Knowledge Hub

Windows PrivEsc

TryHackMe6 answered prompts

Windows PrivEsc TryHackMe walkthrough with 6 answered prompts.

Prompts and answers

  • What is the original BINARY_PATH_NAME of the daclsvc service?
    C:\Program Files\DACL Service\daclservice.exe
  • What is the BINARY_PATH_NAME of the unquotedsvc service?
    C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
  • What was the admin password you found in the registry?
    password123
  • What is the NTLM hash of the admin user?
    a9fdfa038c4b75ebc76dc855dd74f0da
  • Name one user privilege that allows this exploit to work.
    SeImpersonatePrivilege
  • Name the other user privilege that allows this exploit to work.
    SeAssignPrimaryTokenPrivilege