RID). RID 500 is the built-in Administrator account and RID 501 is the built-in Guest account, which has severely limited privileges by default. Since Matthew's SID ends in 501, he is operating as a Guest - a low-privilege account - and must perform privilege escalation to gain Administrator or SYSTEM-level access needed for full control of the machine.

Answer

A. He needs to gain physical access. Matthew already has remote code execution via the Meterpreter session, so physical access is not a prerequisite and would not by itself grant higher operating system privileges.

Answer

C. He already has admin privileges, as shown by the "501" at the end of the SID. RID 501 specifically identifies the Guest account, not an administrator - the built-in Administrator account carries RID 500, making this statement factually incorrect.

Answer

D. He needs to disable antivirus protection. Disabling antivirus may help avoid detection but is not a required prerequisite to privilege escalation and does not itself grant elevated access rights.

Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp's lobby. He checks his current SID, which is S-1-5-21-1223352397-1872883824- 861252104-501. Wh

Question

Options

How the community answered

Why each option

Topics

Community Discussion