Successful Privilege Escalation From a Local User to System

Answer Correct answer: A — The history shows whoami returning domain\localuser, then psexec.exe -s cmd, then nt authority\system, proving a successful local privilege escalation.

A security analyst is reviewing the following system command history on a computer that was recently utilized in a larger attack on the corporate infrastructure: Which of the following best describes what the analyst has discovered? -

A successful privilege escalation attack by a local user Correct Answer
A user determining what level of permissions the user has
A systems administrator performing routine maintenance
An attempt to utilize living-off-the-land binaries

privilege escalation attack psexec system account whoami command history living off the land binaries

Community Votes

83%

17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The closing whoami is the decisive evidence, because it changes from domain\localuser to nt authority\system and therefore shows the escalation completed rather than merely being attempted. A legitimate signed tool was abused to do it, but the finding is the privilege gain, not the tool.

The command history begins with whoami returning domain\localuser, then runs psexec.exe -s cmd to spawn a session in the local System context, and finally repeats whoami to show nt authority\system. That sequence proves the local user successfully escalated from an ordinary domain account to the highest local privilege.

Picking the living-off-the-land option because PsExec is a legitimate Sysinternals binary. The question asks what the analyst discovered, and the decisive event is the successful elevation to the System account rather than the reuse of a tool already present on the host.

Community Discussion (8 comments)

johnabayot 👍 6 Selected: A

These commands indicate that the user was trying to find ways to elevate their privileges using the same account or another account with higher privileges.

mrface33 👍 1

While they did leverage a tool that already existed on the system, the fact that they showed they elevated their privilege at the end there implies it's A. Privilege escalation

Jking1989 👍 1 Selected: A

not an attempt, he was succesful

TM78 👍 3 Selected: A

I believe this is a privilege escalation attempt. It looks like the attacker began as domain\local user but then escalated to nt authority\sytem. Nt authority\system is a local machine’s built-in service accounts which runs everything from the log-in screen to most of the high-privilege background services. In my research, I read that these accounts should be whitelisted to a degree that no one can install malicious services on them.

Payu1994 👍 1

A it is.

johnabayot 👍 2

D. An attempt to Utilize living-off-the-land binaries. Living-off-the-land binaries (LOLBins) are legitimate tools that are already present on the system, such as Powershell, WMIC, or Certutil, that can be exploited by attackers to perform malicious activities. In this case, the attacker used the Certutil tool to download and decode a malicious file from a remote server, and then executed it using Powershell. This technique can help the attacker bypass detection and deliver malware without relying on specific code or files.

Yomzie 👍 1

To throw in more light, PsExec is a lightweight command-line tool for executing processes on remote systems. It can be used by attackers to run malicious processes on compromised systems. Other examples of these dual-use tools which have been used for “living off the land” attacks are, Windows Sysinternals, NETSH, or SC tools.

Hs1208 👍 2 Selected: D

The provided command history indicates an attempt to utilize living-off-the-land binaries (LOLBins). Living-off-the-land binaries are legitimate, built-in system tools or binaries that attackers abuse for malicious purposes. In this case, the command history shows the use of common system tools like "whoami," "net," and "tasklist" to gather information or execute commands.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The transcript opens with whoami returning domain\localuser, establishing that the session started as an ordinary domain account, and closes with whoami returning nt authority\system after psexec.exe -s cmd ran. The System account is the local machine's highest-privilege context, so the second whoami proves the operator reached a privilege level the starting account did not hold. Because the escalation completed rather than merely being attempted, and because the operator was a local user, the best description of the finding is a successful privilege escalation.

Why the Other Options Are Wrong

A user determining their own permission level would explain the first whoami but not the psexec -s step or the change to nt authority\system, so what the analyst found is far more than reconnaissance. Routine system administrator maintenance is implausible because the session began as domain\localuser and crossed into the System context through a remote-execution utility, which is an attacker pattern rather than a patching workflow. Living-off-the-land binaries is the closest distractor, since PsExec is a legitimate signed tool abused in place, but that option names the technique used and understates the outcome, which is a completed privilege escalation.

Community Comment Notes

Most voters chose successful privilege escalation, with Jking1989 noting the escalation was successful rather than attempted and mrface33 pointing to the elevated privilege visible at the end of the transcript. johnabayot first reasoned toward escalation by describing attempts to elevate using a higher-privileged account, then later argued for the living-off-the-land option. Yomzie added useful context that PsExec is a dual-use tool also used for legitimate remote administration, which is why the binary alone does not settle the question.

Official Reference

Exam Strategy

Read a command history as a sequence and let the final state decide the answer: if privileges are higher at the end than at the start, the question describes a completed escalation rather than recon or an attempt. When a legitimate binary appears in the transcript, check whether the question asks about the technique or about the outcome before choosing the living-off-the-land option.

Frequently Asked Questions

Why is the living-off-the-land option wrong when PsExec is a legitimate Sysinternals tool?

Because the question asks what the analyst discovered, and the transcript ends with the operator holding the System account, so the completed privilege escalation describes the finding better than the technique used.

What does the second whoami command add to the analysis?

It confirms the outcome: the first whoami showed domain localuser, and after psexec -s the same check returns nt authority system, proving the privilege change took effect.

Related Analysis

← Back to SY0-601 Study Guide