CompTIA PenTest+ (PT1-002) — Question 26

A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?

Answer options

• A. Alternate data streams
• B. PowerShell modules
• C. MP4 steganography
• D. PsExec

Correct answer: B

Explanation

The correct answer is B, as PowerShell modules can be utilized to run scripts and commands, making them suitable for executing binaries through wmic.exe. The other options, while useful in different contexts, do not directly facilitate the execution of binaries in the same manner as PowerShell modules do.