CPENT Privilege Escalation Lateral Movement And Post Exploitation Practice Test 2 — 15 Questions

Question 1

A penetration tester has compromised a Linux web server and wants to establish persistence by creating a new user account with root privileges. The tester has root access and wants to ensure the account remains hidden from casual inspection by administrators. Which command should the tester use to create a backdoor user with UID 0 and no password prompt?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

`useradd -o -u 0 -g 0 backdoor`. The `useradd -o -u 0 -g 0 backdoor` command creates a new user with UID 0, effectively granting root privileges, while using the `-o` flag to allow a non-unique UID. This is a stealthy way to maintain access because the account name does not immediately stand out unless the administrator specifically checks for duplicate UIDs. It avoids the need to modify /etc/passwd directly, which could trigger file integrity alerts.

Answer

`echo 'backdoor::0:0:root:/root:/bin/bash' >> /etc/passwd`

Answer

`useradd -m -s /bin/bash -G sudo backdoor`

Answer

`adduser --uid 0 --gid 0 --disabled-password backdoor`

Question 2

A penetration tester has compromised a Windows Server 2019 domain controller and wants to extract credentials from memory to facilitate further lateral movement. The tester has administrative rights on the domain controller but wants to avoid running tools that are commonly flagged by antivirus. Which built-in Windows mechanism can be abused to dump LSASS memory without using third-party tools?

Accepted Answer

Use Task Manager to create a dump file of lsass.exe by right-clicking the process and selecting "Create dump file".. Task Manager's "Create dump file" feature is a built-in Windows capability that can dump the memory of lsass.exe without external tools. Because Task Manager is a trusted Microsoft binary, it is less likely to be flagged by antivirus. The resulting dump can be exfiltrated and parsed offline to extract plaintext passwords, hashes, and Kerberos tickets. This method is particularly effective on domain controllers where LSASS holds highly privileged credentials.

Answer

Use `procdump.exe` from Sysinternals with the `-ma` flag to create a full memory dump of lsass.exe.

Answer

Use `rundll32.exe` with `comsvcs.dll` to call the MiniDump function on the lsass process ID.

Answer

Use Windows Error Reporting (WER) to generate a memory dump of lsass.exe by triggering a crash.

Question 3

A penetration tester has gained a foothold on a Linux server and wants to escalate privileges by exploiting misconfigured file permissions. The tester runs 'find / -perm -o+w -type f 2>/dev/null' and identifies several world-writable files. Which TWO of the following files, if world-writable, would most likely allow immediate privilege escalation to root? (Choose two.)

Accepted Answer

/etc/sudoers. World-writable /etc/passwd allows an attacker to add a UID 0 user or modify the root entry, enabling direct root access. World-writable /etc/sudoers allows an attacker to grant themselves sudo privileges, leading to immediate root escalation. Both are critical misconfigurations that provide a direct path to root. The other files either require additional steps, are not typically world-writable, or do not directly yield elevated privileges.

Answer

/var/log/auth.log

Answer

/etc/crontab

Answer

/etc/shadow

Question 4

During an internal penetration test, you compromise a workstation in the Finance VLAN and want to move laterally to a server in the HR VLAN. The HR VLAN is protected by an internal firewall that blocks most inbound traffic from Finance. You have valid domain credentials for a user who is a member of the HR server's local Administrators group. Which technique is most appropriate to establish a connection to the HR server?

Accepted Answer

Use a reverse shell over an allowed egress port from the HR server.. When an internal firewall blocks inbound connections, a reverse connection from the target to the attacker is often the most reliable lateral movement technique. By using allowed egress ports such as 443, the tester can bypass the inbound filtering and establish a command-and-control channel. Valid credentials enable code execution on the target to initiate the connection.

Answer

Use WinRM to execute commands on the HR server.

Answer

Use PsExec to create a service on the HR server.

Answer

Use SMB named pipes over TCP 445 with the compromised credentials.

Question 5

You have obtained a low-privileged shell on a Windows Server 2016 host. You discover that the AppLocker policy is configured to allow only signed scripts from the IT department. You need to escalate privileges to SYSTEM. Which technique is most likely to succeed?

Accepted Answer

Exploit a vulnerable driver to execute kernel-mode code.. When application whitelisting such as AppLocker restricts user-mode execution, kernel-mode exploits become a viable path. Vulnerable signed drivers can be loaded because they are trusted, and they allow arbitrary code execution in kernel mode. This bypasses AppLocker entirely and enables privilege escalation to SYSTEM. The tester must identify a vulnerable driver present on the system or install one if permitted.

Answer

Use PowerShell to download and execute an unsigned script.

Answer

Leverage a misconfigured service with unquoted service path.

Answer

Inject into a signed process using a reflective DLL.

Question 6

A penetration tester has gained a foothold on a Linux web server and wants to escalate privileges by exploiting misconfigured SUID binaries. The tester runs a find command and identifies several SUID binaries. Which TWO of the following SUID binaries are most likely to allow privilege escalation to root? (Choose two.)

Accepted Answer

/usr/bin/find. SUID binaries that can execute commands or spawn shells are prime targets for privilege escalation. find and vim both allow command execution when running with SUID root privileges, enabling a root shell. Other common SUID escalation binaries include bash, less, more, and cp, but these were not listed. The tester should always check GTFOBins for known exploitation methods.

Answer

/bin/ls

Answer

/usr/bin/nmap

Answer

/usr/bin/passwd

Question 7

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

Accepted Answer

It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.. The SUID bit causes /bin/ping to execute with the effective UID of its owner (root) rather than the invoking user, which is why unprivileged users can open raw ICMP sockets. If the binary contains a vulnerability — buffer overflow, command injection, or an unsafe system()/exec() call — or if it can be coerced into spawning a shell, the attacker inherits root privileges, making it a classic local privilege escalation vector.

Answer

It allows remote attackers to execute system calls over ICMP tunneling.

Answer

Any local user can execute commands as root by passing malicious arguments to the SUID binary.

Answer

The system is immune to local privilege escalation because SUID is disabled by SELinux.

Question 8

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

Accepted Answer

Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.. With no_root_squash enabled, the NFS server maps the root user on the client to root on the server, so a client that mounts the share as root can create files owned by root with the SUID bit set. Copying /bin/bash to the share and running chmod +s on it produces a root-owned SUID shell that, when executed on the target, grants root privileges. This is the classic no_root_squash privilege escalation.

Answer

Modify the /etc/exports file on the remote target directly via standard FTP.

Answer

Mount the NFS share using standard user privileges and create a standard user shell script.

Answer

Log into the NFS server directly via SSH using the exported share credentials.

Question 9

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

Accepted Answer

Generate a malicious MSI file using msfvenom and execute it using msiexec /quiet /qn /i exploit.msi.. AlwaysInstallElevated allows MSI packages to be installed with elevated (NT AUTHORITY\SYSTEM) privileges. The tester can generate a malicious MSI file using msfvenom and install it silently.

Answer

Run a batch script that directly modifies the SAM database registry hive.

Answer

Execute a local exploit targeting the Print Spooler service via named pipes.

Answer

Extract plaintext credentials from the lsass.exe process memory.

Question 10

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

Accepted Answer

The NTLM hash (or AES keys) of the krbtgt service account.. A Golden Ticket is forged using the KRBTGT account's NTLM hash (or AES keys), which allows the attacker to generate valid Kerberos Ticket Granting Tickets (TGTs) for any user.

Answer

The krbtgt account's public SSH key stored in Active Directory.

Answer

The global catalog server IP address and LDAP bind credentials.

Answer

The Domain Administrator's plaintext password.

Question 11

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

Accepted Answer

Potato family exploits (e.g., PrintSpoofer, RoguePotato) that abuse token impersonation via named pipes.. SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege allow an attacker to impersonate tokens. Tools like Rotten Potato, RoguePotato, or PrintSpoofer leverage this to escalate to NT AUTHORITY\SYSTEM.

Answer

Mimikatz credential dumper via direct LSASS memory injection.

Answer

PowerView domain enumeration modules.

Answer

Windows Subsystem for Linux (WSL) container breakouts.

Question 12

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

Accepted Answer

Insecure Scheduled Task Permissions / Writable Task Executable. If a scheduled task runs as SYSTEM or an admin, and the underlying script or binary is writable by low-privileged users, it represents an insecure file permissions vulnerability leading to privilege escalation when the task triggers.

Answer

Unquoted service path exploitation involving spaces in service binary names.

Answer

DLL Hijacking via PATH environment variable manipulation.

Answer

Kerberoasting against domain service principal names.

Question 13

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

Accepted Answer

Compiling and loading a malicious Loadable Kernel Module (LKM) rootkit.. Loadable Kernel Modules (LKMs) allow attackers to run code in kernel space, hide processes, files, and network connections, and persist across reboots if loaded at boot time.

Answer

Modifying the SSH authorized_keys file for the root user.

Answer

Creating a systemd service unit file that executes a reverse shell.

Answer

Placing a persistent cron job in /etc/cron.d/

Question 14

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

Accepted Answer

Invoke-Command -ComputerName TargetHost -ScriptBlock { ... }. Invoke-Command allows running script blocks or scripts on local or remote computers using WinRM.

Answer

Get-WmiObject -ComputerName TargetHost -Class Win32_Process

Answer

Start-Process -FilePath "powershell.exe" -Credential ...

Answer

Enter-PSSession -ComputerName TargetHost

Question 15

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

Accepted Answer

Run 'docker run -v /:/hostfs --rm -it alpine chroot /hostfs' to mount the host root directory inside a new container.. Access to /var/run/docker.sock allows the container to interact with the host's Docker daemon. The tester can spin up a new container that mounts the host's root filesystem (/) and provides a chroot or direct execution shell on the host.

Answer

Modify /etc/passwd inside the container to add a root user.

Answer

Send a SIGKILL signal to the docker daemon process via kill -9 1.

Answer

Execute 'sudo su' inside the container environment.