During an assessment, a penetration tester runs the following command: dnscmd.exe /config /serverlevelplugindll C:\users\necad- TA\Documents\adduser.dll Which of the following is the penetration…

The correct answer is B. Privilege escalation. The tester is attempting to register a malicious DLL as a server-level plugin to escalate privileges. Privilege escalation: The command uses dnscmd.exe, a legitimate Windows tool for managing DNS servers. By setting a malicious DLL (adduser.dll) as a server-level plugin…

Submitted by layla.eg· Mar 6, 2026Post-exploitation and Lateral Movement

Question

During an assessment, a penetration tester runs the following command:

dnscmd.exe /config /serverlevelplugindll C:\users\necad- TA\Documents\adduser.dll Which of the following is the penetration tester trying to achieve?

Options

ADNS enumeration
BPrivilege escalation
CCommand injection
DA list of available users

How the community answered

(35 responses)

A
3% (1)
B
80% (28)
C
6% (2)
D
11% (4)

Explanation

The tester is attempting to register a malicious DLL as a server-level plugin to escalate privileges. Privilege escalation: The command uses dnscmd.exe, a legitimate Windows tool for managing DNS servers. By setting a malicious DLL (adduser.dll) as a server-level plugin, attackers can gain SYSTEM-level This technique is a DLL hijacking attack.

Topics

#privilege escalation#DLL injection#Windows commands

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice