13.1 Privilege Escalation and Credential Dumping
Key Takeaways
- Domain 4 Attacks and Exploits is 35 percent of PT0-003; objective 4.4 is host-based work after a foothold — escalate, then dump — not a kernel or LSASS cookbook.
- Windows privilege escalation on the exam is conceptual: UAC bypass, unquoted service path injection, token impersonation, and AlwaysInstallElevated; the unquoted path is a named 4.4 attack type.
- Linux privilege escalation enumerates SUID binaries, sudo misconfiguration, capabilities, and writable cron first; kernel vulnerabilities are last resort because they are noisy, version-specific, and can crash production.
- Misconfigured endpoints — local administrator everywhere, SMBv1, a disabled host firewall, and no patching — turn one foothold into a fleet.
- Credential dumping extracts secrets that already live in LSASS, SAM, or NTDS.dit; Mimikatz is the named 4.4 tool, typically needs Administrator or SYSTEM, and is noisy because EDR watches LSASS.
Domain 4, Attacks and Exploits, is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.4 — Given a scenario, perform host-based attacks using the appropriate tools — starts after you already have a foothold. 4.2 was the network path. 4.3 reused a hash, ticket, or token. 4.4 is what you do on the box: privilege escalation and credential dumping here; process injection, security-tool bypass, and the named host tools in the next section. CompTIA is scoring attack-type identification and tool matching, not an exploit cookbook. This guide will not give Local Security Authority Subsystem Service (LSASS) dump commands or kernel exploit steps.
Privilege escalation: from user to more user
Privilege escalation (priv-esc) is gaining rights the foothold account does not already have. Vertical escalation is a standard user becoming local Administrator or SYSTEM (Windows) or root (Linux). Horizontal escalation is becoming a different user at the same integrity level because that other identity holds the interesting access. On PT0-003, name the class first, then name the OS pattern. Do not pick a kernel exploit as the default first move.
Windows patterns the exam actually names
User Account Control (UAC) bypass is conceptual, not a recipe. UAC is a consent-and-integrity prompt that keeps a medium-integrity process from silently becoming high-integrity. A bypass abuses an auto-elevating trusted binary, a writable path under a trusted parent, or a COM/interface behavior so the tester reaches high integrity without the prompt. Exam trap: treating UAC as a kernel security boundary that cannot be bypassed. CompTIA treats UAC bypass as a host-based technique you recognize when the stem shows a medium-integrity foothold and a prompt the user never saw. Trap two: answering Mimikatz for a UAC stem. Mimikatz dumps credentials; it does not explain why the prompt never appeared.
Unquoted service path injection is a named 4.4 attack type and a Windows priv-esc classic. If a service ImagePath is C:\Program Files\Vendor App\service.exe without quotes, the Service Control Manager may try C:\Program.exe, then C:\Program Files\Vendor.exe, then the real binary. If the tester can write C:\Program.exe (or another prefix the parser will try), the next service start runs the tester's file as the service account, often LocalSystem. When you pick it: host inventory shows an unquoted path plus a writable prefix directory. When you do not: a correctly quoted path, or a path the foothold cannot write. Exam trap: calling every service finding unquoted. A weak service DACL (the user can change the binPath) is a related misconfiguration, but the named 4.4 bullet is the unquoted path.
Token impersonation uses Windows access tokens. A process that holds privileges such as SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege (typical of service accounts, IIS app pools, and some backup agents) can impersonate a more privileged token that connects to it. Potato-family techniques are the exam's unnamed cousins of this idea. You need the concept: the token is the credential the kernel already issued; impersonation borrows it. You do not need a step-by-step. Exam trap: calling token impersonation pass-the-hash. Pass-the-hash is 4.3 reuse of an NTLM hash against a network logon. Token impersonation is on this host.
AlwaysInstallElevated is a pair of Windows Installer policies (machine and user). When both are enabled, a standard user can install a Microsoft Installer (MSI) package that runs with SYSTEM rights. When you pick it: host enumeration shows both policies set. When you do not: only one hive is set, or the tester is already SYSTEM. Conceptual only: the finding is that the installer policy grants SYSTEM to any local user, not a payload-authoring tutorial.
Linux patterns: enumerate, then kernel last
Linux priv-esc on PT0-003 is an enumeration story.
SUID (set-user-ID) binaries run as the file owner, often root. A SUID find, vim, python, or custom backup tool that can spawn a shell is the exam picture. Identification beats exploitation theater: list SUID files, decide which ones are unusual, and report the right that is too broad.
sudo misconfiguration is a sudoers rule that is wider than the administrator intended: NOPASSWD on a binary that can shell out, ALL=(ALL) ALL for a developer group, or a wildcard that includes a writable script. Restricted sudo is not no priv-esc; it is priv-esc through the allowed program. Shell escape in the next section is how several of those binaries become a root shell.
Linux capabilities (cap_setuid, cap_dac_override, cap_net_raw, and related flags) attach selected root powers to a binary without the full SUID bit. A Python interpreter with cap_setuid is conceptually as interesting as SUID Python. Exam trap: treating capabilities as Linux UAC. They are a different kernel feature.
Writable cron (or a writable script that root's crontab already runs) is scheduled execution as another user. If root's hourly job calls /opt/backup/run.sh and that file is world-writable, the tester waits for the clock. This is host-based abuse of a misconfigured endpoint as much as it is a Linux trick.
Kernel vulnerabilities are last resort. They are noisy, version-specific, and they can crash the box. Rules of engagement (RoE) often forbid them on production. Exam trap: answering run a kernel exploit as the first Linux move when SUID, sudo, capabilities, or writable cron are on the stem. Those are safer, more common, and more often in-scope.
Misconfigured endpoints
Misconfigured endpoints are host posture problems that make every 4.4 technique easier:
- Local administrator everywhere — the same local admin password, or the same local admin group membership, on every workstation. One local SYSTEM dump becomes a fleet.
- SMBv1 still enabled — an old, chatty dialect that also marks a host nobody is patching.
- Disabled host firewall — inbound PsExec, WinRM, and random listeners that should never have been reachable from the tester VLAN.
- No patching — missing local privilege-escalation updates, ancient service binaries, and unquoted vendor apps that never got a quoted-path fix.
Exam trap: treating misconfigured endpoint as a Nessus row from Domain 3. 3.1 discovered it. 4.4 uses it on the host. Trap two: treating local-admin-everywhere as a 4.2 default-credential printer. It is a host identity problem: after one workstation, the same local hash works on the next.
Credential dumping: where secrets live
Credential dumping extracts authentication material that is already on the host. CompTIA wants where the secrets live and which tool is named, not a dump recipe.
- LSASS (Windows) holds live logon secrets: NTLM hashes, Kerberos tickets, and, on some older or poorly hardened systems, material that can become cleartext. It is a process in memory. Touching it is noisy. Endpoint detection and response (EDR) products watch LSASS access as a first-class signal.
- SAM (Security Account Manager) stores local account hashes on disk. Useful for local users, including a reused local administrator.
- NTDS.dit is the Active Directory database on a domain controller. Domain hashes live there. Dumping NTDS is a forest-level event, not a workstation afterthought.
Mimikatz is the 4.4 named tool for this family. Typically you already need local Administrator or SYSTEM before Mimikatz can see LSASS or SAM the way the exam describes. A standard Domain User foothold does not magically dump the domain. Escalate first, then dump. Exam trap: picking Mimikatz for 4.2 NTLM relay (that is Impacket or CrackMapExec) or for 4.3 offline cracking (that is hashcat or John the Ripper). Mimikatz extracts host secrets. hashcat cracks them. CME reuses them on the network.
Dumping is loud. Even when RoE allows it, record that EDR should have fired. Credential Guard and similar controls exist specifically to make LSASS material harder to steal. If the stem says the tester is a low-priv user and asks for Mimikatz next, the answer is usually escalate first, not Mimikatz anyway.
Worked host
The tester is j.smith (Domain Users) on WS-042. Host inventory shows an unquoted path for C:\Program Files\Backup Tool\svc.exe and a writable C:\. The same local Administrator password is in the statement of work as reused across the VLAN. SMBv1 is on; the host firewall is off. After a documented unquoted-path proof to SYSTEM, Mimikatz against LSASS is the credential dump — still not a command block in the report. The local Administrator hash then becomes a 4.3 pass-the-hash candidate on the next workstation. Linux analogue on the same engagement: www-data on an intranet box, a SUID custom backup binary, sudo NOPASSWD on less, and a world-writable /etc/cron.hourly/ script. Enumerate those. Do not lead with a kernel module.
| Attack | What it does | When you pick it | Exam trap |
|---|---|---|---|
| Windows priv-esc | UAC bypass, unquoted service path, token impersonation, AlwaysInstallElevated | Foothold is not yet Admin/SYSTEM | Kernel-first on Windows |
| Unquoted service path | Parser runs a writable prefix of an unquoted ImagePath as the service account | Unquoted path plus write on a prefix | Every weak service ACL is unquoted |
| Linux priv-esc | SUID, sudoers, capabilities, writable cron | Unusual SUID or sudo before anything else | Kernel exploit as default |
| Misconfigured endpoint | Local admin reused, SMBv1, firewall off, no patches | Posture that multiplies one host into a fleet | Calling it a Domain 3 scan row |
| Credential dumping | Extract secrets from LSASS, SAM, or NTDS | Already Admin/SYSTEM (typical); Mimikatz | Mimikatz as relay or as hashcat |
Sequence on the exam: name the OS, name the priv-esc class, escalate, then dump. Mimikatz is the dump tool, not the first tool on a low-priv shell.
Seatbelt-style inventory on a Windows foothold shows a service ImagePath of C:\Program Files\Backup Tool\svc.exe with no quotes, and the tester can write C:. Which 4.4 attack is that, and what does it conceptually achieve?
A tester has just reached local SYSTEM on a workstation and wants the live logon secrets from that host. Which statement is exam-correct about 4.4 credential dumping?
A tester is www-data on a Linux intranet host. Enumeration shows a SUID backup binary, sudo NOPASSWD on less, cap_setuid on Python, and a world-writable script that root's cron already runs. Leadership asks for a kernel exploit first. What is the exam-correct 4.4 reading?