CPENT Privilege Escalation Lateral Movement And Post Exploitation — Timed 20 Questions

Question 1

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

Accepted Answer

It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.. While ping traditionally required SUID root to open raw sockets, modern Linux kernels support CAP_NET_RAW capability. If a misconfigured SUID binary allows arbitrary command execution, it leads to privilege escalation, but standard SUID ping is typically safe unless a vulnerability exists in that specific version. Let's frame it around exploiting a known SUID binary vulnerability or misconfigured SUID finder.

Answer

It allows remote attackers to execute system calls over ICMP tunneling.

Answer

Any local user can execute commands as root by passing malicious arguments to the SUID binary.

Answer

The system is immune to local privilege escalation because SUID is disabled by SELinux.

Question 2

During an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?

Accepted Answer

Over-Pass-the-Hash, which generates a full Kerberos ticket using extracted user AES keys instead of NTLM hashes.. When Credential Guard is enabled, direct reading of LSASS memory is blocked. However, techniques like throwing tokens or using restricted administrator access tokens, or abusing specific COM/RPC objects, are alternative vectors, though Pass-the-Ticket via Kerberos delegation or abusing DPAPI are standard workarounds. Specifically, forcing NTLM authentication or abusing constrained delegation are preferred. Wait, the question asks for bypassing Credential Guard or interacting with LSASS - actually, direct LSASS dumping fails, but token impersonation or abusing DCShadow/DCSync if domain admin is available works. For local Credential Guard bypass, Over-Pass-the-Hash (generating Kerberos tickets via AES keys) works if AES keys are extracted from NTDS.dit or kerberos traffic.

Answer

Running mimikatz with the 'privilege::debug' command escalated via a service account.

Answer

Patching the lsass.exe executable on disk to disable security checks.

Answer

Injecting shellcode directly into the winlogon.exe process memory space.

Question 3

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

Accepted Answer

Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.. Because no_root_squash allows root access from remote clients to map to root on the NFS server, the attacker must mount the share as local root (using sudo) and compile a SUID binary or copy /bin/bash with the SUID bit set.

Answer

Modify the /etc/exports file on the remote target directly via standard FTP.

Answer

Mount the NFS share using standard user privileges and create a standard user shell script.

Answer

Log into the NFS server directly via SSH using the exported share credentials.

Question 4

An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?

Accepted Answer

/etc/cron.d/custom_persistence with the format '* * * * * root /bin/nc ...'. Placing a script in /etc/cron.d/ or directly in the root user's crontab via crontab -e (stored in /var/spool/cron/crontabs/root) achieves persistence. Alternatively, /etc/cron.5mins/ if configured, but /etc/cron.d/ is standard.

Answer

~/.bashrc of the current low-privileged user.

Answer

/etc/init.d/rc.local execution hook.

Answer

/var/www/html/backdoor.php

Question 5

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

Accepted Answer

Generate a malicious MSI file using msfvenom and execute it using msiexec /quiet /qn /i exploit.msi.. AlwaysInstallElevated allows MSI packages to be installed with elevated (NT AUTHORITY\SYSTEM) privileges. The tester can generate a malicious MSI file using msfvenom and install it silently.

Answer

Run a batch script that directly modifies the SAM database registry hive.

Answer

Execute a local exploit targeting the Print Spooler service via named pipes.

Answer

Extract plaintext credentials from the lsass.exe process memory.

Question 6

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

Accepted Answer

The NTLM hash (or AES keys) of the krbtgt service account.. A Golden Ticket is forged using the KRBTGT account's NTLM hash (or AES keys), which allows the attacker to generate valid Kerberos Ticket Granting Tickets (TGTs) for any user.

Answer

The krbtgt account's public SSH key stored in Active Directory.

Answer

The global catalog server IP address and LDAP bind credentials.

Answer

The Domain Administrator's plaintext password.

Question 7

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

Accepted Answer

TCP port 135 (RPC Endpoint Mapper). WMI relies on DCOM, which uses RPC. The initial connection to the RPC Endpoint Mapper is made on TCP port 135, after which dynamic high ports are negotiated.

Answer

UDP port 53 (DNS)

Answer

TCP port 445 (SMB)

Answer

TCP port 3389 (RDP)

Question 8

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

Accepted Answer

Get-WmiObject win32_service | select Name, PathName | where { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }. Unquoted service paths can be queried via WMI or PowerShell without admin rights. The Get-WmiObject command querying Win32_Service can filter for paths containing spaces and not enclosed in quotes.

Answer

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command

Answer

sc query state= all | findstr /i "binpath"

Answer

Get-Service | Where-Object { $_.Status -eq 'Running' -and $_.Path -notmatch '"' }

Question 9

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

Accepted Answer

Potato family exploits (e.g., PrintSpoofer, RoguePotato) that abuse token impersonation via named pipes.. SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege allow an attacker to impersonate tokens. Tools like Rotten Potato, RoguePotato, or PrintSpoofer leverage this to escalate to NT AUTHORITY\SYSTEM.

Answer

Mimikatz credential dumper via direct LSASS memory injection.

Answer

PowerView domain enumeration modules.

Answer

Windows Subsystem for Linux (WSL) container breakouts.

Question 10

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

Accepted Answer

Insecure Scheduled Task Permissions / Writable Task Executable. If a scheduled task runs as SYSTEM or an admin, and the underlying script or binary is writable by low-privileged users, it represents an insecure file permissions vulnerability leading to privilege escalation when the task triggers.

Answer

Unquoted service path exploitation involving spaces in service binary names.

Answer

DLL Hijacking via PATH environment variable manipulation.

Answer

Kerberoasting against domain service principal names.

Question 11

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

Accepted Answer

Compiling and loading a malicious Loadable Kernel Module (LKM) rootkit.. Loadable Kernel Modules (LKMs) allow attackers to run code in kernel space, hide processes, files, and network connections, and persist across reboots if loaded at boot time.

Answer

Modifying the SSH authorized_keys file for the root user.

Answer

Creating a systemd service unit file that executes a reverse shell.

Answer

Placing a persistent cron job in /etc/cron.d/

Question 12

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

Accepted Answer

Invoke-Command -ComputerName TargetHost -ScriptBlock { ... }. Invoke-Command allows running script blocks or scripts on local or remote computers using WinRM.

Answer

Get-WmiObject -ComputerName TargetHost -Class Win32_Process

Answer

Start-Process -FilePath "powershell.exe" -Credential ...

Answer

Enter-PSSession -ComputerName TargetHost

Question 13

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

Accepted Answer

Run 'docker run -v /:/hostfs --rm -it alpine chroot /hostfs' to mount the host root directory inside a new container.. Access to /var/run/docker.sock allows the container to interact with the host's Docker daemon. The tester can spin up a new container that mounts the host's root filesystem (/) and provides a chroot or direct execution shell on the host.

Answer

Modify /etc/passwd inside the container to add a root user.

Answer

Send a SIGKILL signal to the docker daemon process via kill -9 1.

Answer

Execute 'sudo su' inside the container environment.

Question 14

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

Accepted Answer

Copying an executable to the ADMIN$ share and creating a remote Windows service via the Service Control Manager (SCM).. PsExec connects to the remote ADMIN$ share, uploads a service executable (such as Psexecsvc.exe), and then creates and starts a Windows service using the Service Control Manager (SCM) via RPC.

Answer

Initiating an RDP cliprdr channel file transfer.

Answer

Writing a payload to the target's startup folder via FTP.

Answer

Injecting shellcode into the lsass.exe process over WinRM.

Question 15

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

Accepted Answer

cmdkey /list. cmdkey /list displays a list of stored user names and credentials saved in the Windows Credential Manager.

Answer

gpresult /r

Answer

net user /domain

Answer

whoami /priv

Question 16

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Accepted Answer

A DNS tunneling tool such as dnscat2 or iodine to encode the archive into DNS query records.. DNS tunneling tools like dnscat2 or iodine encapsulate data inside DNS queries (such as TXT, A, or CNAME records) sent to a controlled nameserver.

Answer

Standard FTP client configured to use port 53 as the control channel.

Answer

Wget command pointing to an external HTTP server listening on port 53.

Answer

Netcat in listening mode on TCP port 53.

Question 17

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Accepted Answer

wmic useraccount get name. net user and wmic useraccount (or Get-LocalUser in PowerShell) are standard built-in mechanisms to list local users on Windows.

Answer

ipconfig /all

Answer

tasklist /v

Answer

systeminfo

Question 18

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. CrackMapExec (or NetExec) and nmap with the smb2-security-mode script are standard tools used to check SMB signing status across targets.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>

Question 19

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

Accepted Answer

Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.. DCSync is an attack technique that abuses the Directory Replication Service (DRS) remote protocol to simulate a domain controller and request password data (hashes) for user accounts from another domain controller.

Answer

Kerberoasting against computer accounts.

Answer

Performing an AS-REP Roasting attack on users with Kerberos pre-authentication disabled.

Answer

Running Responder on the local subnet to capture NTLMv2 hashes.

Question 20

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Accepted Answer

/etc/passwd. /etc/passwd, /etc/crontab, and ~/.ssh/ are key locations for user accounts, scheduled tasks, and SSH keys respectively.

Answer

/proc/version

Answer

/var/log/syslog