Overview
Module 8 covers exploiting Windows hosts and escalating privileges. It covers Windows exploitation techniques, local privilege escalation routes such as unquoted service paths, misconfigured services, weak permissions and token abuse, credential dumping from memory and the registry with tools such as Mimikatz, and post-exploitation activities including persistence and gathering material for lateral movement.
Windows is dominant in enterprise ranges, so this module is heavily exercised. The goal is to turn an initial foothold into high-privilege control, then harvest credentials that enable movement across the network and into Active Directory. The module rewards knowing Windows privilege-escalation patterns and recognizing them from enumeration output.
How it's tested
CPENT is performance-based, so this module shows up as turning a Windows foothold into high privilege, dumping credentials and setting up lateral movement, all documented. Because the exam is scored on what you achieve and document on live ranges, read each scenario for what it actually permits and reward methodical, evidence-backed work over guesswork.
-
Enumerate for escalation
You inspect services, permissions, tokens and paths to find the escalation route before acting.
-
Escalate then harvest
You raise privileges, then dump credentials to enable movement.
-
Prepare lateral movement
You collect hashes, tickets and credentials that unlock other hosts and the domain.
On a foothold, a service runs as SYSTEM with an unquoted path containing spaces and a writable directory. Exploiting a random kernel bug is tempting, but the misconfiguration is the clean route: placing a malicious executable in the path escalates to SYSTEM. After escalation, dumping credentials from memory yields hashes and tickets that enable pass-the-hash and movement toward the domain controller.
Modules 1
Official modules from the EC-Council outline, in outline order.
8.1 Windows Exploitation and Privilege EscalationThis module covers compromising Windows hosts and escalating privileges: exploitation techniques, local privilege escala
- What it means
- Windows exploitation and privilege escalation covers exploitation techniques, local escalation routes (unquoted service paths, misconfigured or weak-permission services, token abuse, scheduled tasks), credential dumping from memory and the registry, and post-exploitation including persistence and preparing lateral movement.
- What to understand
- Escalation usually comes from misconfiguration rather than exotic exploits, so enumeration finds the route. After escalation, credential dumping with tools such as Mimikatz yields hashes and tickets that enable pass-the-hash and pass-the-ticket. These credentials feed lateral movement and Active Directory attacks.
- How it shows up
- Applied hands-on to escalate on Windows, dump credentials and set up movement across the range.
- Common confusion
- Confusing credential dumping with cracking; dumping harvests stored hashes and tickets directly, without cracking the password.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Unquoted service path
A service path with spaces and no quotes that Windows may misinterpret.
- Remember
- A writable directory in the path enables escalation.
- Tested as
- Local escalation.
- Trap
- Overlooking it in enumeration.
-
Misconfigured services
Services with weak permissions a user can modify or restart.
- Remember
- They allow running code as a higher privilege.
- Tested as
- Local escalation.
- Trap
- Ignoring service permissions.
-
Token abuse
Impersonating privileged tokens to gain their rights.
- Remember
- Certain privileges enable it.
- Tested as
- Local escalation.
- Trap
- Missing exploitable privileges.
-
Credential dumping
Extracting hashes and tickets from memory or the registry.
- Remember
- Tools like Mimikatz harvest them directly.
- Tested as
- Post-exploitation.
- Trap
- Confusing it with cracking.
-
Pass-the-hash
Authenticating with a captured hash without cracking it.
- Remember
- It enables quiet lateral movement.
- Tested as
- Lateral movement.
- Trap
- Assuming the plaintext is needed.
-
Pass-the-ticket
Reusing a captured Kerberos ticket.
- Remember
- It grants access without the password.
- Tested as
- Lateral movement.
- Trap
- Confusing it with pass-the-hash.
-
Living off the land
Using built-in Windows tools to evade detection.
- Remember
- It avoids dropping obvious malware.
- Tested as
- Evasion.
- Trap
- Expecting custom malware when built-ins suffice.
-
Persistence
Maintaining access after the foothold.
- Remember
- Scheduled tasks, services and registry keys are common.
- Tested as
- Post-exploitation.
- Trap
- Leaving noisy, easily found persistence.
-
Enumeration for escalation
Systematically checking services, permissions, tokens and paths.
- Remember
- It reveals the escalation route.
- Tested as
- Methodology.
- Trap
- Attempting random exploits first.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Credential dumping vs. cracking vs. pass-the-hash
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Credential dumping | Harvests stored hashes and tickets | Direct from memory or registry | Confusing it with cracking |
| Cracking | Recovering plaintext from a hash offline | Slow, may fail | Cracking when reuse would work |
| Pass-the-hash | Authenticating with the hash itself | No cracking needed | Assuming plaintext is required |
Common Windows escalation routes
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Unquoted service path | Writable path with spaces | Place an executable to escalate | Overlooking it |
| Service misconfiguration | Weak service permissions | Modify or restart to run code | Ignoring permissions |
| Token abuse | Impersonate privileged tokens | Gain higher rights | Missing exploitable privileges |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Crack first
- What candidates pick
- Spend time cracking dumped hashes before using them.
- Why it looks right
- Cracking recovers the password.
- Why it's wrong
- Pass-the-hash authenticates with the hash directly, which is faster and quieter.
Clue to watch for Hashes are captured and time is limited.
-
Random exploit
- What candidates pick
- Try kernel exploits before checking for misconfiguration.
- Why it looks right
- A kernel exploit sounds powerful.
- Why it's wrong
- Most Windows escalation comes from misconfiguration found through enumeration.
Clue to watch for Enumeration reveals a misconfigured service or path.
-
Dump equals crack
- What candidates pick
- Treat credential dumping as the same as cracking.
- Why it looks right
- Both involve credentials.
- Why it's wrong
- Dumping harvests stored hashes and tickets directly, no cracking involved.
Clue to watch for The task is extracting credentials from a host.
-
Ignore service perms
- What candidates pick
- Overlook weak service permissions during enumeration.
- Why it looks right
- Services seem managed by the system.
- Why it's wrong
- Misconfigured service permissions are a classic escalation route.
Clue to watch for A user can modify or restart a privileged service.
-
Noisy persistence
- What candidates pick
- Install an obvious, easily detected persistence mechanism.
- Why it looks right
- It is quick to set up.
- Why it's wrong
- Valid credentials and subtle persistence are stealthier and more reliable.
Clue to watch for Stealth matters and credentials are available.
Answer framework
For any CPENT Windows Exploitation and Privilege Escalation scenario, use these steps.
- Enumerate the foothold systematically for services, permissions, tokens, paths and scheduled tasks, working methodically and documenting the outcome before moving on.
- Identify the escalation route, favoring misconfiguration over exotic exploits, and escalate to high privilege.
- Dump credentials from memory and the registry to obtain hashes and tickets.
- Use pass-the-hash and pass-the-ticket to move laterally without cracking passwords, working methodically and documenting the outcome before moving on.
- Establish stealthy persistence where needed and document the escalation and credentials gathered, and record evidence and the reasoning for each decision as you go, since the engagement is judged partly on the professional report you submit at the end.
Practice question
Want more like this? The CPENT practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Build a Windows lab and practice the escalation routes until you recognize each from enumeration output: unquoted service paths, weak service permissions, token abuse and scheduled tasks. Favor misconfiguration over exotic exploits, since that is where most range escalations come from.
Then master credential dumping and reuse. Learn to harvest hashes and tickets with tools such as Mimikatz, and to move with pass-the-hash and pass-the-ticket rather than cracking, which is slow. Practice living-off-the-land techniques for stealth. Keep documenting the escalation path and every credential captured, because these feed the Active Directory module and the final report. Afterwards, move to Module 9, Active Directory penetration testing, where these credentials become domain compromise. Throughout, keep a disciplined note-taking and evidence workflow, because the CPENT report and its evidence carry much of the score, and details are easily lost across a long, intense exam. Rehearse this in a lab until it is routine, and capture evidence as you work so the final report is complete and defensible.
FAQ
What is the difference between credential dumping and cracking?
Dumping harvests stored hashes and tickets directly from a host. Cracking tries to recover the plaintext password from a hash offline, which is slower and may fail.
Where does Windows privilege escalation usually come from?
More often from misconfiguration, such as unquoted service paths or weak service permissions, than from exotic kernel exploits.
What is pass-the-hash?
Authenticating to other systems using a captured password hash directly, without recovering the plaintext, which is common in Windows environments.
Why dump credentials after escalating?
High-privilege access unlocks hashes and tickets that enable lateral movement and domain compromise in later modules.
What does living off the land mean?
Using built-in Windows tools for malicious actions to evade detection, rather than dropping obvious malware.
How should persistence be handled?
Prefer valid credentials and subtle mechanisms over noisy, easily detected ones, consistent with stealth on the range.
How does this module connect to the rest of CPENT?
It turns a network foothold into high-privilege control and the credentials that drive Active Directory attacks and lateral movement.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Practice Module 8 skills
You have covered Windows exploitation, privilege escalation and credential dumping. Practice recognizing escalation routes and reusing credentials hands-on.