GPEN Exploitation Fundamentals Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. What does this output indicate regarding the current exploitation attempt?

Accepted Answer

The tester has successfully redirected execution flow.. The Instruction Pointer (EIP/RIP) being set to 0x41414141 (the hex representation of 'AAAA') proves that the tester has successfully overwritten the return address on the stack. This confirms the vulnerability is exploitable because the tester now has control over the execution flow. The next logical step is to replace the padding ('AAAA') with a valid memory address that points to the desired malicious shellcode.

Answer

The application is secure from buffer overflow attacks.

Answer

The system is protected by DEP/NX.

Answer

The payload is too large for the allocated buffer.

Question 2

Which technique is most effective for exploiting a heap-based buffer overflow compared to a stack-based overflow?

Accepted Answer

Manipulating heap metadata to achieve write-what-where.. Heap overflows are significantly more complex because they involve manipulating heap management metadata (like chunk headers) rather than simply overwriting a return address on the stack. Techniques like 'unlink' or 'house of force' are used to corrupt the heap structures to gain arbitrary write-what-where primitives. Understanding this distinction is vital, as stack-based knowledge does not directly transfer to the more intricate heap exploitation landscape required for modern applications.

Answer

Overwriting the return address on the stack.

Answer

Using a simple NOP sled to reach the shellcode.

Answer

Increasing the size of the input string.

Question 3

Which of the following is considered a 'client-side' exploitation scenario?

Accepted Answer

Tricking a user into opening a malicious PDF.. Client-side exploitation involves targeting an application running on a user's machine, such as a browser, document viewer, or email client. Unlike server-side exploitation, which targets a persistent service, client-side attacks rely on tricking a user into interacting with a malicious resource. This shift in vector requires testers to consider social engineering and user behavior as key components of the attack chain, which is distinct from direct network-based vulnerability exploitation.

Answer

Exploiting an unpatched web server service.

Answer

Attacking an open database port.

Answer

Brute-forcing an SSH login on a server.

Question 4

When planning an exploit that requires a specific memory address, which THREE techniques can a tester use to increase the reliability of the exploit?

Accepted Answer

Heap spraying to fill memory with the payload.. Memory reliability is the primary hurdle in binary exploitation. Techniques like heap spraying, NOP sleds, and ROP gadgets are designed to circumvent the uncertainty of memory addresses. By using these methods, a tester creates a more robust exploit that does not rely on perfect, single-point accuracy, which is almost impossible to achieve in modern systems with complex memory management and various active security mitigations.

Answer

Disabling the target's operating system logging.

Answer

Increasing the network MTU size.

Question 5

What is the primary danger of using a 'bind shell' payload in a penetration test?

Accepted Answer

It opens a listening port that is easily discovered.. A bind shell opens a listening port on the target machine, which is highly visible to firewalls and network monitoring. This makes it an insecure choice, as it allows anyone else on the network to potentially connect to the listener. In a professional engagement, using a reverse shell is preferred, as it initiates the connection from the target back to the tester, which is far more likely to bypass perimeter firewalls.

Answer

It is always detected by local antivirus.

Answer

It requires the target to have an internet connection.

Answer

It automatically crashes the target's kernel.

Question 6

During a penetration test against an internal Windows host, you use Metasploit's psexec module with a Meterpreter payload and receive a session. You then run the getuid command and see that you are running as NT AUTHORITY\SYSTEM. However, when you attempt to access a mapped network drive that the logged-on user had access to, you receive an access denied error. Which of the following best explains this behavior?

Accepted Answer

The Meterpreter session is running in the security context of the SYSTEM account, which has no network credentials for the mapped drive.. When psexec runs a payload as a service, the resulting process runs as NT AUTHORITY\SYSTEM. SYSTEM has no user credentials, so it cannot access network resources that require the logged-on user's authentication. To access those resources, the tester must migrate into a process running under the user's context or steal a token.

Answer

The psexec module drops the payload into a temporary directory that lacks the necessary permissions to access network shares.

Answer

The mapped drive was disconnected when the psexec service was created, and you must re-map it manually from the Meterpreter shell.

Answer

The firewall on the target is blocking SMB traffic from the SYSTEM account, preventing access to the mapped drive.

Question 7

You have identified a Windows Server 2019 target running a custom service that is vulnerable to a stack-based buffer overflow. You develop a working exploit and want to execute it during an authorized penetration test. After sending the payload, the service crashes and the target reboots. You need to minimize the impact on the production environment while still validating the vulnerability. Which approach should you take?

Accepted Answer

Debug the exploit locally in a lab environment that mirrors the target to identify the correct offset and payload, then test again.. The safest way to develop and validate an exploit is to replicate the target environment in a lab. This allows you to debug the exploit, find the correct offset, and test payloads without risking production systems. Once the exploit is stable, you can perform a controlled test on the target, but only after ensuring it will not crash the service. This approach aligns with penetration testing best practices.

Answer

Use a bind shell payload to gain a command shell and then immediately patch the service.

Answer

Use a staged payload that downloads a second stage, as this reduces the initial payload size and prevents crashes.

Answer

Modify the exploit to use a reverse shell payload and execute it during off-peak hours.

Question 8

During an authorized penetration test, you have gained a low-privileged shell on a Linux host. You discover that the kernel is version 4.4.0-116-generic and the system is missing several patches. You want to escalate privileges to root. Which of the following is the most reliable and safe method to achieve privilege escalation?

Accepted Answer

Search for misconfigured SUID binaries and exploit them using GTFOBins techniques.. Privilege escalation via misconfigured SUID binaries is often the safest and most reliable because it exploits existing permissions rather than kernel vulnerabilities. Kernel exploits carry a higher risk of crashing the system and are version-dependent. Enumerating SUID binaries and using GTFOBins to identify exploitation vectors is a standard practice in penetration testing, allowing for privilege escalation without destabilizing the host.

Answer

Run a kernel exploit such as Dirty COW (CVE-2016-5195) to overwrite /etc/passwd and add a root user.

Answer

Use Metasploit's local exploit suggester module to automatically find and run a suitable exploit.

Answer

Use a public exploit for CVE-2017-16995 (BPF verifier) to gain root, as it is known to work on this kernel version.

Question 9

You are conducting a penetration test against a web application. During exploitation, you identify a SQL injection vulnerability that allows you to execute arbitrary SQL queries. You want to leverage this to gain remote code execution on the underlying database server. Which TWO of the following techniques are most likely to achieve this goal? (Choose two.)

Accepted Answer

Exploiting the SQL injection to write a web shell to the web server's root directory using INTO OUTFILE.. The two techniques that directly lead to remote code execution from SQL injection are writing a web shell via INTO OUTFILE and using xp_cmdshell on MSSQL. Both require specific privileges and configurations but are proven methods to escalate from SQL injection to full command execution on the server. Other options focus on data extraction or reading files, which do not directly achieve RCE.

Answer

Injecting a stored procedure that uses the LOAD_FILE function to read sensitive files from the server.

Answer

Performing a blind SQL injection to infer the database schema and then using that information to craft a more targeted attack.

Answer

Using UNION-based SQL injection to extract data from the database and then cracking password hashes offline.

Question 10

A penetration tester has gained a foothold on a Windows host and wants to escalate privileges. They discover that the host has an unquoted service path vulnerability. Which command should they use to identify services with unquoted paths that contain spaces?

Accepted Answer

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\". Unquoted service paths with spaces allow a tester to place a malicious executable in a directory that Windows will search before the intended binary. The wmic command with the specified filters lists auto-start services and their paths, excluding Windows directory services, making it efficient for spotting vulnerable services.

Answer

tasklist /svc | findstr /i "svchost"

Answer

sc query type= service state= all | findstr /i "SERVICE_NAME"

Answer

net start | findstr /i "service"

Question 11

A penetration tester is preparing to exploit a stack-based buffer overflow on a Linux target. The target binary has non-executable stack (NX) enabled. Which technique should the tester use to achieve code execution?

Accepted Answer

Return-to-libc (ret2libc) attack. Return-to-libc is the correct technique because it leverages existing executable code in shared libraries to bypass the non-executable stack. It allows the tester to call functions like `system()` to execute commands without injecting shellcode. Other options either assume an executable stack or are not applicable to stack-based overflows on Linux with NX enabled.

Answer

Use a NOP sled and jump to shellcode on the stack

Answer

Stack pivot to a writable and executable memory region

Answer

Heap spraying

Question 12

During an exploitation attempt against a web application, you inject a payload that causes the server to return a verbose error message containing a stack trace and database query. What is the most likely type of vulnerability you have discovered?

Accepted Answer

SQL injection. Verbose error messages that include database queries and stack traces are a hallmark of SQL injection. They occur when user input is not properly sanitized, allowing attackers to manipulate SQL statements and trigger errors that reveal backend details. This information can be used to further exploit the database.

Answer

Cross-site request forgery (CSRF)

Answer

Remote file inclusion (RFI)

Answer

Cross-site scripting (XSS)

Question 13

You are conducting a penetration test against a web application and have identified a potential SQL injection vulnerability in a login form. You want to confirm the vulnerability and extract the database schema without causing a denial of service. Which technique should you use to safely enumerate the database?

Accepted Answer

Union-based SQL injection to retrieve schema information. Union-based SQL injection is the most direct and efficient method to extract database schema when the application returns query results in its response. It allows the tester to retrieve multiple rows of data in a single request without relying on delays or error messages. This minimizes impact on the application's performance and reduces the risk of triggering defensive mechanisms. Other techniques like time-based or out-of-band are used when union is not possible, but they are slower and can be more disruptive.

Answer

Out-of-band SQL injection using DNS exfiltration

Answer

Error-based SQL injection by forcing detailed error messages

Answer

Time-based blind SQL injection using heavy delays

Question 14

During a penetration test, you have identified a Windows domain controller with SMB signing disabled and obtained valid domain user credentials. You want to perform a relay attack to gain administrative access to multiple hosts. Which two conditions are necessary for a successful SMB relay attack? (Choose two.)

Accepted Answer

SMB signing must be disabled on the target hosts.. The necessary conditions for a successful SMB relay attack are that SMB signing is disabled on the target hosts and that the attacker can intercept and relay authentication from a privileged user. These two factors allow the attacker to forward authentication to a target and gain access as that privileged user. Other options are either not required or describe different attack techniques.

Answer

The attacker must have administrative credentials on the domain controller.

Answer

The target hosts must have the same local administrator password.

Answer

The attacker must have a valid NTLM hash for a domain administrator.

Question 15

You are performing a penetration test against a Windows domain and have obtained domain user credentials. You want to identify which domain controllers are vulnerable to a specific privilege escalation technique. Which TWO tools or techniques are most appropriate for enumerating domain controllers and their potential vulnerabilities? (Choose two.)

Accepted Answer

BloodHound with SharpHound collector. BloodHound with SharpHound and PowerView's Get-NetDomainController are both designed to enumerate Active Directory environments, including domain controllers. BloodHound maps attack paths and can highlight misconfigurations like unconstrained delegation, while PowerView directly queries domain controller information. Other tools like Nmap SMB scripts, Metasploit SMB scanner, and Responder focus on different aspects such as share enumeration, version scanning, or credential capture, and do not provide the specific domain controller vulnerability enumeration required.

Answer

Nmap with the smb-enum-shares script

Answer

Metasploit's auxiliary/scanner/smb/smb_version

Answer

Responder with LLMNR poisoning