CPENT Practice Test 17 — 15 Questions

Question 1

A tester has located a domain user account configured with Constrained Delegation (S4U2Self / S4U2Proxy) pointing to a target service. What tool and module in Impacket can be used to leverage this delegation to obtain a TGS for a privileged user (e.g., Administrator)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

getST.py. Impacket's getST.py is purpose-built to abuse Kerberos delegation by performing the S4U2Self and S4U2Proxy extensions. Given a constrained-delegation account's credentials (or hash) and the target SPN, it requests a service ticket impersonating an arbitrary user such as Administrator, which can then be used with other Impacket tools. This directly leverages the delegation trust configured on the account.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

addcomputer.py

Question 2

A penetration tester is performing an attack utilizing the PetitPotam (MS-EFSR) vulnerability against a domain controller. What is the primary objective of forcing the domain controller to authenticate via PetitPotam?

Accepted Answer

To coerce the domain controller's machine account to authenticate to an NTLM relay listener targeting AD CS.. PetitPotam (CVE-2021-36942) abuses the MS-EFSRPC interface (EfsRpcOpenFileRaw) to force a Windows host — including a domain controller — to initiate an outbound NTLM authentication to an attacker-controlled UNC path. The attacker's real goal is not to read files or dump memory, but to capture that machine-account NTLM authentication and relay it to a service that accepts NTLM, most classically Active Directory Certificate Services (AD CS) via the ESC8 web enrollment endpoint. Relaying the DC's machine account to AD CS allows the attacker to request a certificate on behalf of the DC, which can then be used for domain takeover (e.g., via PKINIT to obtain a TGT for the DC).

Answer

To corrupt the NTDS.dit database file on the remote domain controller.

Answer

To extract the plaintext password of the domain administrator from the LSASS process memory.

Answer

To bypass Kerberos pre-authentication requirements on user accounts.

Question 3

A penetration tester is reviewing the firmware of a smart electricity meter and discovers that the bootloader is unlocked. The tester connects a USB-to-UART serial adapter to the board's exposed pins and interrupts the boot sequence to gain a root shell. Which environment variable or kernel boot parameter must the tester modify to bypass the root password authentication prompt entirely?

Accepted Answer

init=/bin/sh. Appending 'init=/bin/sh' or 'init=/bin/bash' to the kernel boot arguments (bootargs) forces the Linux kernel to spawn a shell directly upon booting, bypassing init scripts and authentication prompts. 'rootfstype' defines the filesystem type, 'ip=' configures networking, and 'mem=' limits RAM.

Answer

rootfstype=squashfs

Answer

ip=DHCP

Answer

mem=256M

Question 4

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

Accepted Answer

Netdiscover. Netdiscover is a reconnaissance tool built specifically to send ARP requests (and ARP replies in active mode) to enumerate live hosts on a local Layer 2 segment. Because ARP operates below IP and requires no TCP/UDP ports to be open, it maps hosts quickly without generating the noisy port-scan traffic that IDS/IPS signatures look for.

Answer

Wireshark

Answer

Nikto

Answer

Sqlmap

Question 5

An analyst is examining the firmware of an IoT gateway and discovers a JFFS2 file system image. The analyst wants to extract the file system contents. Which tool, specifically designed for JFFS2 extraction and analysis, should the analyst run on a Linux workstation?

Accepted Answer

jeffs2dump / mtd-utils. The 'mtd-utils' package includes tools like 'jeffs2dump' and 'nanddump', while 'jeffs2dump' or 'jeffs2extract' utilities unpack JFFS2 file systems.

Answer

dpkg-deb

Answer

rpmbuild

Answer

apt-get extract

Question 6

An operator is conducting an Active Directory penetration test and has obtained domain admin credentials. To maintain persistence, they want to create a backdoor that allows them to authenticate as any user without knowing their password, even if the domain admin password is changed. Which of the following techniques would BEST achieve this?

Accepted Answer

Forge a Golden Ticket using the KRBTGT account hash.. A Golden Ticket is a forged Kerberos TGT that is signed with the KRBTGT account's hash. Once an operator has domain admin access, they can extract the KRBTGT hash and generate Golden Tickets at will. These tickets can be used to impersonate any user, including domain admins, and they remain valid until the KRBTGT password is changed twice (to invalidate all existing tickets). This makes it a powerful persistence mechanism that survives password changes of individual accounts.

Answer

Create a new domain admin account with a known password.

Answer

Set the 'AdminCount' attribute to 1 on a standard user account.

Answer

Enable the 'Do not require Kerberos preauthentication' flag on a service account.

Question 7

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

Accepted Answer

Mimikatz. Mimikatz is the standard tool used to parse LSASS dumps and extract authentication secrets.

Answer

Wireshark

Answer

Hashcat

Answer

Responder

Question 8

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

Accepted Answer

-sI. The -sI flag instructs Nmap to perform an idle scan using a specified zombie host, allowing completely blind port scanning where packets appear to originate from the zombie.

Answer

-sZ

Answer

-sO

Answer

-sM

Question 9

A penetration tester is assessing a building automation system that uses BACnet for communication between controllers and a central workstation. The tester wants to enumerate all BACnet devices on the network and identify their object types and properties. Which tool should the tester use to perform this enumeration?

Accepted Answer

BACnet discovery tool (e.g., BACnet Scan or VTS). A dedicated BACnet discovery tool such as BACnet Scan or VTS can actively query the network using BACnet services like Who-Is and Read-Property to enumerate all devices, object types, and properties. This provides the comprehensive inventory the tester needs. Other tools like Nmap or Wireshark may offer limited visibility but cannot perform the full active enumeration required.

Answer

Wireshark with a BACnet display filter

Answer

Nmap with the bacnet-info NSE script

Answer

Metasploit with the bacnet_scanner module

Question 10

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

Accepted Answer

The service account possesses permissions across all GCP services unless explicitly restricted by IAM project-level bindings.. The scope https://www.googleapis.com/auth/cloud-platform is the broadest OAuth scope available in GCP, granting the service account access to essentially all GCP APIs. IAM bindings then determine which specific actions the account can actually perform, but the scope itself does not restrict the API surface. Therefore, the service account can potentially reach every GCP service unless IAM policies explicitly deny or limit permissions.

Answer

Google Cloud automatically rotates the service account private key every 60 seconds.

Answer

The instance is automatically accessible via SSH from any external IP address without firewall rules.

Answer

The instance metadata server disables access tokens to prevent Server-Side Request Forgery.

Question 11

A penetration tester has obtained domain user credentials and wants to perform lateral movement to a Windows Server 2016 host using WinRM. The tester has network access to the target on port 5985. Which TWO methods can be used to execute commands remotely via WinRM? (Choose two.)

Accepted Answer

Using PowerShell Remoting with Enter-PSSession. WinRM allows remote command execution via WS-Management. PowerShell Remoting (Enter-PSSession) and WinRS are native tools that utilize WinRM. They enable interactive or one-off command execution when WinRM is enabled and credentials are available, making them effective for lateral movement in Windows environments.

Answer

Using WMI with the /node:target parameter

Answer

Using PsExec with the -r flag to specify WinRM

Answer

Using SSH to connect to the Windows host

Question 12

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

Accepted Answer

Query 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01' with the header 'Metadata: true' to obtain an Azure access token using the managed identity.. The Azure Instance Metadata Service (IMDS) is accessible at http://169.254.169.254 and can provide an OAuth2 token for the managed identity when the request includes the header 'Metadata: true'. By exploiting SSRF, the tester can make the Function App issue a request to this endpoint and retrieve the token, which can then be used to access Azure resources with the Contributor role. This is a classic SSRF-to-cloud-metadata attack.

Answer

Send a crafted SOAP request to the Azure Resource Manager endpoint to extract the storage account account key.

Answer

Extract the master deployment credentials from the Azure Web Job environment variables via port 443.

Answer

Exploit the Azure Function proxy configuration to read the /etc/passwd file from the underlying hypervisor.

Question 13

A CPENT tester is evaluating an IoT device that exposes a serial console header on its PCB. After connecting a UART adapter, the tester sees garbled characters in the terminal. Which action should the tester take to obtain a readable console output?

Accepted Answer

Adjust the terminal's baud rate to match the device's configured UART speed, trying common values such as 115200 or 9600. Garbled UART output indicates the terminal's baud rate does not match the device's configured speed. Systematically trying common baud rates such as 115200, 57600, 38400, and 9600 until readable text appears is the standard, non-destructive fix. This restores the serial console, enabling bootloader and firmware analysis on the IoT device.

Answer

Enable hardware flow control (RTS/CTS) in the terminal to stabilize the serial connection

Answer

Increase the UART adapter's voltage from 3.3V to 5V to boost signal integrity

Answer

Swap the TX and RX lines on the UART adapter to correct the garbled output

Question 14

A penetration tester is evaluating a smart home IoT hub and needs to extract the firmware to analyze hardcoded cryptographic keys. The device exposes a physical debugging interface on the board with clock, data, ground, and power pins. Which hardware hacking tool should the tester connect to these pins to interact with the internal flash memory and dump the firmware?

Accepted Answer

Bus Pirate. The Bus Pirate is a universal open-source hardware hacking tool designed to interface with embedded chips via SPI, I2C, UART, JTAG, and other low-level protocols. The described pins (clock, data, ground, power) match an SPI or I2C flash chip interface, which the Bus Pirate can directly read to dump firmware. It is the standard tool for in-circuit flash extraction when a physical debugging header is exposed.

Answer

Wireshark

Answer

Logic Analyzer

Answer

HackRF One

Question 15

An operator has compromised a domain user account and wants to perform a Kerberoasting attack to extract service account hashes. The operator uses Rubeus with the kerberoast command. Which encryption type should the operator request to maximize the chance of cracking the extracted tickets?

Accepted Answer

RC4 (etype 23). The correct answer is RC4 (etype 23) because it is the weakest encryption type for Kerberos tickets and is easier to crack. By requesting RC4 tickets, the operator increases the chances of successfully cracking the service account hash offline, especially if the password is weak. This is a common tactic in Kerberoasting attacks.

Answer

DES (etype 1)

Answer

AES256 (etype 18)

Answer

AES128 (etype 17)