PT0-001 · Question #72
After successfully capturing administrator credentials to a remote Windows machine, a penetration tester attempts to access the system using PSExec but is denied permission. Which of the following…
The correct answer is C. SERVICES and ADMINS. PSExec requires the ADMIN$ share to deploy its service binary onto the remote host and access to the Windows Service Control Manager to install and start that service.
Question
After successfully capturing administrator credentials to a remote Windows machine, a penetration tester attempts to access the system using PSExec but is denied permission. Which of the following shares must be accessible for a successful PSExec connection?
Options
- AIPCS and C$
- BC$ and ADMINS
- CSERVICES and ADMINS
- DADMINS and IPCS
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- C92% (24)
Why each option
PSExec requires the ADMIN$ share to deploy its service binary onto the remote host and access to the Windows Service Control Manager to install and start that service.
IPC$ enables named pipe communication but C$ is merely the root drive share and is not the share PSExec targets for service binary deployment.
C$ is the root drive administrative share and is not the deployment target PSExec uses; the tool specifically requires ADMIN$ for writing its service binary.
PSExec works by copying its remote agent executable to the ADMIN$ share (which maps to %SystemRoot%) and then communicating with the Windows Service Control Manager to register and start the deployed service. Without ADMIN$ the binary cannot be placed on the target, and without service management access the agent cannot be executed - both components are necessary for the connection to succeed.
IPC$ provides the named pipe channel for RPC but the combination of ADMIN$ and IPC$ alone omits the service management component that PSExec relies on to install and start its remote agent.
Concept tested: PSExec required shares for remote service execution
Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
Topics
Community Discussion
No community discussion yet for this question.