Study guide
13.1 Privilege Escalation and Credential Dumping
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
13.1 Privilege Escalation and Credential Dumping
Key Takeaways Explain This Topic AI
Domain 4 Attacks and Exploits is 35 percent of PT0-003; objective 4.4 is host-based work after a foothold — escalate, then dump — not a kernel or LSASS cookbook.
Windows privilege escalation on the exam is conceptual: UAC bypass, unquoted service path injection, token impersonation, and AlwaysInstallElevated; the unquoted path is a named 4.4 attack type.
Linux privilege escalation enumerates SUID binaries, sudo misconfiguration, capabilities, and writable cron first; kernel vulnerabilities are last resort because they are noisy, version-specific, and can crash production.
Misconfigured endpoints — local administrator everywhere, SMBv1, a disabled host firewall, and no patching — turn one foothold into a fleet.
Credential dumping extracts secrets that already live in LSASS, SAM, or NTDS.dit; Mimikatz is the named 4.4 tool, typically needs Administrator or SYSTEM, and is noisy because EDR watches LSASS.
Last updated: August 2026
Domain 4, Attacks and Exploits , is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.4 — Given a scenario, perform host-based attacks using the appropriate tools — starts after you already have a foothold. 4.2 was the network path. 4.3 reused a hash, ticket, or token. 4.4 is what you do on the box : privilege escalation and credential dumping here; process injection, security-tool bypass, and the named host tools in the next section. CompTIA is scoring attack-type identification and tool matching, not an exploit cookbook. This guide will not give Local Security Authority Subsystem Service (LSASS) dump commands or kernel exploit steps.
Privilege escalation: from user to more user
Privilege escalation (priv-esc) is gaining rights the foothold account does not already have. Vertical escalation is a standard user becoming local Administrator or SYSTEM (Windows) or root (Linux). Horizontal escalation is becoming a different user at the same integrity level because that other identity holds the interesting access. On PT0-003, name the class first, then name the OS pattern. Do not pick a kernel exploit as the default first move.
Windows patterns the exam actually names
User Account Control (UAC) bypass is conceptual, not a recipe. UAC is a consent-and-integrity prompt that keeps a medium-integrity process from silently becoming high-integrity. A bypass abuses an auto-elevating trusted binary, a writable path under a trusted parent, or a COM/interface behavior so the tester reaches high integrity without the prompt . Exam trap: treating UAC as a kernel security boundary that cannot be bypassed. CompTIA treats UAC bypass as a host-based technique you recognize when the stem shows a medium-integrity foothold and a prompt the user never saw. Trap two: answering Mimikatz for a UAC stem. Mimikatz dumps credentials; it does not explain why the prompt never appeared.
Unquoted service path injection is a named 4.4 attack type and a Windows priv-esc classic. If a service ImagePath is C:\Program Files\Vendor App\service.exe without quotes , the Service Control Manager may try C:\Program.exe , then C:\Program Files\Vendor.exe , then the real binary. If the tester can write C:\Program.exe (or another prefix the parser will try), the next service start runs the tester's file as the service account , often LocalSystem . When you pick it: host inventory shows an unquoted path plus a writable prefix directory. When you do not: a correctly quoted path, or a path the foothold cannot write. Exam trap: calling every service finding unquoted. A weak service DACL (the user can change the binPath) is a related misconfiguration, but the named 4.4 bullet is the unquoted path.
Token impersonation uses Windows access tokens . A process that holds privileges such as SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege (typical of service accounts, IIS app pools, and some backup agents) can impersonate a more privileged token that connects to it. Potato-family techniques are the exam's unnamed cousins of this idea. You need the concept : the token is the credential the kernel already issued; impersonation borrows it. You do not need a step-by-step. Exam trap: calling token impersonation pass-the-hash. Pass-the-hash is 4.3 reuse of an NTLM hash against a network logon. Token impersonation is on this host .
AlwaysInstallElevated is a pair of Windows Installer policies (machine and user). When both are enabled, a standard user can install a Microsoft Installer (MSI) package that runs with SYSTEM rights. When you pick it: host enumeration shows both policies set. When you do not: only one hive is set, or the tester is already SYSTEM. Conceptual only: the finding is that the installer policy grants SYSTEM to any local user, not a payload-authoring tutorial.
Linux patterns: enumerate, then kernel last
Linux priv-esc on PT0-003 is an enumeration story.
SUID (set-user-ID) binaries run as the file owner , often root. A SUID find , vim , python , or custom backup tool that can spawn a shell is the exam picture. Identification beats exploitation theater: list SUID files, decide which ones are unusual, and report the right that is too broad.
sudo misconfiguration is a sudoers rule that is wider than the administrator intended: NOPASSWD on a binary that can shell out, ALL=(ALL) ALL for a developer group, or a wildcard that includes a writable script. Restricted sudo is not no priv-esc; it is priv-esc through the allowed program. Shell escape in the next section is how several of those binaries become a root shell.
Linux capabilities ( cap_setuid , cap_dac_override , cap_net_raw , and related flags) attach selected root powers to a binary without the full SUID bit. A Python interpreter with cap_setuid is conceptually as interesting as SUID Python. Exam trap: treating capabilities as Linux UAC. They are a different kernel feature.
Writable cron (or a writable script that root's crontab already runs) is scheduled execution as another user. If root's hourly job calls /opt/backup/run.sh and that file is world-writable, the tester waits for the clock. This is host-based abuse of a misconfigured endpoint as much as it is a Linux trick.
Kernel vulnerabilities are last resort. They are noisy, version-specific, and they can crash the box. Rules of engagement (RoE) often forbid them on production. Exam trap: answering run a kernel exploit as the first Linux move when SUID, sudo, capabilities, or writable cron are on the stem. Those are safer, more common, and more often in-scope.
Misconfigured endpoints
Misconfigured endpoints are host posture problems that make every 4.4 technique easier:
Local administrator everywhere — the same local admin password, or the same local admin group membership, on every workstation. One local SYSTEM dump becomes a fleet.
SMBv1 still enabled — an old, chatty dialect that also marks a host nobody is patching.
Disabled host firewall — inbound PsExec, WinRM, and random listeners that should never have been reachable from the tester VLAN.
No patching — missing local privilege-escalation updates, ancient service binaries, and unquoted vendor apps that never got a quoted-path fix.
Exam trap: treating misconfigured endpoint as a Nessus row from Domain 3. 3.1 discovered it. 4.4 uses it on the host. Trap two: treating local-admin-everywhere as a 4.2 default-credential printer. It is a host identity problem: after one workstation, the same local hash works on the next.
Credential dumping: where secrets live
Credential dumping extracts authentication material that is already on the host . CompTIA wants where the secrets live and which tool is named, not a dump recipe.
LSASS (Windows) holds live logon secrets: NTLM hashes, Kerberos tickets, and, on some older or poorly hardened systems, material that can become cleartext. It is a process in memory. Touching it is noisy . Endpoint detection and response (EDR) products watch LSASS access as a first-class signal.
SAM (Security Account Manager) stores local account hashes on disk. Useful for local users, including a reused local administrator.
NTDS.dit is the Active Directory database on a domain controller . Domain hashes live there. Dumping NTDS is a forest-level event, not a workstation afterthought.
Mimikatz is the 4.4 named tool for this family. Typically you already need local Administrator or SYSTEM before Mimikatz can see LSASS or SAM the way the exam describes. A standard Domain User foothold does not magically dump the domain. Escalate first, then dump. Exam trap: picking Mimikatz for 4.2 NTLM relay (that is Impacket or CrackMapExec) or for 4.3 offline cracking (that is hashcat or John the Ripper). Mimikatz extracts host secrets. hashcat cracks them. CME reuses them on the network.
Dumping is loud . Even when RoE allows it, record that EDR should have fired. Credential Guard and similar controls exist specifically to make LSASS material harder to steal. If the stem says the tester is a low-priv user and asks for Mimikatz next, the answer is usually escalate first, not Mimikatz anyway.
Worked host
The tester is j.smith (Domain Users) on WS-042 . Host inventory shows an unquoted path for C:\Program Files\Backup Tool\svc.exe and a writable C:\ . The same local Administrator password is in the statement of work as reused across the VLAN. SMBv1 is on; the host firewall is off. After a documented unquoted-path proof to SYSTEM , Mimikatz against LSASS is the credential dump — still not a command block in the report. The local Administrator hash then becomes a 4.3 pass-the-hash candidate on the next workstation. Linux analogue on the same engagement: www-data on an intranet box, a SUID custom backup binary, sudo NOPASSWD on less , and a world-writable /etc/cron.hourly/ script. Enumerate those. Do not lead with a kernel module.
Attack What it does When you pick it Exam trap
Windows priv-esc UAC bypass, unquoted service path, token impersonation, AlwaysInstallElevated Foothold is not yet Admin/SYSTEM Kernel-first on Windows
Unquoted service path Parser runs a writable prefix of an unquoted ImagePath as the service account Unquoted path plus write on a prefix Every weak service ACL is unquoted
Linux priv-esc SUID, sudoers, capabilities, writable cron Unusual SUID or sudo before anything else Kernel exploit as default
Misconfigured endpoint Local admin reused, SMBv1, firewall off, no patches Posture that multiplies one host into a fleet Calling it a Domain 3 scan row
Credential dumping Extract secrets from LSASS, SAM, or NTDS Already Admin/SYSTEM (typical); Mimikatz Mimikatz as relay or as hashcat
Sequence on the exam: name the OS, name the priv-esc class, escalate, then dump. Mimikatz is the dump tool, not the first tool on a low-priv shell.