GPEN Escalation and Exploitation Practice Test 2 — 15 Questions

Question 1

You have identified an SUID binary on a Linux system that executes a shell command without using an absolute path. What is the most effective way to exploit this for privilege escalation?

Accepted Answer

Modify the PATH variable to point to a malicious directory.. When a binary calls a command without an absolute path, it relies on the PATH environment variable to locate the executable. By modifying the PATH to include a directory under the attacker's control, the attacker can place a malicious executable with the same name as the target command. This forces the SUID binary to execute the malicious file instead of the intended system utility, resulting in command execution as the owner.

Answer

Overflow the buffer of the binary.

Answer

Use LD_PRELOAD to inject a shared object.

Answer

Inject arguments into the binary.

Question 2

During a penetration test, you successfully exploit a web application via SQL injection. You want to use this access to achieve remote code execution (RCE) on the underlying Windows database server. Which feature should you look for to facilitate this?

Accepted Answer

Stored procedure execution via xp_cmdshell. Database features like 'xp_cmdshell' in Microsoft SQL Server allow for the execution of arbitrary operating system commands from within a SQL query. If the database service account has sufficient privileges, this allows an attacker to pivot from SQL injection to full system command execution. Checking for this feature is a critical step in escalating database access to server-level administrative control.

Answer

Database backup functionality

Answer

Database triggers on update

Answer

Database user enumeration

Question 3

Which of the following is a primary goal during the 'Exploitation' phase of a penetration test?

Accepted Answer

To gain unauthorized access or influence target systems.. The primary goal during exploitation is to prove the existence of a vulnerability by successfully executing code or accessing unauthorized data. It is not just about finding the vulnerability; it is about demonstrating its impact. This confirms the risk to the client and allows for a more accurate assessment of the potential consequences if the flaw were exploited by a real-world attacker.

Answer

To document all vulnerabilities found.

Answer

To scan the entire network for open ports.

Answer

To patch the vulnerabilities identified.

Question 4

You are performing a penetration test and discover a service running as SYSTEM that is vulnerable to DLL hijacking. What is the most appropriate action to take to ensure the test is successful and safe?

Accepted Answer

Use a benign DLL to prove execution.. DLL hijacking involves placing a malicious DLL in a directory that a process searches before the legitimate DLL. To do this safely, you must ensure the DLL does not crash the service, which would cause a denial of service. Using a benign payload, such as one that launches a notepad process or logs a specific action, confirms the vulnerability without disrupting the client's business operations.

Answer

Immediately drop a reverse shell.

Answer

Reboot the server to force the service to restart.

Answer

Modify the Windows Registry to disable the service.

Question 5

When escalating privileges using a Kernel exploit, why is it considered a high-risk activity for a penetration test?

Accepted Answer

It frequently causes system instability and crashes.. Kernel exploits target the core of the operating system. If the exploit fails or contains errors, it frequently leads to a system crash (Blue Screen of Death). This causes significant downtime for the client, which is usually prohibited. Because kernel-level code runs with the highest possible privilege, any mistake results in immediate system instability, making it one of the most dangerous vectors to test in a production environment.

Answer

It requires the user to have administrative credentials.

Answer

It is easily detected by standard antivirus software.

Answer

It can only be executed on outdated operating systems.

Question 6

During an internal assessment, you gain a foothold as a low-privileged domain user on a Windows Server 2019 host that is a member of an Active Directory domain. You run whoami /priv and observe SeImpersonatePrivilege enabled in your token. You need to escalate to NT AUTHORITY\SYSTEM on this host. Which technique is most appropriate?

Accepted Answer

Abuse SeImpersonatePrivilege with a token impersonation tool such as JuicyPotato, RoguePotato, or PrintSpoofer, depending on the OS build.. SeImpersonatePrivilege allows a process to take on the security context of a token it receives, and privileged Windows services can be coerced into connecting to an attacker-controlled listener. Tools such as PrintSpoofer and RoguePotato exploit that behavior to obtain a SYSTEM token on modern Windows builds where older Potato techniques no longer work. Because the privilege is already present in the token, this is the direct escalation route.

Answer

Run a Kerberoasting attack against all service accounts and crack the resulting RC4 hashes offline to obtain a domain administrator password.

Answer

Extract cached domain credentials from the registry using reg save on the SAM and SYSTEM hives and crack them with hashcat.

Answer

Perform an unquoted service path attack by placing a malicious executable in a directory whose path contains a space and is writable.

Question 7

You have obtained a Meterpreter session as a standard user on an Ubuntu 20.04 server during an authorized penetration test. You want to identify reliable local privilege escalation vectors. Which two findings most directly indicate a path to root? (Choose two.)

Accepted Answer

A systemd service unit that runs a script located in /opt/backup, and the /opt/backup directory is world-writable.. Two findings give direct root: a root-run service executing a script from a world-writable directory, allowing script replacement, and passwordless sudo for find, whose -exec flag spawns arbitrary commands. Both convert standard user access into root on the same host. The remaining findings are hygiene or lateral-movement issues that do not, by themselves, elevate privileges locally.

Answer

The /etc/hosts file is writable by the standard user account you compromised.

Answer

The target runs an SSH server on port 22 that permits password authentication for all local accounts.

Answer

The host has an outdated OpenSSL library version recorded in the package manifest.

Question 8

During an internal assessment you obtain a Meterpreter session on a Windows Server 2016 host running as a low-privileged service account. You want to identify whether the host is missing security updates that could allow local privilege escalation without immediately running an exploit. Which Metasploit post-exploitation module should you use to enumerate installed hotfixes and compare them against known vulnerabilities?

Accepted Answer

post/windows/gather/enum_patches. Enumerating installed hotfixes and comparing them to known Microsoft vulnerabilities is exactly what the enum_patches module provides, and it does so without triggering exploit code on a production server. The other modules either list applications, suggest exploits through active checks, or report current token privileges, none of which produce a patch-level inventory needed before selecting a kernel escalation path.

Answer

post/multi/recon/local_exploit_suggester

Answer

post/windows/gather/enum_applications

Answer

post/windows/gather/win_privs

Question 9

While testing a Windows 10 workstation, you find that the account you compromised belongs to the Backup Operators group. You need to escalate to local administrator without installing third-party tools on disk. Which built-in capability of this group can you abuse to obtain administrative access?

Accepted Answer

SeBackupPrivilege allows reading any file, enabling extraction of the SAM and SYSTEM registry hives for offline credential dumping. The Backup Operators group is powerful because SeBackupPrivilege and SeRestorePrivilege bypass file system ACLs. An attacker can therefore read protected files such as the SAM and SYSTEM hives, exfiltrate them, and recover local password hashes offline, then use those credentials to reach administrative access without dropping custom binaries onto the host.

Answer

Membership grants SeDebugPrivilege, permitting direct injection into a SYSTEM process to steal its token

Answer

SeTakeOwnershipPrivilege is granted, allowing ownership takeover of any object followed by full control

Answer

The group can modify the discretionary access control list on the local administrator account to reset its password

Question 10

You have obtained a Meterpreter session on a Windows 10 host as a standard user. You want to escalate privileges by exploiting a vulnerable kernel driver. Which Metasploit module category would you use to search for suitable exploits?

Accepted Answer

exploit/windows/local. Local privilege escalation exploits in Metasploit are found under the 'exploit/windows/local' category. These modules are specifically designed to run within a session and elevate privileges by exploiting vulnerabilities such as kernel driver flaws. Other categories like SMB, RDP, or HTTP are for remote exploitation and do not apply when you already have local access.

Answer

exploit/windows/rdp

Answer

exploit/windows/smb

Answer

exploit/windows/http

Question 11

You have a shell as www-data on an Ubuntu 20.04 web server and notice a cron job that runs every minute as root executing a script located in /opt/backup/run.sh. The script is writable by the www-data user. What is the most direct way to escalate privileges in this situation?

Accepted Answer

Append a reverse shell command to run.sh so the next cron execution spawns a root shell back to your listener. When a root-owned cron job executes a script that a lower-privileged user can write to, the attacker effectively controls code that will run as root. Appending a reverse shell to that script is the simplest and most reliable escalation, since it leverages the scheduler's existing root context rather than requiring a separate vulnerability.

Answer

Change the permissions on /bin/bash to SUID root so any user can spawn a privileged shell

Answer

Use the writable script to add www-data to the sudoers file and then run sudo su

Answer

Replace run.sh with a symbolic link to /etc/passwd so cron overwrites the password file with a new root entry

Question 12

During a penetration test on a Linux server, you find a cron job that runs every minute as root: '*/1 * * * * root /usr/local/bin/backup.sh'. The script is owned by root but has permissions 777. You are a low-privileged user. What is the most direct way to escalate privileges?

Accepted Answer

Modify the backup.sh script to include a reverse shell command.. The most direct escalation is to modify the world-writable script because it runs as root every minute. By adding a command to create a reverse shell or copy /bin/bash with SUID permissions, you gain root access. Other methods like LD_PRELOAD or symlinking are less reliable or indirect. The writable script is a clear privilege escalation vector.

Answer

Create a malicious shared library and use LD_PRELOAD in the script's environment.

Answer

Use the cron job to copy /etc/shadow to a world-readable location.

Answer

Replace the /usr/local/bin/backup.sh with a symbolic link to /bin/bash.

Question 13

You are performing a penetration test on a Linux system and have obtained a low-privileged shell. You want to escalate privileges by exploiting misconfigured file permissions. Which two of the following file permission scenarios are most likely to allow privilege escalation? (Choose two.)

Accepted Answer

A world-writable script that is executed by a root cron job.. The two scenarios most likely to allow privilege escalation are a world-writable script executed by root cron and a root-owned SUID binary that calls a command without an absolute path. The former allows direct code injection as root, while the latter allows PATH manipulation to execute malicious code as root. The other options either do not provide direct escalation or lack a trigger mechanism.

Answer

A world-readable configuration file that contains database credentials.

Answer

A world-writable file in /etc/ that is not used by any service or cron job.

Answer

A directory with permissions 755 owned by root, containing a script that is executed by root.

Question 14

During a Linux assessment you find a root-owned binary with the SUID bit set that calls the system() function using a relative path, such as system("cat /etc/hostname"). The binary's directory is not writable, but your current directory is. Which technique is most likely to let you execute arbitrary code as root?

Accepted Answer

Create a malicious executable named cat in your current directory and manipulate PATH so it is found before /bin. A root-owned SUID binary that calls system() with a relative command name inherits the caller's PATH, so a low-privileged user can place a malicious executable earlier in PATH and have it run as root. This PATH hijacking is the intended escalation for the described weakness, and the unwritable binary directory does not prevent it.

Answer

Use LD_PRELOAD to inject a shared library into the SUID process and hook the system() call

Answer

Set the SUID bit on /bin/cat so the command runs as root when invoked

Answer

Overwrite the SUID binary with a copy of /bin/sh to inherit its root ownership

Question 15

You compromise a Windows workstation and extract the NTLM hash of a local administrator account that is reused across many workstations in the domain. You want to authenticate to remote hosts without cracking the hash. Which technique should you use?

Accepted Answer

Perform a pass-the-hash attack using the extracted NTLM hash to authenticate to remote SMB services.. NTLM authentication treats possession of the hash as sufficient proof of identity, so the extracted local administrator hash can be supplied directly to tools that establish SMB or WMI sessions. Because that local account is reused across workstations, pass-the-hash grants access to many systems immediately, with no cracking step and no dependency on the plaintext password.

Answer

Use the hash as input to an offline brute-force tool to recover the plaintext password.

Answer

Kerberoast service accounts to obtain crackable service ticket hashes.

Answer

Run a relay attack with Responder to capture and forward NetNTLM authentications.