GPEN Practice Test 6 — 10 Questions

Question 1

During an internal penetration test, you capture an NTLMv2 hash challenge-response pair from a network segment. You want to crack the user's password using Hashcat. Which hashcat attack mode and hash format identifier should you use to crack this specific challenge-response pair efficiently on a modern GPU?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mode 5600, which targets NetNTLMv2 hashes captured during network authentication events or LLMNR/NBT-NS spoofing attacks.. Hashcat utilizes mode 5600 specifically for NetNTLMv2 hashes, which allows leveraging high-speed GPU acceleration to perform dictionary and mask attacks against captured enterprise authentication handshakes. Selecting the correct mode ensures hashcat parses the challenge, username, domain, and response fields accurately according to the standard NTLMv2 response format specification.

Answer

Mode 1000, which targets local Windows SAM NT hashes extracted from a compromised registry hive export.

Answer

Mode 5500, which is designed exclusively for cracking legacy NTLMv1 network authentication challenge-response pairs.

Answer

Mode 3000, which processes LanMan hashes historically found on very old Windows NT and 95 operating systems.

Question 2

A penetration tester is performing a password audit and has obtained a set of NTLM hashes from a Windows system. The tester wants to use Hashcat to crack these hashes but needs to choose the correct mode. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

Hashcat mode 1000. NTLM hashes are MD4-based and are cracked using Hashcat mode 1000. This mode correctly interprets the hash format and applies the appropriate algorithm. Other modes target different hash types such as NetNTLMv1, NetNTLMv2, or LM, and will not work for NTLM hashes. Therefore, mode 1000 is the only correct choice for this scenario.

Answer

Hashcat mode 3000

Answer

Hashcat mode 5500

Answer

Hashcat mode 5600

Question 3

Which Kerberos feature is specifically exploited when an attacker uses 'constrained delegation' to escalate privileges?

Accepted Answer

The S4U2Self and S4U2Proxy extensions.. Constrained delegation allows a service to impersonate a user to a specific set of other services, defined in the 'msDS-AllowedToDelegateTo' attribute. If an attacker compromises a service account configured for constrained delegation, they can request a service ticket for any user to the allowed target services. This allows the attacker to pivot throughout the network while impersonating high-privilege users without needing their credentials.

Answer

The TGT's ability to be renewed indefinitely.

Answer

The PAC validation performed by the Domain Controller.

Answer

The ability to use RC4 encryption for TGS requests.

Question 4

A penetration tester obtains a password hash from a Linux system's /etc/shadow file that begins with $6$. Which statement correctly describes this hash and its implications for cracking?

Accepted Answer

It is a SHA-512 crypt hash and can be cracked using Hashcat mode 1800.. The $6$ prefix in /etc/shadow indicates SHA-512 crypt. Hashcat mode 1800 is the correct mode for cracking sha512crypt hashes. Other modes correspond to different algorithms: mode 500 for md5crypt, mode 3200 for bcrypt, and mode 7400 for sha256crypt. Identifying the prefix correctly is essential to select the right cracking mode and avoid wasted effort.

Answer

It is a bcrypt hash and can be cracked using Hashcat mode 3200.

Answer

It is a SHA-256 crypt hash and can be cracked using Hashcat mode 7400.

Answer

It is an MD5-based hash and can be cracked using Hashcat mode 500.

Question 5

A penetration tester has obtained a password hash from a Windows system: `aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0`. They attempt to crack it using Hashcat with mode 1000 but are unable to recover any plaintext. What is the most likely explanation for this failure?

Accepted Answer

The LM hash is empty, and the NT hash corresponds to a blank password.. The hash consists of an LM part and an NT part separated by a colon. The LM part `aad3b435b51404eeaad3b435b51404ee` is the constant for an empty LM hash, and the NT part `31d6cfe0d16ae931b73c59d7e0c089c0` is the NT hash of an empty password. Hashcat mode 1000 correctly handles NTLM, but since the password is blank, cracking yields an empty string, which may not be displayed. Thus, the failure is due to the password being blank, not a mode or salt issue.

Answer

The hash is a domain cached credential and requires mode 2100.

Answer

The hash is salted, and Hashcat mode 1000 does not support salts.

Answer

The hash was captured from a Kerberos ticket and requires mode 13100.

Question 6

A penetration tester is reviewing an Azure Logic App that uses a managed identity to access an Azure SQL Database. The tester finds that the Logic App's workflow definition is stored in a storage account that is publicly accessible. The workflow includes a step that executes a stored procedure with parameters. Which of the following is the most significant risk of this misconfiguration?

Accepted Answer

An attacker can modify the workflow to exfiltrate data from the SQL Database using the managed identity.. The most significant risk is that an attacker can modify the publicly accessible workflow definition to perform malicious actions using the managed identity's privileges. Since the managed identity can access the SQL Database, the attacker could alter the workflow to extract data and send it externally. This highlights the importance of securing Logic App definitions and limiting access to storage accounts.

Answer

An attacker can disable the managed identity by deleting the Logic App.

Answer

An attacker can use the managed identity to authenticate to Azure AD and create new users.

Answer

An attacker can retrieve the managed identity's client secret from the workflow definition.

Question 7

What is the primary security benefit of implementing Group Managed Service Accounts (gMSAs) in an environment vulnerable to Kerberoasting?

Accepted Answer

gMSAs use long, complex passwords that are automatically rotated by the domain controller.. gMSAs are designed to mitigate the risks associated with long-term static service account passwords. They feature automatically managed, complex passwords that are rotated frequently by the Active Directory domain controller. Because the passwords are long and changed regularly, they are effectively impossible to crack offline even if an attacker successfully captures the encrypted TGS ticket during a Kerberoasting attempt, rendering the attack functionally useless.

Answer

gMSAs prevent the KDC from issuing service tickets for the account.

Answer

gMSAs require multi-factor authentication for every TGS-REQ performed.

Answer

gMSAs force all Kerberos traffic to be encrypted using AES-256 only.

Question 8

What is the primary function of 'rules' in tools like Hashcat when performing a dictionary attack?

Accepted Answer

To transform dictionary words into common password variations.. Rules are used to transform wordlist entries into variations. For example, a rule might take the word 'password' and generate 'Password123!' or 'P@ssw0rd'. This increases the effectiveness of dictionary attacks by covering common variations that users employ to meet complexity requirements, without needing a massive, exhaustive dictionary. This is a critical skill for testers to maximize the utility of limited wordlist sizes while increasing the likelihood of cracking complex, user-chosen passwords.

Answer

To decrypt the hash using the specified algorithm.

Answer

To automatically update the hashing algorithm to a newer standard.

Answer

To bypass account lockout mechanisms on the target system.

Question 9

During a penetration test for a multinational retailer, you discover that a legacy internal application in scope contains a hardcoded credential that also grants access to a payment processing system the client explicitly excluded from testing. You have not yet used the credential. What is the MOST appropriate course of action?

Accepted Answer

Immediately notify the client's designated point of contact, document the finding, and await written guidance before accessing the excluded system.. When testing reveals a path into an explicitly excluded system, the tester must stop and escalate rather than proceed. Notifying the client contact, documenting the discovery, and awaiting written direction respects the Rules of Engagement while ensuring the client can act on a serious risk. This balances the obligation to report critical findings with the legal boundary the client set.

Answer

Report the hardcoded credential as an informational finding without mentioning the link to the excluded payment system.

Answer

Continue testing other in-scope systems and include the credential finding in the final report at the end of the engagement.

Answer

Use the credential only to confirm it works against the excluded system, then report the finding without making changes.

Question 10

During a penetration test of a Microsoft Entra ID environment, you discover that an on-premises user account has the ms-DS-ConsistencyGuid attribute set to a value that matches the ImmutableID of a cloud user with higher privileges. What is the most likely security implication of this configuration?

Accepted Answer

It allows the on-premises user to authenticate to the cloud as the privileged user.. The ms-DS-ConsistencyGuid attribute is used as the source anchor when Microsoft Entra Connect is configured to use it. If an attacker can modify this attribute on an on-premises user to match the ImmutableID of a privileged cloud user, the next synchronization will link the on-premises account to the cloud account. The attacker can then authenticate to the cloud as the privileged user, achieving privilege escalation.

Answer

It allows the on-premises user to reset the privileged user's password.

Answer

It enables password hash synchronization for the privileged user.

Answer

It causes a synchronization error that prevents the user from logging in.