Question

During a penetration test, you have SYSTEM-level access on a Windows Server 2019 host that has RDP enabled and internet-facing. The client wants to evaluate persistence techniques that survive user logins but do not require valid credentials. You replace sethc.exe with cmd.exe so that pressing SHIFT five times at the login screen spawns a SYSTEM command prompt. Which category of post-exploitation activity does this technique BEST represent?

Accepted Answer

Establishing persistence via an accessibility feature (image file execution / binary replacement) backdoor

Answer

Privilege escalation from a standard user to SYSTEM using an unquoted service path

Answer

Lateral movement to adjacent hosts using pass-the-hash over SMB

Answer

Covering tracks by clearing the Windows Security event log after access