A penetration tester has gained access to a target Windows machine and wants to maintain persistence by creating a new user with administrative privileges. Which command sequence achieves this?

• A. net user jsmith <password> /add followed by net localgroup Administrators jsmith /add
• B. net user /add jsmith
• C. net localgroup Administrators /add jsmith
• D. net user jsmith /delete

Answer: (A)

Creating persistence on a Windows host by a new admin user requires two steps: first create the account with a password, then grant that account administrative rights by adding it to the local Administrators group. The sequence that does this is to create the user with a password, then add that user to Administrators. The first command establishes a usable account, and the second command elevates its privileges by placing the account into the Administrators group, which gives full admin rights on the machine. Without the password, the account may not be usable; without first creating the user, there’s nothing to add to the group; and deleting a user would remove the account rather than create it. Adding to the Administrators group without an existing user would fail, since the target account doesn’t exist yet.