GPEN Escalation and Exploitation — Timed 10 Questions

Question 1

During an internal network penetration test, you compromise a Linux workstation and discover plaintext credentials for a domain service account cached in memory. You want to move laterally to a critical database server using Pass-the-Hash without triggering Kerberos logging anomalies. Which technique is most appropriate for establishing this lateral movement?

10 minute time limit — choose an answer to begin.

Accepted Answer

Authenticating to the Server Message Block (SMB) service using the retrieved NTLM password hash directly.. Utilizing NTLM hashes directly via Pass-the-Hash bypasses the requirement for plain-text passwords during authentication. This technique is favored in penetration testing because service accounts often retain local administrator privileges across multiple internal systems, enabling rapid expansion of access without generating new Kerberos ticket-granting ticket requests that might alert monitoring analysts.

Answer

Injecting the cleartext password into the LSASS process memory of the remote database server.

Answer

Generating a golden ticket using the krbtgt hash obtained from a compromised domain controller.

Answer

Requesting a Kerberos service ticket for the target database using the cached NTLM hash.

Question 2

You are assessing a Linux web server and have discovered a local file inclusion (LFI) vulnerability in a parameter used to load template files. The application runs with standard web user privileges, but you notice that cron is executing a script owned by root every minute. How can you leverage this situation for privilege escalation?

Accepted Answer

Inject PHP code into the Apache access logs and use the LFI to include the log file for execution.. Local File Inclusion vulnerabilities can sometimes be escalated to remote code execution or local privilege escalation if they permit reading configuration files or logs that interact with system processes. When cron jobs execute scripts insecurely or depend on world-writable include files, local users can exploit these conditions to execute arbitrary commands.

Answer

Use the LFI to read /etc/shadow directly and crack the root password hash offline.

Answer

Overwrite the cron daemon binary directly through the web application upload mechanism.

Answer

Modify the crontab configuration file directly using standard web user privileges.

Question 3

During an assessment of a corporate Active Directory environment, you discover that a user account has the GenericAll access right over a specific security group. What does this permission enable the penetration tester to achieve?

Accepted Answer

The authority to modify the group membership and add any user account to that security group.. GenericAll is a powerful Active Directory extended access right that grants full control over an object, equivalent to ownership. When applied to a security group, it allows the attacker to modify group membership directly, granting themselves or an accomplice access to sensitive domain resources associated with that group.

Answer

The ability to read the password hashes of all group members stored in the Active Directory database.

Answer

Automatic inheritance of Domain Admin privileges due to cascading access control list permissions.

Answer

The capability to decrypt all Kerberos ticket-granting tickets issued to members of the target group.

Question 4

You are performing a post-exploitation task on a Windows host and successfully obtain a user's cleartext password from LSASS memory. Which technique is most appropriate to leverage this credential to move laterally to a remote target using only standard Windows authentication protocols?

Accepted Answer

WinRM remote command execution. Pass-the-Hash (PtH) and Pass-the-Ticket (PtT) are common, but since you have the cleartext password, Pass-the-Password is not a standard protocol term. Executing a remote process via WinRM or SMB with credentials is the standard approach. This matters because knowing the difference between cleartext capabilities and hash-based capabilities allows testers to select the most reliable authentication method for lateral movement without alerting defensive monitoring systems.

Answer

Golden Ticket injection

Answer

Pass-the-Hash via Mimikatz

Answer

Overpass-the-Hash

Question 5

Which TWO of the following Linux configuration files or directories, if writable by a low-privileged user, represent a critical privilege escalation vector?

Accepted Answer

/etc/passwd. Writable system files allow an attacker to inject malicious code or configurations that execute with root privileges upon system events. Identifying these vectors is crucial for penetration testers because they often provide the most direct path to full system compromise. If a user can modify these files, they can effectively bypass all standard Linux permission controls and establish persistence or gain elevated access during the next service restart.

Answer

/etc/shadow

Answer

/var/log/syslog

Answer

/usr/bin/ls

Question 6

When attempting to escalate privileges on a Windows system, what is the significance of the 'AlwaysInstallElevated' registry setting?

Accepted Answer

It allows MSI files to be installed with SYSTEM privileges.. The 'AlwaysInstallElevated' registry key, when set to 1 for both the Local Machine and Current User hives, allows any user to run Microsoft Installer (MSI) files with elevated SYSTEM privileges. This is a classic misconfiguration that testers look for because it provides an trivial path to privilege escalation by simply running a custom, malicious MSI package that executes a payload during installation.

Answer

It forces all user applications to run as an administrator.

Answer

It enables the installation of unsigned drivers.

Answer

It bypasses User Account Control (UAC) for all tasks.

Question 7

Which THREE of the following are common indicators that a service is vulnerable to an Unquoted Service Path escalation attack?

Accepted Answer

The service path contains spaces.. Unquoted service paths occur when a service executable path contains spaces and is not enclosed in quotes. Windows attempts to execute files by resolving the path incrementally. If an attacker can place a malicious executable in a directory that matches the partial path, the system will execute the attacker's file instead of the actual service binary, leading to privilege escalation when the service restarts.

Answer

The service binary is located in a protected directory.

Answer

The service uses a remote network share.

Question 8

While exploiting a vulnerable web application on a Windows host, you achieve remote code execution and want to establish a reliable, encrypted command-and-control channel that survives intermittent connectivity. Which Meterpreter payload characteristic best supports this requirement?

Accepted Answer

The payload is a reverse TCP Meterpreter that encrypts the session with TLS and supports automatic reconnection and migration.. Meterpreter reverse TCP encrypts its transport with TLS and its session supports automatic reconnection, while migration into a stable process keeps the channel alive across process restarts. Those traits directly satisfy the need for an encrypted, resilient command-and-control channel. Bind shells, staged-only delivery, and fire-and-forget command payloads do not provide equivalent resilience or encryption.

Answer

The payload uses staged delivery, where a small stager downloads the full Meterpreter DLL into memory after connecting back.

Answer

The payload executes a single command and exits immediately, returning only the command output to the tester.

Answer

The payload is a bind shell that listens on a chosen port and accepts a single inbound connection from the tester.

Question 9

During a penetration test on a Windows Server 2019 host, you gain a low-privileged shell as the user 'webuser'. You discover that the service 'Apache2.4' runs as LocalSystem and its binary path is 'C:\Program Files\Apache Group\Apache2\bin\httpd.exe'. You have write access to the 'C:\Program Files\Apache Group\Apache2\bin' directory. What is the most reliable way to escalate privileges to SYSTEM?

Accepted Answer

Replace the httpd.exe binary with a malicious executable and restart the service.. The most reliable escalation is to replace the service binary because you have write access to the directory containing the executable. When the service restarts, it executes your malicious binary with SYSTEM privileges. Other methods either require administrative rights or do not apply due to the service path being properly quoted. This technique is a standard Windows privilege escalation vector when service directories are writable.

Answer

Modify the service's registry key to point to a malicious executable and restart the service.

Answer

Create a new service with the same name using sc.exe create.

Answer

Use the unquoted service path vulnerability by placing a malicious executable in C:\Program Files\Apache Group\Apache2\bin.

Question 10

You have a Meterpreter session on a Windows host running as a service account with SeImpersonatePrivilege enabled. You want to elevate to SYSTEM. Which two techniques are valid for abusing this privilege on a modern Windows system? (Choose two.)

Accepted Answer

Run the PrintSpoofer or RogueWinRM technique to capture a token from the Spooler or WinRM service. SeImpersonatePrivilege permits a process to take on the identity of tokens it can capture. Potato-family tools and PrintSpoofer or RogueWinRM coerce a SYSTEM service into authenticating to an attacker-controlled endpoint, yielding a token that can be impersonated. Both approaches fit the described privilege and work across many supported Windows builds.

Answer

Load a vulnerable signed driver to execute kernel code and disable token checks

Answer

Enable the built-in Administrator account by writing to the SAM registry hive directly from the service context

Answer

Invoke a named pipe impersonation attack against the LSASS process to duplicate its token