Privilege Escalation Lateral Movement And Post Exploitation

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

Which post-exploitation action is considered 'Living off the Land' (LotL)?

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

During a CPENT engagement, a tester gains a low-privileged shell on a Windows Server 2019 host. The tester runs 'whoami /priv' and sees SeImpersonatePrivilege enabled. The host is running IIS with a service account that has this privilege. Which tool is most appropriate to escalate privileges by leveraging this token privilege?

A penetration tester has obtained domain user credentials and wants to perform lateral movement to a Windows Server 2016 host using WinRM. The tester has network access to the target on port 5985. Which TWO methods can be used to execute commands remotely via WinRM? (Choose two.)

During a CPENT engagement, you have obtained a low-privileged shell on a Windows Server 2019 host that is a member of an Active Directory domain. You notice the host has the SMB signing requirement disabled. You want to perform lateral movement to other hosts on the network by capturing and relaying authentication attempts. Which tool and technique would best allow you to relay NTLM authentication to a target host where SMB signing is not enforced?

You have gained access to a Linux host and escalated to root. You want to maintain persistence by creating a backdoor that will execute a reverse shell each time the system reboots. Which method would best achieve this while evading common detection mechanisms?

A penetration tester has obtained domain administrator credentials for a Windows Active Directory environment. The tester wants to extract the KRBTGT account password hash to create Golden Tickets. Which method is most direct for obtaining this hash?

You have compromised a Linux server and want to exfiltrate sensitive data to an external server. The network egress filtering only allows DNS traffic (UDP port 53) to a specific internal DNS resolver. Which technique would best allow you to exfiltrate data over DNS while evading detection?

A penetration tester has obtained a low-privileged shell on a Windows 10 workstation that is part of an Active Directory domain. The tester discovers that the workstation has Credential Guard enabled and that the current user has local admin rights on a different server. The tester wants to move laterally to the server using the current user's credentials without knowing the plaintext password. Which technique should the tester use to extract the user's Kerberos ticket from memory and reuse it on the target server?

During a penetration test on a Windows domain, a tester has compromised a workstation and obtained the NTLM hash of a domain user. The tester wants to authenticate to a remote server using this hash without cracking it. Which tool and command should the tester use to perform a pass-the-hash attack?

During a post-exploitation phase, you have obtained domain administrator credentials. You want to extract all password hashes from the domain controller's Active Directory database without installing additional software. Which built-in Windows utility should you use?

You have compromised a Windows workstation and want to maintain persistence by ensuring your malicious executable runs every time a user logs on. You have local administrator rights. Which registry key should you modify?