CPENT Privilege Escalation Lateral Movement And Post Exploitation Practice Test 3 — 15 Questions

Question 1

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker. DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.

Answer

Use standard FTP data channels over ephemeral ports to push archives to an external staging server

Answer

Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets

Answer

Establish an HTTPS connection to an external IP address using port 443

Question 2

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

Accepted Answer

uname -r. The command uname -r displays the specific kernel release version, which is critical for identifying applicable kernel-level vulnerabilities.

Answer

whoami

Answer

env

Answer

cat /etc/issue

Question 3

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

Accepted Answer

The target account's NTLM password hash must be known to the attacker. Pass-the-Hash requires the target account's NTLM hash (or LM hash) and requires the target machine to either have UAC network restrictions mitigated (LocalAccountTokenFilterPolicy set) when using local accounts, or to target domain accounts where Kerberos is not strictly enforced over NTLM.

Answer

SMB signing must be globally disabled across the entire Active Directory forest

Answer

The target user account must have Kerberos pre-authentication disabled

Answer

The local Windows Firewall on the domain controller must be completely disabled

Question 4

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

Accepted Answer

Create a malicious script named after the command and prepend its directory to the PATH.. If a SUID binary calls a command without an absolute path, you can modify the PATH environment variable to point to a malicious version of that command.

Answer

Modify /etc/ld.so.preload to inject a malicious library.

Answer

Exploit a buffer overflow in the binary using a NOP sled.

Answer

Use the --inject flag on the binary to force command execution.

Answer

null

Question 5

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

Accepted Answer

Adding a scheduled task or cron job in /etc/crontab or user crontabs to periodically execute a reverse shell. Linux persistence can be achieved via Cron jobs (scheduled tasks), modifying initialization scripts like /etc/rc.local or systemd service units, and adding SSH authorized keys to user profiles.

Answer

Modifying the Windows Registry Run key using winereg

Answer

Injecting shellcode into the BIOS/UEFI firmware via flashrom without user interaction

Question 6

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

Accepted Answer

Use PrintSpoofer to trigger a pipe connection from the spooler service.. The PrintSpoofer or JuicyPotato exploit tools leverage SeImpersonatePrivilege to impersonate the SYSTEM account, allowing for code execution.

Answer

Use GPP-decrypt to extract credentials from cached XML files.

Answer

Run Invoke-TokenManipulation to steal a process token.

Answer

Execute reg add to modify the ImagePath of a system service.

Question 7

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Accepted Answer

The target must have NTLM authentication enabled in the local security policy.. Pass-the-Hash requires that the target machine allows NTLM authentication and the user has not disabled it or enforced Kerberos-only authentication (Restricted Admin mode).

Answer

The target must have the Remote Registry service disabled.

Answer

The target must be running Windows 10 or higher.

Answer

You must have the plaintext password of the target account.

Question 8

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

Accepted Answer

Use PsExec or WinRM with the valid credentials to execute commands interactively on domain-joined member servers. With Domain Administrator credentials, an attacker can generate a Golden Ticket using Mimikatz (requiring the krbtgt hash) or perform a Session Hijacking / PsExec execution to access remote systems. Alternatively, creating a scheduled task or using WinRM are also valid options. A Golden Ticket requires the krbtgt hash, which is obtainable via DCSync, but interactive logon and PsExec/WinRM directly utilize the DA credentials.

Answer

Modify the Windows Boot Configuration Data (BCD) store to disable PatchGuard on all domain controllers

Answer

Change the password of the local Administrator account on a single workstation via SAM-R or RPC

Answer

Inject shellcode directly into the Active Directory database file (ntds.dit) while the database is offline

Question 9

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

Accepted Answer

Adding an entry to the Run registry key in the current user hive.. The 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key is a common location for persistence that triggers when the current user logs in.

Answer

Creating a hidden scheduled task.

Answer

Modifying the default shell via Winlogon.

Answer

Replacing the utilman.exe binary with cmd.exe.

Question 10

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

Accepted Answer

Chisel to establish a tunnel over HTTP.. Chisel is a fast TCP/UDP tunnel over HTTP that is ideal for bypassing firewalls by masquerading traffic as web requests.

Answer

ftp to a remote server.

Answer

scp using a custom port.

Answer

netcat with a simple pipe.

Question 11

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

Accepted Answer

Mimikatz. Mimikatz is the standard tool used to parse LSASS dumps and extract authentication secrets.

Answer

Wireshark

Answer

Hashcat

Answer

Responder

Question 12

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

Accepted Answer

It will alert the Security Operations Center (SOC) due to signature-based detection.. Windows Defender (and other EDRs) have specific signatures for Mimikatz and will trigger an alert or quarantine the file immediately upon execution.

Answer

It will cause the system to BSOD.

Answer

It will corrupt the LSASS process.

Answer

It requires a reboot to function.

Question 13

You have identified an unquoted service path vulnerability on a Windows server. What is the correct remediation path to escalate privileges?

Accepted Answer

Create a malicious executable matching a component of the unquoted path.. By placing a malicious executable in the folder corresponding to the unquoted path (e.g., C:\Program.exe), the service manager will execute it instead of the intended binary.

Answer

Replace the existing service binary.

Answer

Restart the service with elevated arguments.

Answer

Modify the service registry key to add quotes.

Question 14

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Accepted Answer

Using PowerShell to download and execute a script in memory.. LotL involves using pre-installed system tools (like PowerShell or WMI) to conduct malicious activities, minimizing the need for custom malware.

Answer

Installing a rootkit driver.

Answer

Deploying a custom C++ backdoor.

Answer

Using a known Metasploit payload.

Question 15

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

Accepted Answer

.kirbi. Mimikatz uses the .kirbi file extension to save exported Kerberos tickets.

Answer

.ntds

Answer

.sam

Answer

.pfx