nerdexam
CompTIA

PT0-001 · Question #1

A penetration tester has compromised a Windows server and is attempting to achieve persistence. Which of the following would achieve that goal?

The correct answer is D. reg save HKLM\System\CurrentControlSet\Services\Sv.reg. Modifying Windows registry service keys under HKLM\System\CurrentControlSet\Services establishes persistence because registered services start automatically at every system boot.

Post-exploitation and lateral movement

Question

A penetration tester has compromised a Windows server and is attempting to achieve persistence. Which of the following would achieve that goal?

Options

  • Aschtasks.exe /create/tr "powershell.exe" Sv.ps1 /run
  • Bnet session server | dsquery -user | net use c$
  • Cpowershell && set-executionpolicy unrestricted
  • Dreg save HKLM\System\CurrentControlSet\Services\Sv.reg

How the community answered

(55 responses)
  • A
    13% (7)
  • B
    7% (4)
  • C
    4% (2)
  • D
    76% (42)

Why each option

Modifying Windows registry service keys under HKLM\System\CurrentControlSet\Services establishes persistence because registered services start automatically at every system boot.

Aschtasks.exe /create/tr "powershell.exe" Sv.ps1 /run

The schtasks.exe syntax is malformed - it is missing required parameters such as /tn for the task name and /sc for the schedule type, making the command non-functional.

Bnet session server | dsquery -user | net use c$

These commands perform network session enumeration and share mapping for lateral movement, not persistence - they do not create any mechanism that survives a reboot.

Cpowershell && set-executionpolicy unrestricted

Setting the PowerShell execution policy to unrestricted changes script execution behavior for the current session environment but does not create any auto-starting mechanism that persists across reboots.

Dreg save HKLM\System\CurrentControlSet\Services\Sv.regCorrect

Adding or modifying a service entry under HKLM\System\CurrentControlSet\Services achieves persistence because Windows automatically starts all registered services at boot, allowing the attacker to maintain access across reboots. The reg save command exports this registry hive, preserving the malicious service configuration (Sv) in a way that survives system restarts.

Concept tested: Windows registry service-based persistence technique

Source: https://attack.mitre.org/techniques/T1543/003/

Topics

#Windows persistence#registry#schtasks#post-exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice