CPENT Privilege Escalation Lateral Movement And Post Exploitation Practice Test 2 — 15 Questions

Question 1

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A DNS tunneling tool such as dnscat2 or iodine to encode the archive into DNS query records.. DNS tunneling tools like dnscat2 or iodine encapsulate data inside DNS queries (such as TXT, A, or CNAME records) sent to a controlled nameserver.

Answer

Standard FTP client configured to use port 53 as the control channel.

Answer

Wget command pointing to an external HTTP server listening on port 53.

Answer

Netcat in listening mode on TCP port 53.

Question 2

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Accepted Answer

wmic useraccount get name. net user and wmic useraccount (or Get-LocalUser in PowerShell) are standard built-in mechanisms to list local users on Windows.

Answer

ipconfig /all

Answer

tasklist /v

Answer

systeminfo

Question 3

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. CrackMapExec (or NetExec) and nmap with the smb2-security-mode script are standard tools used to check SMB signing status across targets.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>

Question 4

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

Accepted Answer

Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.. DCSync is an attack technique that abuses the Directory Replication Service (DRS) remote protocol to simulate a domain controller and request password data (hashes) for user accounts from another domain controller.

Answer

Kerberoasting against computer accounts.

Answer

Performing an AS-REP Roasting attack on users with Kerberos pre-authentication disabled.

Answer

Running Responder on the local subnet to capture NTLMv2 hashes.

Question 5

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Accepted Answer

/etc/passwd. /etc/passwd, /etc/crontab, and ~/.ssh/ are key locations for user accounts, scheduled tasks, and SSH keys respectively.

Answer

/proc/version

Answer

/var/log/syslog

Question 6

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Accepted Answer

scp. scp, sftp, and curl (using HTTPS) or rsync over ssh provide encrypted file transfers. Standard nc and ftp are unencrypted.

Answer

nc (Netcat)

Answer

ftp

Question 7

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

Accepted Answer

Adding a controlled user account to the Domain Admins or Enterprise Admins group.. SID History injection and adding members to privileged groups (like Administrators or Domain Admins) are common AD persistence methods.

Answer

Disabling Windows Defender real-time monitoring via PowerShell.

Answer

Configuring a local Windows scheduled task to run netsh.

Answer

Flushing the local ARP cache on the workstation.

Question 8

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. sudo -l, checking /etc/sudoers, and inspecting files within /etc/sudoers.d/ are essential checks for sudo misconfigurations.

Answer

arp -a

Answer

uname -r

Question 9

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

Accepted Answer

wevtutil cl <LogName>. wevtutil and PowerShell's Remove-EventLog or Clear-EventLog are standard utilities for managing Windows event logs.

Answer

netsh advfirewall reset

Answer

taskkill /f /im lsass.exe

Answer

ipconfig /flushdns

Question 10

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

Accepted Answer

WinRM (Windows Remote Management). WinRM, SMB (via PsExec/Services), and RDP are native Windows protocols commonly used for lateral movement.

Answer

FTP (File Transfer Protocol)

Answer

SNMP (Simple Network Management Protocol)

Question 11

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command. By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.

Answer

Append a new user account to the /etc/passwd file by leveraging a kernel exploit

Answer

Modify the /etc/sudoers file directly using a buffer overflow vulnerability

Answer

Inject shellcode into the target binary's memory space using GDB while running under sudo

Question 12

An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?

Accepted Answer

Create a __EventFilter monitoring Win32_OperatingSystem startup, a CommandLineEventConsumer executing the payload, and a __FilterToConsumerBinding object. WMI persistence involves creating an __EventFilter to trigger on system startup, an __EventConsumer (specifically CommandLineEventConsumer) to execute the payload, and a __FilterToConsumerBinding to link the two objects together.

Answer

Inject a DLL into winlogon.exe and configure a Group Policy Object to execute the payload upon user logon

Answer

Configure a new registry run key using reg add pointing to a VBScript payload in the Startup folder

Answer

Use PowerShell to create an EventFilter looking for Win32_NTLogEvent and a ScriptFileEventConsumer pointing to a scheduled task

Question 13

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

Accepted Answer

Run the built-in command rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:	emp\lsass.dmp full. Comsvcs.dll exports an undocumented function (MiniDumpW) that can be invoked via rundll32.exe to create a minidump of the lsass.exe process, a common Living off the Land technique used by attackers to bypass basic detection mechanisms.

Answer

Invoke PowerShell with the Get-WmiObject Win32_Process cmdlet specifying the LSASS process handle

Answer

Execute the native net accounts command with the /dump flag to extract password hashes from the SAM registry hive

Answer

Use the tasklist /m lsass.exe command to output the active directory database credentials to the console

Question 14

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

Accepted Answer

find / -type f -perm -4000 2>/dev/null. The command find / -perm -4000 2>/dev/null searches the entire filesystem for files with the SUID bit set (-4000) and redirects standard error to /dev/null to keep the output clean.

Answer

grep -r 'SUID' /etc/permissions.conf

Answer

getcap -r / 2>/dev/null

Answer

find / -name suid -exec ls -la {} \;

Question 15

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

Accepted Answer

winrs -r:TargetServer -u:Administrator -p:Password cmd.exe. WinRM uses port 5985 for HTTP (and 5986 for HTTPS). The native Windows tool designed to interact with remote systems via WinRM is Winrs (Windows Remote Shell) or PowerShell Remoting (Enter-PSSession).

Answer

rpcclient -U Administrator TargetServer

Answer

nbtstat -A TargetServer -winrm

Answer

mstv -target:TargetServer -port:5985