nerdexam
CompTIA

PT0-001 · Question #72

After successfully capturing administrator credentials to a remote Windows machine, a penetration tester attempts to access the system using PSExec but is denied permission. Which of the following…

The correct answer is C. SERVICES and ADMINS. PSExec requires the ADMIN$ share to deploy its service binary onto the remote host and access to the Windows Service Control Manager to install and start that service.

Post-exploitation and lateral movement

Question

After successfully capturing administrator credentials to a remote Windows machine, a penetration tester attempts to access the system using PSExec but is denied permission. Which of the following shares must be accessible for a successful PSExec connection?

Options

  • AIPCS and C$
  • BC$ and ADMINS
  • CSERVICES and ADMINS
  • DADMINS and IPCS

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    92% (24)

Why each option

PSExec requires the ADMIN$ share to deploy its service binary onto the remote host and access to the Windows Service Control Manager to install and start that service.

AIPCS and C$

IPC$ enables named pipe communication but C$ is merely the root drive share and is not the share PSExec targets for service binary deployment.

BC$ and ADMINS

C$ is the root drive administrative share and is not the deployment target PSExec uses; the tool specifically requires ADMIN$ for writing its service binary.

CSERVICES and ADMINSCorrect

PSExec works by copying its remote agent executable to the ADMIN$ share (which maps to %SystemRoot%) and then communicating with the Windows Service Control Manager to register and start the deployed service. Without ADMIN$ the binary cannot be placed on the target, and without service management access the agent cannot be executed - both components are necessary for the connection to succeed.

DADMINS and IPCS

IPC$ provides the named pipe channel for RPC but the combination of ADMIN$ and IPC$ alone omits the service management component that PSExec relies on to install and start its remote agent.

Concept tested: PSExec required shares for remote service execution

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec

Topics

#PSExec#Windows shares#lateral movement#credential use

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice