CPENT Privilege Escalation Lateral Movement And Post Exploitation — 30 Questions

Question 1

During an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Over-Pass-the-Hash, which generates a full Kerberos ticket using extracted user AES keys instead of NTLM hashes.. When Credential Guard is enabled, direct reading of LSASS memory is blocked. However, techniques like throwing tokens or using restricted administrator access tokens, or abusing specific COM/RPC objects, are alternative vectors, though Pass-the-Ticket via Kerberos delegation or abusing DPAPI are standard workarounds. Specifically, forcing NTLM authentication or abusing constrained delegation are preferred. Wait, the question asks for bypassing Credential Guard or interacting with LSASS - actually, direct LSASS dumping fails, but token impersonation or abusing DCShadow/DCSync if domain admin is available works. For local Credential Guard bypass, Over-Pass-the-Hash (generating Kerberos tickets via AES keys) works if AES keys are extracted from NTDS.dit or kerberos traffic.

Answer

Running mimikatz with the 'privilege::debug' command escalated via a service account.

Answer

Patching the lsass.exe executable on disk to disable security checks.

Answer

Injecting shellcode directly into the winlogon.exe process memory space.

Question 2

An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?

Accepted Answer

/etc/cron.d/custom_persistence with the format '* * * * * root /bin/nc ...'. The /etc/cron.d/ directory is specifically designed for system administrators and packages to drop in cron job files without editing the main /etc/crontab. Each file in /etc/cron.d/ follows the system crontab format, which includes an extra field for the user to run the job as (e.g., 'root'). This allows an attacker with write access to /etc/cron.d/ to create a file that schedules a command to run as root every 5 minutes, achieving persistence. The format '* * * * * root /bin/nc ...' is correct for a job that runs every minute, but the question specifies every 5 minutes; however, the option is still the correct location because it's the only one that supports root execution via cron without modifying /etc/crontab.

Answer

~/.bashrc of the current low-privileged user.

Answer

/etc/init.d/rc.local execution hook.

Answer

/var/www/html/backdoor.php

Question 3

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

Accepted Answer

TCP port 135 (RPC Endpoint Mapper). WMI (Windows Management Instrumentation) relies on DCOM/RPC for remote communication. The initial connection is made to the RPC Endpoint Mapper on TCP port 135, which then directs the client to a dynamically allocated port for the actual WMI service. Therefore, TCP 135 must be accessible through firewalls to initiate a WMI connection.

Answer

UDP port 53 (DNS)

Answer

TCP port 445 (SMB)

Answer

TCP port 3389 (RDP)

Question 4

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

Accepted Answer

Get-WmiObject win32_service | select Name, PathName | where { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }. Unquoted service paths can be queried via WMI or PowerShell without admin rights. The Get-WmiObject command querying Win32_Service can filter for paths containing spaces and not enclosed in quotes.

Answer

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command

Answer

sc query state= all | findstr /i "binpath"

Answer

Get-Service | Where-Object { $_.Status -eq 'Running' -and $_.Path -notmatch '"' }

Question 5

An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?

Accepted Answer

Create a __EventFilter monitoring Win32_OperatingSystem startup, a CommandLineEventConsumer executing the payload, and a __FilterToConsumerBinding object. WMI persistence involves creating an __EventFilter to trigger on system startup, an __EventConsumer (specifically CommandLineEventConsumer) to execute the payload, and a __FilterToConsumerBinding to link the two objects together.

Answer

Inject a DLL into winlogon.exe and configure a Group Policy Object to execute the payload upon user logon

Answer

Configure a new registry run key using reg add pointing to a VBScript payload in the Startup folder

Answer

Use PowerShell to create an EventFilter looking for Win32_NTLogEvent and a ScriptFileEventConsumer pointing to a scheduled task

Question 6

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

Accepted Answer

find / -type f -perm -4000 2>/dev/null. The command find / -perm -4000 2>/dev/null searches the entire filesystem for files with the SUID bit set (-4000) and redirects standard error to /dev/null to keep the output clean.

Answer

grep -r 'SUID' /etc/permissions.conf

Answer

getcap -r / 2>/dev/null

Answer

find / -name suid -exec ls -la {} \;

Question 7

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

Accepted Answer

Use PsExec or WinRM with the valid credentials to execute commands interactively on domain-joined member servers. Option A is correct because possessing valid domain administrator credentials allows the tester to authenticate to remote domain-joined member servers via PsExec (SMB/RPC) or WinRM (5985/5986) and execute commands interactively, which is a standard lateral movement technique that does not require DCSync. Option B is correct because with valid domain admin credentials the tester can request or harvest Kerberos TGTs (e.g., from LSASS via tools like Mimikatz sekurlsa::tickets) and perform a Pass-the-Ticket attack, reusing the TGT to authenticate to other services without knowing the account password or performing DCSync. Option C is incorrect because modifying the BCD store to disable PatchGuard is not a valid or practical technique for lateral movement or domain dominance, and PatchGuard cannot be disabled this way on domain controllers. Option D is incorrect because changing a local Administrator password on a single workstation via SAM-R/RPC is a limited, host-specific action that does not leverage domain admin credentials for lateral movement or domain dominance. Option E is incorrect because injecting shellcode directly into ntds.dit while the database is offline is not a feasible or standard post-exploitation technique and does not relate to using the discovered credentials.

Answer

Modify the Windows Boot Configuration Data (BCD) store to disable PatchGuard on all domain controllers

Answer

Change the password of the local Administrator account on a single workstation via SAM-R or RPC

Answer

Inject shellcode directly into the Active Directory database file (ntds.dit) while the database is offline

Question 8

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

Accepted Answer

Chisel to establish a tunnel over HTTP.. Chisel is a fast TCP/UDP tunnel over HTTP that is ideal for bypassing firewalls by masquerading traffic as web requests.

Answer

ftp to a remote server.

Answer

scp using a custom port.

Answer

netcat with a simple pipe.

Question 9

You have identified an unquoted service path vulnerability on a Windows server. What is the correct remediation path to escalate privileges?

Accepted Answer

Create a malicious executable matching a component of the unquoted path.. By placing a malicious executable in the folder corresponding to the unquoted path (e.g., C:\Program.exe), the service manager will execute it instead of the intended binary.

Answer

Replace the existing service binary.

Answer

Restart the service with elevated arguments.

Answer

Modify the service registry key to add quotes.

Question 10

You are assessing a Linux privilege escalation path. Which THREE techniques would allow you to escalate to root if you have write access to the /etc/passwd or /etc/shadow file?

Accepted Answer

Creating a new user entry with UID 0. Option A is correct because adding a new line to /etc/passwd with UID 0 (e.g., 'hacker:x:0:0:root:/root:/bin/bash') creates an account that the kernel treats as root, allowing immediate privilege escalation via su or login. Option B is correct because write access to /etc/passwd or /etc/shadow can be leveraged indirectly — for example, by creating a UID 0 account and then using it to append an entry to /etc/sudoers granting full sudo rights, or by editing sudoers directly if the write primitive extends to it — enabling root-level command execution. Option C is correct because overwriting the root hash in /etc/shadow with a known hash (e.g., generated via openssl passwd -6 or mkpasswd) lets you authenticate as root with your chosen password using su or ssh. Option D is incorrect because /etc/hosts only maps hostnames to IP addresses and has no bearing on user authentication or privilege levels. Option E is incorrect because running a kernel exploit via gcc is an unrelated escalation vector that does not depend on write access to /etc/passwd or /etc/shadow.

Answer

Modifying /etc/hosts

Answer

Running a kernel exploit using gcc

Question 11

Which TWO methods are commonly used for data exfiltration during a penetration test to bypass basic network monitoring?

Accepted Answer

Using HTTPS to tunnel the data. Option A (Using HTTPS to tunnel the data) is correct because HTTPS encrypts the payload with TLS on port 443, so basic network monitoring that relies on signature matching or cleartext inspection cannot see the exfiltrated content, and the traffic blends with normal web browsing. Option D (Base64 encoding the data before transit) is correct because base64 converts binary or sensitive data into an ASCII-safe format that evades simple keyword/pattern-based DLP and IDS rules looking for readable strings, and it is commonly used to package data for covert channels. Option B is not a network exfiltration method; writing data into system event logs stores it locally and does not transmit it off-host. Option C is wrong because plaintext Telnet is easily detected by basic network monitoring and is not a bypass technique. Option E is wrong because standard FTP sends credentials and data in cleartext, making it visible to network monitoring rather than evading it.

Answer

Storing data in the system event logs

Answer

Sending data via plaintext telnet

Answer

Using a standard FTP connection

Question 12

A tester has compromised a Linux host and wants to escalate privileges by exploiting a misconfigured cron job. The tester notices that a script in /etc/cron.d/backup.sh is writable by the current user. What is the most direct way to escalate privileges using this misconfiguration?

Accepted Answer

Modify the script to add a reverse shell and wait for the cron job to execute.. Writable cron scripts are a classic privilege escalation vector. By injecting a reverse shell into the script, the tester leverages the cron job's root execution to gain a root shell. This method is straightforward and requires no additional tools beyond a listener.

Answer

Use the writable script to add a new user with root privileges.

Answer

Replace the script with a symbolic link to /bin/bash.

Answer

Change the script's permissions to SUID and execute it.

Question 13

A penetration tester has obtained a Meterpreter session on a Windows 10 workstation that is a member of an Active Directory domain. The tester runs `getsystem` and receives the error "[-] priv_elevate_getsystem: Operation failed: Access is denied." The session is running as a standard domain user, and UAC is enabled with the default setting. Which technique should the tester use to escalate privileges on this host?

Accepted Answer

Use the `exploit/windows/local/bypassuac` module to bypass User Account Control and then run `getsystem` again.. The correct approach is to bypass UAC first. The `bypassuac` module leverages a known UAC bypass to elevate from a medium-integrity process to a high-integrity one, assuming the user is a local administrator. Once UAC is bypassed, the session can successfully run `getsystem` to obtain SYSTEM privileges. This is a common and reliable technique for default Windows 10 configurations where UAC is enabled but the user is an admin.

Answer

Use the `exploit/windows/local/ms16_075_reflection` module to perform a NTLM reflection attack and obtain SYSTEM privileges.

Answer

Migrate the Meterpreter session to a process running as SYSTEM, such as `lsass.exe`, to inherit its token.

Answer

Use the `exploit/windows/local/ask` module to prompt the user for credentials via a fake UAC dialog and capture the entered password.

Question 14

A penetration tester has gained a foothold on a Windows Server 2016 host in a domain environment and now wants to perform lateral movement to other systems using only native Windows tools to avoid detection. The tester has valid domain user credentials but no administrative rights on the target hosts. Which two techniques can be used to move laterally while remaining stealthy? (Choose two.)

Accepted Answer

Use `WinRM` (Windows Remote Management) with `Invoke-Command` to execute commands on remote hosts.. WinRM and WMI are both native Windows management protocols that allow remote command execution without installing additional services. They can be used with standard domain user credentials if the user has the necessary permissions. These methods are generally stealthier than service-based tools like PsExec because they leverage existing services and generate less obvious artifacts. They are preferred for lateral movement in environments where stealth is paramount.

Answer

Use `RDP` to log into remote hosts and manually execute commands.

Answer

Use `SMBExec` to execute commands via SMB and service creation.

Answer

Use `PsExec` from Sysinternals to execute commands on remote hosts.

Question 15

During a penetration test on a Windows domain, you have compromised a workstation and obtained local administrator privileges. You want to escalate privileges to domain administrator by exploiting Active Directory Certificate Services (AD CS) misconfigurations. Which TWO certificate template settings, if misconfigured, can be exploited to request a certificate that allows domain administrator impersonation? (Choose two.)

Accepted Answer

The template has 'Enrollment Agent' EKU and the CA allows enrollment agents to request certificates on behalf of any user.. Two misconfigurations that directly enable domain admin impersonation are allowing the requester to specify a SAN (ESC1) and having an Enrollment Agent template with unrestricted enrollment agent rights (ESC3). In both cases, an attacker with low privileges can obtain a certificate that authenticates them as a domain administrator. These are well-known AD CS escalation paths that must be identified during a penetration test.

Answer

The template has the 'Enroll' permission granted to a low-privileged group.

Answer

The template has 'Client Authentication' enabled as an extended key usage (EKU).

Answer

The template allows enrolling without manager approval.

Question 16

A penetration tester has compromised a Linux web server and wants to establish persistence by creating a new user account with root privileges. The tester has root access and wants to ensure the account remains hidden from casual inspection by administrators. Which command should the tester use to create a backdoor user with UID 0 and no password prompt?

Accepted Answer

`useradd -o -u 0 -g 0 backdoor`. The `useradd -o -u 0 -g 0 backdoor` command creates a new user with UID 0, effectively granting root privileges, while using the `-o` flag to allow a non-unique UID. This is a stealthy way to maintain access because the account name does not immediately stand out unless the administrator specifically checks for duplicate UIDs. It avoids the need to modify /etc/passwd directly, which could trigger file integrity alerts.

Answer

`echo 'backdoor::0:0:root:/root:/bin/bash' >> /etc/passwd`

Answer

`useradd -m -s /bin/bash -G sudo backdoor`

Answer

`adduser --uid 0 --gid 0 --disabled-password backdoor`

Question 17

A penetration tester has compromised a Windows Server 2019 domain controller and wants to extract credentials from memory to facilitate further lateral movement. The tester has administrative rights on the domain controller but wants to avoid running tools that are commonly flagged by antivirus. Which built-in Windows mechanism can be abused to dump LSASS memory without using third-party tools?

Accepted Answer

Use Task Manager to create a dump file of lsass.exe by right-clicking the process and selecting "Create dump file".. Task Manager's "Create dump file" feature is a built-in Windows capability that can dump the memory of lsass.exe without external tools. Because Task Manager is a trusted Microsoft binary, it is less likely to be flagged by antivirus. The resulting dump can be exfiltrated and parsed offline to extract plaintext passwords, hashes, and Kerberos tickets. This method is particularly effective on domain controllers where LSASS holds highly privileged credentials.

Answer

Use `procdump.exe` from Sysinternals with the `-ma` flag to create a full memory dump of lsass.exe.

Answer

Use `rundll32.exe` with `comsvcs.dll` to call the MiniDump function on the lsass process ID.

Answer

Use Windows Error Reporting (WER) to generate a memory dump of lsass.exe by triggering a crash.

Question 18

A penetration tester has gained a foothold on a Linux server and wants to escalate privileges by exploiting misconfigured file permissions. The tester runs 'find / -perm -o+w -type f 2>/dev/null' and identifies several world-writable files. Which TWO of the following files, if world-writable, would most likely allow immediate privilege escalation to root? (Choose two.)

Accepted Answer

/etc/sudoers. World-writable /etc/passwd allows an attacker to add a UID 0 user or modify the root entry, enabling direct root access. World-writable /etc/sudoers allows an attacker to grant themselves sudo privileges, leading to immediate root escalation. Both are critical misconfigurations that provide a direct path to root. The other files either require additional steps, are not typically world-writable, or do not directly yield elevated privileges.

Answer

/var/log/auth.log

Answer

/etc/crontab

Answer

/etc/shadow

Question 19

During an internal penetration test, you compromise a workstation in the Finance VLAN and want to move laterally to a server in the HR VLAN. The HR VLAN is protected by an internal firewall that blocks most inbound traffic from Finance. You have valid domain credentials for a user who is a member of the HR server's local Administrators group. Which technique is most appropriate to establish a connection to the HR server?

Accepted Answer

Use a reverse shell over an allowed egress port from the HR server.. When an internal firewall blocks inbound connections, a reverse connection from the target to the attacker is often the most reliable lateral movement technique. By using allowed egress ports such as 443, the tester can bypass the inbound filtering and establish a command-and-control channel. Valid credentials enable code execution on the target to initiate the connection.

Answer

Use WinRM to execute commands on the HR server.

Answer

Use PsExec to create a service on the HR server.

Answer

Use SMB named pipes over TCP 445 with the compromised credentials.

Question 20

You have obtained a low-privileged shell on a Windows Server 2016 host. You discover that the AppLocker policy is configured to allow only signed scripts from the IT department. You need to escalate privileges to SYSTEM. Which technique is most likely to succeed?

Accepted Answer

Exploit a vulnerable driver to execute kernel-mode code.. When application whitelisting such as AppLocker restricts user-mode execution, kernel-mode exploits become a viable path. Vulnerable signed drivers can be loaded because they are trusted, and they allow arbitrary code execution in kernel mode. This bypasses AppLocker entirely and enables privilege escalation to SYSTEM. The tester must identify a vulnerable driver present on the system or install one if permitted.

Answer

Use PowerShell to download and execute an unsigned script.

Answer

Leverage a misconfigured service with unquoted service path.

Answer

Inject into a signed process using a reflective DLL.