CPENT Privilege Escalation Lateral Movement And Post Exploitation Practice Test 3 — 15 Questions

Question 1

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Copying an executable to the ADMIN$ share and creating a remote Windows service via the Service Control Manager (SCM).. PsExec connects to the remote ADMIN$ share, uploads a service executable (such as Psexecsvc.exe), and then creates and starts a Windows service using the Service Control Manager (SCM) via RPC.

Answer

Initiating an RDP cliprdr channel file transfer.

Answer

Writing a payload to the target's startup folder via FTP.

Answer

Injecting shellcode into the lsass.exe process over WinRM.

Question 2

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

Accepted Answer

cmdkey /list. The cmdkey utility is a built-in Windows command-line tool that manages stored credentials in the Credential Manager. Running 'cmdkey /list' enumerates all saved credentials (including domain, generic, and certificate-based) for the current user, showing target names and types. This is the standard way a penetration tester checks for cached credentials that could be reused for lateral movement.

Answer

gpresult /r

Answer

net user /domain

Answer

whoami /priv

Question 3

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Accepted Answer

A DNS tunneling tool such as dnscat2 or iodine to encode the archive into DNS query records.. DNS tunneling tools like dnscat2 or iodine encapsulate data inside DNS queries (such as TXT, A, or CNAME records) sent to a controlled nameserver.

Answer

Standard FTP client configured to use port 53 as the control channel.

Answer

Wget command pointing to an external HTTP server listening on port 53.

Answer

Netcat in listening mode on TCP port 53.

Question 4

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Accepted Answer

wmic useraccount get name. Option A, `wmic useraccount get name`, is correct because the WMIC `useraccount` alias queries the Win32_UserAccount WMI class and returns the names of all local user accounts, which is exactly what the tester needs for enumeration. Option C, `net user`, is correct because running it without arguments lists every local user account on the system, a classic built-in method for identifying accounts including privileged ones. Option B, `ipconfig /all`, only displays network adapter configuration such as IP addresses, MAC addresses, and DNS servers, so it does not enumerate users. Option D, `tasklist /v`, lists running processes with verbose details and has nothing to do with local account enumeration. Option E, `systeminfo`, shows OS version, hotfixes, and hardware information but does not list local users or groups.

Answer

ipconfig /all

Answer

tasklist /v

Answer

systeminfo

Question 5

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. Option C is correct because the Nmap NSE script smb2-security-mode queries SMB2 on port 445 and reports the message signing configuration, explicitly showing whether signing is required or not, which directly identifies hosts vulnerable to NTLM relay. Option E is correct because CrackMapExec/NetExec's smb module enumerates SMB hosts across a subnet and reports signing status (e.g., 'signing:False') in its output, making it ideal for quickly sweeping an internal range. Option A (tracert) only maps the network path to a target via ICMP TTL expiry and reveals nothing about SMB configuration. Option B (ping -t) merely sends continuous ICMP echo requests to test reachability and cannot detect SMB signing. Option D (nslookup -type=mx) queries DNS mail exchanger records and is unrelated to SMB security settings.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>

Question 6

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

Accepted Answer

Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.. DCSync is an attack technique that abuses the Directory Replication Service (DRS) remote protocol to simulate a domain controller and request password data (hashes) for user accounts from another domain controller.

Answer

Kerberoasting against computer accounts.

Answer

Performing an AS-REP Roasting attack on users with Kerberos pre-authentication disabled.

Answer

Running Responder on the local subnet to capture NTLMv2 hashes.

Question 7

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Accepted Answer

/etc/passwd. Option A, /etc/passwd, is correct because it enumerates local user accounts (UIDs, GIDs, home directories, and login shells), which is essential for identifying valid usernames for credential attacks or privilege-escalation targets. Option C, ~/.ssh/, is correct because this directory typically holds private keys (id_rsa), authorized_keys, and known_hosts, which can yield reusable credentials for lateral movement or persistence. Option D, /etc/crontab, is correct because it defines system-wide scheduled tasks, revealing scripts or binaries that may run as root and can be abused for privilege escalation. Option B, /proc/version, is not among the selected answers because it only discloses kernel and compiler version information, which is useful for exploit matching but not for locating configuration data, credentials, or cron jobs. Option E, /var/log/syslog, is not among the selected answers because it contains system event logs rather than the sensitive configuration files, credential stores, or scheduled-task definitions the question asks for.

Answer

/proc/version

Answer

/var/log/syslog

Question 8

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Accepted Answer

scp. Option A (scp) is correct because it runs over SSH and encrypts the entire file transfer session, making it a standard encrypted exfiltration channel out of the box. Option B (curl using HTTPS) is correct because HTTPS wraps HTTP in TLS, so uploading the archive to an HTTPS endpoint encrypts the data in transit without additional tooling. Option C (sftp) is correct because it is the SSH File Transfer Protocol, tunneling file operations through SSH for encryption by default. Option D (nc/Netcat) is not correct because it transmits raw data with no built-in encryption, so the archive would cross the network in cleartext. Option E (ftp) is not correct because standard FTP sends credentials and data unencrypted, requiring FTPS or SFTP for any confidentiality.

Answer

nc (Netcat)

Answer

ftp

Question 9

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

Accepted Answer

Adding a controlled user account to the Domain Admins or Enterprise Admins group.. Option B is correct because adding a controlled account to Domain Admins or Enterprise Admins grants it persistent, high-privilege domain-wide access that survives reboots and is a classic AD persistence technique (e.g., via net group "Domain Admins" user /add /domain or Add-ADGroupMember). Option E is correct because injecting a privileged SID (such as the Domain Admins or Enterprise Admins SID) into the sIDHistory attribute of a controlled account lets that account inherit the privileges of the injected SID during token creation, providing stealthy persistence that is not visible through normal group membership. Option A is not an AD persistence mechanism; disabling Defender real-time monitoring is a host-level defense evasion action that does not survive as a directory-based persistence foothold. Option C is a local scheduled task, which is host persistence rather than an Active Directory mechanism. Option D is merely a local ARP cache flush, a network troubleshooting action with no persistence value.

Answer

Disabling Windows Defender real-time monitoring via PowerShell.

Answer

Configuring a local Windows scheduled task to run netsh.

Answer

Flushing the local ARP cache on the workstation.

Question 10

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. Option D, `sudo -l`, is correct because it lists the sudo privileges of the invoking user, showing exactly which commands they may run as root or other users (including NOPASSWD entries and wildcard rules) — the primary way to spot exploitable sudo rights. Option E, `cat /etc/sudoers`, is correct because the main sudoers policy file defines user/group specifications, command aliases, and defaults; reading it (if permissions allow) reveals misconfigurations such as overly broad ALL=(ALL) ALL grants. Option C, `ls -la /etc/sudoers.d/`, is correct because sudoers drop-in files in /etc/sudoers.d/ are included via #includedir and often contain custom privilege rules that are easy to overlook; listing them identifies additional policy files to inspect. Option A, `arp -a`, is not relevant because it only displays the ARP cache for network mapping, not sudo configuration. Option B, `uname -r`, is not relevant because it only prints the kernel release version, which does not reveal sudo privilege settings.

Answer

arp -a

Answer

uname -r

Question 11

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

Accepted Answer

wevtutil cl . Option A, `wevtutil cl `, is correct because wevtutil is the built-in Windows command-line utility for managing event logs, and the `cl` (clear-log) subcommand clears the specified log (e.g., `wevtutil cl Security`), directly serving the goal of erasing log evidence. Option E, `Clear-EventLog -LogName `, is correct because it is the native PowerShell cmdlet that clears a specified event log on the local or remote computer, providing the same log-clearing capability through PowerShell. Option B, `netsh advfirewall reset`, is incorrect because it restores Windows Firewall configuration to default, which is unrelated to event log management. Option C, `taskkill /f /im lsass.exe`, is incorrect because it force-terminates the LSASS process, which would crash the system and does not manage event logs. Option D, `ipconfig /flushdns`, is incorrect because it only clears the DNS resolver cache and has no effect on Windows Event Logs.

Answer

netsh advfirewall reset

Answer

taskkill /f /im lsass.exe

Answer

ipconfig /flushdns

Question 12

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

Accepted Answer

WinRM (Windows Remote Management). WinRM (B) is correct because it is a native Windows remote management service built on WS-Management and SOAP over HTTP/HTTPS (ports 5985/5986), allowing an operator to execute commands remotely via tools like winrs or PowerShell remoting without installing any agent. RDP (D) is correct because it is a built-in Windows remote desktop protocol (TCP 3389) that provides interactive graphical access to a remote host, enabling lateral movement using only native OS functionality. SMB/RPC via the Service Control Manager and ADMIN$ share (E) is correct because native Windows administrative tooling such as PsExec-style techniques use SMB (TCP 445) to copy a service binary to ADMIN$ and RPC to the Service Control Manager to start it remotely, requiring no third-party agent. FTP (A) is not correct because it is a file-transfer protocol, not a remote execution or administrative control mechanism, and SNMP (C) is not correct because it is a monitoring/management protocol for querying device state, not a native Windows remote command-execution channel.

Answer

FTP (File Transfer Protocol)

Answer

SNMP (Simple Network Management Protocol)

Question 13

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command. By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.

Answer

Append a new user account to the /etc/passwd file by leveraging a kernel exploit

Answer

Modify the /etc/sudoers file directly using a buffer overflow vulnerability

Answer

Inject shellcode into the target binary's memory space using GDB while running under sudo

Question 14

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the built-in command rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:	emp\lsass.dmp full. The comsvcs.dll MiniDump export can be invoked via rundll32.exe to dump the memory of any process by PID, including lsass.exe, producing a full memory dump for offline credential extraction. Because rundll32 and comsvcs.dll are signed Microsoft binaries, this technique (often called 'comsvcs MiniDump' or 'rundll32 LSASS dump') is a living-off-the-land method that evades many application-whitelisting controls.

Answer

Invoke PowerShell with the Get-WmiObject Win32_Process cmdlet specifying the LSASS process handle

Answer

Execute the native net accounts command with the /dump flag to extract password hashes from the SAM registry hive

Answer

Use the tasklist /m lsass.exe command to output the active directory database credentials to the console

Question 15

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

Accepted Answer

winrs -r:TargetServer -u:Administrator -p:Password cmd.exe. The winrs utility is the built-in Windows Remote Shell client that uses WinRM (Windows Remote Management) over HTTP (port 5985) or HTTPS (port 5986). It allows an attacker with valid credentials to execute commands interactively on a remote system when SMB is blocked but WinRM is open. The syntax '-r:TargetServer' specifies the remote host, and the command to run (e.g., cmd.exe) is provided at the end.

Answer

rpcclient -U Administrator TargetServer

Answer

nbtstat -A TargetServer -winrm

Answer

mstv -target:TargetServer -port:5985