312-50 Question 146
Single answer▪ Executing ApplicationsDuring an authorized internal penetration test of a Windows 10 workstation, you gain a Meterpreter session running in the context of a standard domain user. The client asks you to demonstrate impact by launching a local application that requires elevated privileges, but without crashing the user's session or rebooting the host. You confirm that UAC is enabled and the current token is not elevated. Which action is the MOST appropriate next step to execute the application with the required privileges?
- A
Use Meterpreter's getuid to verify the current username, then launch the application directly with execute
- B
Attempt a UAC bypass or privilege escalation technique to obtain an elevated context first, then launch the application
- C
Migrate into explorer.exe and run the application from that process because explorer.exe is always elevated
- D
Use the shell command to start the application with runas; Windows will automatically elevate it without additional credentials or user approval
Show answer and explanation
Correct answer: B
Explanation
This question tests the distinction between executing an application and executing it in the correct security context. In Windows post-exploitation, launching a program is straightforward, but launching one that requires administrative rights depends on the integrity level and token privileges of the current session. Meterpreter's execute command can start processes, but it does not magically elevate them. Likewise, process migration affects stability and context, not privilege level by itself. On modern Windows systems with User Account Control enabled, a standard user or non-elevated admin token cannot simply start administrative applications without elevation. The practical sequence is to verify context, obtain elevation through an authorized and appropriate technique, and then execute the target application. This aligns with Microsoft guidance on UAC behavior and Windows access tokens: elevation depends on token integrity and administrative approval or valid credentials, not merely on which process launches the application.
- A. Incorrect.
Incorrect. Verifying the current user context with getuid is useful situational awareness, but it does not change the privilege level of the session. If the current token is a standard user token, directly using execute will still run the application without the administrative rights required by the target program.
- B. Correct.
Correct. If the application requires elevated privileges and the current Meterpreter session is not elevated, the tester must first obtain an elevated token or administrative context through an approved privilege escalation or UAC bypass technique that fits the engagement rules. After elevation, launching the application is the appropriate way to demonstrate impact while avoiding unnecessary disruption such as rebooting the host.
- C. Incorrect.
Incorrect. Migrating into explorer.exe may improve session stability or align with the logged-in user's desktop session, but explorer.exe is not inherently elevated. On a standard UAC-enabled Windows system, explorer.exe typically runs with the user's medium-integrity token, so this does not satisfy the requirement to execute an application needing administrative privileges.
- D. Incorrect.
Incorrect. The runas mechanism does not automatically grant elevation. In practice, it either requires valid alternate credentials or triggers behavior constrained by UAC and user interaction. It is not a reliable method for silently elevating a standard-user Meterpreter session during a controlled test.