ExamFinch.com My Study

Study guide

8.4 Windows Patch Management, Local Security & Common Services

Practice this exam

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

8.4 Windows Patch Management, Local Security & Common Services

Key Takeaways Explain This Topic AI

Microsoft vulnerability tracking transitioned from legacy Security Bulletins (MSYY-NNN) to CVE identifiers and Knowledge Base (KB) numbers; hallmark vulnerabilities frequently tested on the CPSA include MS08-067 (Server Service), MS17-010 (EternalBlue), BlueKeep (RDP), and Zerologon (Netlogon).

Unquoted service paths containing spaces enable local privilege escalation if standard users have write access to intermediate directories, causing the Service Control Manager to execute planted binaries before the intended target executable.

Overly permissive service permissions such as SERVICE_CHANGE_CONFIG allow low-privileged users to alter the binary path (binpath) of a service to execute arbitrary commands with NT AUTHORITY\SYSTEM privileges upon restart.

Remote Desktop Protocol (RDP) mandates Network Level Authentication (NLA) to enforce user validation prior to full session creation and driver initialization, mitigating pre-authentication remote code execution vulnerabilities like BlueKeep.

Last updated: September 2026

8.4 Windows Patch Management, Local Security & Common Services

Enterprise Windows assessment requires evaluating not only Active Directory domain architecture and network authentication protocols, but also local host configurations, patch management posture, and common enterprise server roles. In the CREST Practitioner Security Analyst (CPSA) technical syllabus, candidates are expected to demonstrate knowledge of legacy and modern Microsoft vulnerability identifiers, recognize misconfigurations that permit local privilege escalation, and evaluate the security controls protecting Remote Desktop, Internet Information Services (IIS), and Microsoft Exchange.

  • Windows Patch Management & Vulnerability Tracking
  • 1. Patch Management Architecture

In enterprise networks, managing operating system updates is conducted centrally to prevent bandwidth saturation and ensure operational stability:

Windows Server Update Services (WSUS): An on-premises update repository that downloads patches from Microsoft Update and distributes them to enterprise workstations and servers via Group Policy Object (GPO) configuration.

Microsoft Endpoint Configuration Manager (MECM / SCCM): Provides comprehensive patch orchestration, compliance reporting, and software distribution.

Patch Cadence: Microsoft releases security patches on "Patch Tuesday" (the second Tuesday of each month). Out-of-band (OOB) patches are issued emergency updates reserved for critical, actively exploited zero-day vulnerabilities.

2. Vulnerability Tracking Nomenclature

Security analysts evaluate patches using two historical naming formats:

Legacy Security Bulletins (MSYY-NNN): Utilized by Microsoft until early 2017. Formatted as MS followed by the two-digit year and a three-digit sequential number (e.g., MS08-067 , MS17-010 ).

Modern Tracking (CVE & KB Numbers): Microsoft deprecated Security Bulletins in favor of the industry-standard Common Vulnerabilities and Exposures (CVE) nomenclature (e.g., CVE-2019-0708 ) paired with specific Knowledge Base (KB) article numbers (e.g., KB4013389 ). A single KB update frequently addresses multiple CVEs.

3. Landmark Windows Vulnerabilities Tested on CPSA +-----------------------------------------------------------------------------+

  • | CRITICAL HISTORICAL WINDOWS VULNERABILITIES |
  • +-----------------------------------------------------------------------------+
  • | MS08-067 (CVE-2008-4250) : Server Service NetprPathCanonicalize Overflow |
  • | Unauthenticated SYSTEM RCE via SMB (TCP 445/139) |
  • | |
  • | MS17-010 (CVE-2017-0144) : EternalBlue SMBv1 srv.sys FEA Buffer Overflow |
  • | Unauthenticated SYSTEM RCE via SMB (TCP 445) |
  • | |
  • | BlueKeep (CVE-2019-0708) : RDP termdd.sys Pre-Auth Use-After-Free |
  • | Unauthenticated SYSTEM RCE via RDP (TCP 3389) |
  • | |
  • | Zerologon (CVE-2020-1472): Netlogon AES-CFB8 Fixed All-Zero IV Flaw |
  • | Unauthenticated Domain Admin Takeover via RPC |
  • | |
  • | PrintNightmare (CVE-2021): Spooler RpcAddPrinterDriverEx Arbitrary DLL Load |
  • | Authenticated SYSTEM RCE / Privilege Escalation |
  • +-----------------------------------------------------------------------------+
  • A. MS08-067 (CVE-2008-4250, Server Service Buffer Overflow)

Affected Systems: Windows 2000, Windows XP, Windows Server 2003.

Root Cause: A stack-based buffer overflow in netapi32.dll inside the Server Service during the parsing of relative directory traversal paths ( ..\ ) in the RPC function NetprPathCanonicalize .

Impact: Unauthenticated remote code execution as NT AUTHORITY\SYSTEM over SMB TCP port 445 or 139. Weaponized by the historic Conficker worm.

B. MS17-010 (CVE-2017-0144, "EternalBlue")

Affected Systems: Windows Vista through Windows 10, Windows Server 2008 through 2016.

Root Cause: A mathematical integer error in the SMBv1 driver srv.sys when calculating the allocation buffer size for File Extended Attribute (FEA) lists received in SMB_COM_TRANSACTION2 secondary requests.

Impact: Complete unauthenticated remote code execution with SYSTEM privileges over TCP port 445. Utilized in global ransomware outbreaks including WannaCry and NotPetya.

C. BlueKeep (CVE-2019-0708, Remote Desktop Protocol Pre-Auth RCE)

Affected Systems: Windows XP, Windows 7, Windows Server 2003, Windows Server 2008 / 2008 R2.

Root Cause: A pre-authentication use-after-free vulnerability in the RDP kernel driver termdd.sys . An attacker sends malformed channel binding requests targeting the internal MS_T120 channel, leading to kernel memory corruption.

Impact: Remote code execution at the kernel level without authentication. Completely mitigated by enabling Network Level Authentication (NLA) .

D. Zerologon (CVE-2020-1472, Netlogon Protocol Privilege Escalation)

Affected Systems: All Windows Server versions operating as Active Directory Domain Controllers.

Root Cause: A cryptographic implementation failure in the Netlogon Remote Protocol ( ComputeNetlogonCredential ). The protocol implemented the AES-CFB8 block cipher mode with a fixed, static Initialization Vector (IV) consisting of 16 zero bytes ( 0x00 * 16 ).

Mathematical Flaw: When encrypting an all-zero plaintext using an all-zero IV under AES-CFB8, there is a 1-in-256 ( 2 8 2^8 2 8 ) probability that the resulting ciphertext is also entirely zeros.

Impact: An unauthenticated attacker transmitting roughly 256 authentication attempts consisting of zero bytes can authenticate as the Domain Controller's computer account ( DC$ ) and reset its password in Active Directory to empty strings, achieving immediate, complete domain compromise.

E. PrintNightmare (CVE-2021-34527 & CVE-2021-1675)

Affected Systems: All Windows client and server platforms.

Root Cause: Insecure design in the Windows Print Spooler service ( spoolsv.exe ). The RPC function RpcAddPrinterDriverEx() permitted authenticated clients to register printer drivers and specify remote DLL files hosted on an SMB share without adequate privilege validation.

Impact: Allows any authenticated domain user to achieve remote code execution as NT AUTHORITY\SYSTEM on any host running the Print Spooler service, including Domain Controllers.

Windows Local Privilege Escalation & Misconfigurations

Once an attacker obtains a low-privileged command shell on a Windows endpoint, local misconfigurations frequently allow immediate escalation to NT AUTHORITY\SYSTEM .

1. Unquoted Service Paths

Mechanics: Windows services execute binaries registered under the registry key HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\ImagePath .

If a service binary path contains space characters and is not enclosed within quotation marks , the Windows Service Control Manager (SCM) cannot determine where the executable path ends and where command-line arguments begin.

Evaluation Order: SCM evaluates spaces as potential argument delimiters from left to right: Path: C:\Program Files\Enterprise Monitor\Sub Folder\service.exe

  • 1. C:\Program.exe
  • 2. C:\Program Files\Enterprise.exe
  • 3. C:\Program Files\Enterprise Monitor\Sub.exe
  • 4. C:\Program Files\Enterprise Monitor\Sub Folder\service.exe (Intended)

Exploitation Condition: If an unprivileged user has write permissions to C:\ or C:\Program Files\ , dropping a malicious executable named Program.exe or Enterprise.exe results in the SCM executing that binary with the service's privileges (typically SYSTEM ) upon system reboot or service restart.

Discovery Command: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """"

2. Weak Service Permissions (DACL Misconfigurations)

Services in Windows are securable objects with Discretionary Access Control Lists (DACLs). If permissions on a service are overly permissive, unprivileged users can modify service parameters.

Vulnerable Permissions: If standard groups ( Authenticated Users , BUILTIN\Users , Everyone ) possess SERVICE_CHANGE_CONFIG or SERVICE_ALL_ACCESS rights over a service.

Exploitation: The tester reconfigures the service's binary path ( binPath ) to execute a command or payload, then stops and restarts the service: # Reconfigure the service binary path to execute a reverse shell or add a local admin

  • sc config VulnerableService binPath= "net localgroup administrators attacker /add"
  • sc stop VulnerableService
  • sc start VulnerableService
  • Verification Tool: Microsoft Sysinternals accesschk.exe -uwcqv "Authenticated Users" *
  • 3. AlwaysInstallElevated Registry Setting

Windows Installer ( msiexec.exe ) allows administrative installations. Microsoft includes a policy setting intended for environments where non-administrators must install approved software.

The Flaw: If the AlwaysInstallElevated registry key is set to 1 (DWORD) in BOTH of the following registry hives:

  • HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1
  • HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1

When both keys equal 1 , the operating system executes all .msi installation packages with elevated NT AUTHORITY\SYSTEM privileges, regardless of the user's privilege level.

Exploitation: The tester generates an MSI payload (e.g., via msfvenom -p windows/x64/shell_reverse_tcp ... -f msi -o update.msi ) and executes it silently: msiexec /quiet /qn /i update.msi

4. Insecure Scheduled Tasks

Scheduled tasks running under high-privilege accounts (such as SYSTEM ) that execute scripts (batch files, PowerShell) or binaries located in world-writable directories (e.g., C:\Temp\ or C:\ProgramData\ ). Replacing the script or binary elevates the attacker's context when the scheduled task fires.

  • Common Windows Services Security Assessment
  • 1. Remote Desktop Protocol (RDP, TCP Port 3389)

Protocol Architecture: Provides graphical desktop access over TCP port 3389 (and optional UDP 3389 for streaming optimization).

Network Level Authentication (NLA):

Legacy RDP established the graphical session and loaded kernel drivers before prompting for user credentials, exposing the system to denial of service and pre-auth exploits like BlueKeep.

NLA Mechanics: Enforces client authentication via the Credential Security Support Provider (CredSSP) protocol using Kerberos or NTLM before the full RDP connection handshake occurs. Systems with NLA enabled silently drop unauthenticated exploit payloads targeting the RDP protocol stack.

Session Hijacking via tscon.exe : An administrative user possessing SYSTEM privileges can hijack disconnected or locked interactive user sessions without entering the user's password using the built-in Terminal Services utility: # List active and disconnected user sessions

  • query user
  • # Hijack session ID 2 into the current console session
  • tscon 2 /dest:console
  • 2. Microsoft Internet Information Services (IIS, TCP Ports 80 / 443)

Configuration Leakage ( web.config ): The central configuration file for ASP.NET applications hosted on IIS. Frequently contains database connection strings with embedded plaintext credentials, application API keys, and machine keys used for ViewState signing.

Handler Mappings & ISAPI Filters: Handlers dictate how IIS processes specific file extensions ( .asp , .aspx , .ashx ). If an upload directory allows the upload of executable extensions and inherits script execution permissions, an attacker achieves web shell execution.

IIS Short (8.3) Filename Disclosure: A legacy vulnerability where IIS reveals the first six characters of files and folders (e.g., SECRET~1.DOC ) via tilde character enumeration due to Windows 8.3 filename compatibility in the NTFS driver.

3. Microsoft Exchange Server

Architecture: Enterprise messaging platform deeply integrated with Active Directory. Key web endpoints include Outlook Web Access ( /owa ), Exchange ActiveSync ( /Microsoft-Server-ActiveSync ), Exchange Web Services ( /ews ), and the Exchange Administration Center ( /ecp ).

Privilege Risks: Exchange servers belong to the high-privilege Exchange Windows Permissions and Exchange Trusted Subsystem Active Directory security groups, which historically possess WriteDacl permissions over domain objects, allowing an attacker who compromises Exchange to immediately escalate to Domain Admin.

Pre-Auth Proxy Vulnerability Families:

ProxyLogon (CVE-2021-26855 / CVE-2021-27065): Pre-authentication Server-Side Request Forgery (SSRF) combined with an arbitrary file write flaw, allowing unauthenticated attackers to write web shells to the OWA directory.

ProxyShell (CVE-2021-34473 / CVE-2021-34523 / CVE-2021-31207): Pre-authentication path confusion, privilege elevation to SYSTEM via Exchange PowerShell backend, and arbitrary file write allowing remote command execution via exposed web ports.