OSCP PRACTICE
QUESTIONS AND
CORRECT ANSWERS
GRADED A+ 2025-2026
What is a SID for and where does it come from - ANS-The SID for local accounts and
groups is generated by the LSA, the domain controller generates it for domain users
and groups. The SID is immutable.
Parts of an SID - ANS-S-R-X-Y
S - a literal S which indicates that the string is an SID
R - the revision which is always 1
X - the identifier authority indicates what kind of entity created the SID, whether it be
the local computer or the domain controller.
Y - the sub authorities of the identifier authority, it is the domain identifier and the
relative identifier (RID)
Well-known SIDs - ANS-These are SIDs with an RID under 1000, these identify generic
groups etc in a domain.
RID - ANS-The relative identifier is the part of an SID the uniquely identifies that asset
in a domain.
Primary Non-Auth Windows Privilege Escalation Strategies - ANS-Service Binary
Hijacking
Service DLL Hijacking
Unquoted Service Paths
, Scheduled Tasks
Exploits
Get-CimInstance Usage Caveat - ANS-When running this command via bindshell or
WinRM we will get a permission denied error. Using an interactive logon like RDP
solves this problem.
Enumerate windows permissions from the commandline with these two commands: -
ANS-icacls
get-acl
Why is it that sometimes service binaries are world writeable? - ANS-When creating a
new service, sometimes people set the directory permissions of the service to be full
because they don't know what permissions will be needed.
What are the default actions for powerup.ps1's exploit functions? - ANS-They will add
a user named john and a password that is Password123!
What are the methods for performing a successful DLL hijacking? - ANS-- You can
directly overwrite the DLL in use, and write your own functions to add yourself as an
admin user.
- You can hijack the DLL search order. Essentially, if you can put your DLL in a location
closer to the binary being run than the current DLL used by that program, you can get
code execution in the context of whatever ran the DLL.
What is the DLL search order? - ANS-1. The directory from which the application
loaded.
2. The system directory.
3. The 16-bit system directory.
4. The Windows directory.
5. The current directory.
6. The directories that are listed in the PATH environment variable.
QUESTIONS AND
CORRECT ANSWERS
GRADED A+ 2025-2026
What is a SID for and where does it come from - ANS-The SID for local accounts and
groups is generated by the LSA, the domain controller generates it for domain users
and groups. The SID is immutable.
Parts of an SID - ANS-S-R-X-Y
S - a literal S which indicates that the string is an SID
R - the revision which is always 1
X - the identifier authority indicates what kind of entity created the SID, whether it be
the local computer or the domain controller.
Y - the sub authorities of the identifier authority, it is the domain identifier and the
relative identifier (RID)
Well-known SIDs - ANS-These are SIDs with an RID under 1000, these identify generic
groups etc in a domain.
RID - ANS-The relative identifier is the part of an SID the uniquely identifies that asset
in a domain.
Primary Non-Auth Windows Privilege Escalation Strategies - ANS-Service Binary
Hijacking
Service DLL Hijacking
Unquoted Service Paths
, Scheduled Tasks
Exploits
Get-CimInstance Usage Caveat - ANS-When running this command via bindshell or
WinRM we will get a permission denied error. Using an interactive logon like RDP
solves this problem.
Enumerate windows permissions from the commandline with these two commands: -
ANS-icacls
get-acl
Why is it that sometimes service binaries are world writeable? - ANS-When creating a
new service, sometimes people set the directory permissions of the service to be full
because they don't know what permissions will be needed.
What are the default actions for powerup.ps1's exploit functions? - ANS-They will add
a user named john and a password that is Password123!
What are the methods for performing a successful DLL hijacking? - ANS-- You can
directly overwrite the DLL in use, and write your own functions to add yourself as an
admin user.
- You can hijack the DLL search order. Essentially, if you can put your DLL in a location
closer to the binary being run than the current DLL used by that program, you can get
code execution in the context of whatever ran the DLL.
What is the DLL search order? - ANS-1. The directory from which the application
loaded.
2. The system directory.
3. The 16-bit system directory.
4. The Windows directory.
5. The current directory.
6. The directories that are listed in the PATH environment variable.
