nerdexam
CompTIA

PT0-002 · Question #595

A penetration tester issued the following command at a command prompt: Which of the following is the best reason the penetration tester ran this command?

The correct answer is B. To possibly utilize an MSI file to escalate privileges. The penetration tester likely ran a command to check for the AlwaysInstallElevated registry key settings, as this configuration allows non-privileged users to install Windows Installer (.msi) packages with elevated system privileges, presenting a common privilege escalation…

Post-exploitation and lateral movement

Question

A penetration tester issued the following command at a command prompt:

Which of the following is the best reason the penetration tester ran this command?

Options

  • ATo check if command prompts will automatically open with an administrator token
  • BTo possibly utilize an MSI file to escalate privileges
  • CTo validate HKLM was installed correctly
  • DTo determine the current bypass setting for PowerShell

How the community answered

(39 responses)
  • A
    13% (5)
  • B
    74% (29)
  • C
    5% (2)
  • D
    8% (3)

Why each option

The penetration tester likely ran a command to check for the AlwaysInstallElevated registry key settings, as this configuration allows non-privileged users to install Windows Installer (.msi) packages with elevated system privileges, presenting a common privilege escalation vector.

ATo check if command prompts will automatically open with an administrator token

Checking if command prompts open with an administrator token is usually done via whoami /priv or observing the prompt, not typically through commands related to MSI files.

BTo possibly utilize an MSI file to escalate privilegesCorrect

The AlwaysInstallElevated registry setting, when enabled in both HKLM and HKCU, allows Windows Installer (.msi) packages to run with SYSTEM privileges, regardless of the user's current privileges. A penetration tester would check this setting to identify a potential privilege escalation vulnerability.

CTo validate HKLM was installed correctly

HKLM (HKEY_LOCAL_MACHINE) is a root registry key; it is not "installed" but is a fundamental part of the Windows registry.

DTo determine the current bypass setting for PowerShell

Determining bypass settings for PowerShell usually involves checking execution policies (Get-ExecutionPolicy) or other PowerShell-specific configurations, not MSI-related commands.

Concept tested: MSI AlwaysInstallElevated privilege escalation

Source: https://learn.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated

Topics

#privilege escalation#MSI files#post-exploitation#Windows vulnerabilities

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-002 Practice