GPEN Exploitation Fundamentals — Timed 25 Questions

Question 1

When evaluating an exploit script found on a public repository, which THREE actions should a tester take before executing it against a production target?

Accepted Answer

Analyze the source code for hidden malicious logic.. Executing unvetted code in a production environment is dangerous and irresponsible. A tester must analyze the code to understand its functionality, ensure it does not contain malicious side effects, and verify it will not cause system instability. Testing in a sandbox or isolated lab environment is the standard practice to validate that the exploit behaves exactly as intended, protecting the client's assets from accidental damage or unintended data loss.

Answer

Verify the exploit author's social media presence.

Answer

Test the exploit while the system is under heavy load.

Question 2

You are attempting to exploit a buffer overflow vulnerability. The target is using Address Space Layout Randomization (ASLR). Which technique is most appropriate to bypass this protection?

Accepted Answer

Implementing a Return-Oriented Programming (ROP) chain.. ASLR randomizes memory addresses, making it difficult to predict the location of shellcode or useful functions. Return-Oriented Programming (ROP) bypasses this by using existing code fragments (gadgets) already present in executable memory. By chaining these gadgets together, a tester can execute arbitrary commands without needing to know the absolute memory addresses, effectively neutralizing the protection provided by ASLR during the exploitation phase of the assessment.

Answer

Using a NOP sled of larger size.

Answer

Disabling the target's network interface.

Answer

Increasing the size of the injected shellcode.

Question 3

Which THREE of the following are common indicators that an exploitation attempt has crashed a service?

Accepted Answer

The socket connection is abruptly closed by the server.. Monitoring service stability is crucial to avoid causing unintended downtime during an engagement. Indicators like lost connections, non-responsive ports, or error logs are the primary signals of a service failure. If these occur immediately following an exploit attempt, it suggests the target was disrupted, necessitating an immediate pause in testing to assess the impact and ensure the stability of the environment before proceeding further.

Answer

The server's fan speed increases significantly.

Answer

Increased memory usage in the system dashboard.

Question 4

You are exploiting a stack-based buffer overflow on a 32-bit Linux application. The binary has NX enabled but no ASLR. You have identified a 'pop eax; ret' gadget and a 'jmp esp' instruction. You need to execute your shellcode. Which technique should you use?

Accepted Answer

Overwrite the return address with the address of the 'jmp esp' instruction and place shellcode after the overwritten return address on the stack.. With NX enabled, the stack is non-executable, so placing shellcode on the stack and jumping to it will fail. The correct approach is ret2libc, which reuses existing executable code in libc to call system() with a pointer to '/bin/sh'. This bypasses NX by executing code from an executable memory region rather than the stack.

Answer

Use a return-to-plt attack by calling the PLT entry for a function like execve, passing the address of '/bin/sh' as an argument.

Answer

Use a ret2libc attack by overwriting the return address with the address of the system() function and providing a pointer to '/bin/sh' as an argument.

Answer

Use a heap spray to place shellcode in a predictable location and then overwrite the return address to point to that location.

Question 5

During an internal penetration test, you gain access to a Windows 10 workstation and need to escalate privileges to SYSTEM. You discover the host has not been patched since a critical local privilege escalation vulnerability was disclosed. You have a working exploit module in Metasploit. Which Metasploit payload type should you select to get a Meterpreter session that survives process restarts and allows you to migrate to a more stable process?

Accepted Answer

A Meterpreter payload configured with a reverse HTTPS handler. The requirement is for a Meterpreter session that can survive process restarts and allow migration. Meterpreter is a sophisticated payload that operates in memory and includes the migrate command to move the session into another process. This migration ensures that if the originally exploited process crashes or is restarted, the session remains active. Other payload types, such as staged, bind, or encoded shells, do not offer these post-exploitation capabilities.

Answer

A shell payload encoded with Shikata Ga Nai

Answer

A bind shell payload using a standard TCP handler

Answer

A staged payload delivered via a reverse TCP handler

Question 6

During a penetration test, you gain a low-privileged shell on a Windows 10 host. You notice the system has PowerShell v5 and the `SeImpersonatePrivilege` enabled for your user. Which exploitation technique is most appropriate to escalate privileges to SYSTEM?

Accepted Answer

Use the Rotten Potato exploit to impersonate a token from a privileged process.. Rotten Potato is the correct choice because it directly leverages `SeImpersonatePrivilege` to impersonate a SYSTEM token. This privilege is often granted to service accounts and is a known escalation path. Other options either require higher privileges, are not targeted to the given privilege, or are less reliable. The technique is well-suited for Windows 10 with PowerShell v5.

Answer

Use Mimikatz to dump credentials from memory and pass-the-hash.

Answer

Exploit a kernel vulnerability such as CVE-2021-1732 for local privilege escalation.

Answer

Run PowerUp's `Invoke-AllChecks` to find unquoted service paths.

Question 7

You are conducting a penetration test against a Linux server and have obtained a low-privilege shell. You want to escalate privileges by exploiting a vulnerable SUID binary. Which TWO of the following commands are most useful for identifying SUID binaries that could be exploited? (Choose two.)

Accepted Answer

find / -perm -4000 -type f 2>/dev/null. The find commands with -perm -4000 identify SUID binaries. Adding -user root filters for those owned by root, which are most likely to grant root privileges when exploited. These commands are essential for discovering SUID-based privilege escalation vectors on Linux systems.

Answer

getcap -r / 2>/dev/null

Answer

ls -la /usr/bin | grep rws

Answer

find / -perm -2000 -type f 2>/dev/null

Question 8

A penetration tester is exploiting a web application vulnerability that allows arbitrary file upload. The target server runs PHP and has `mod_security` with OWASP Core Rule Set (CRS) enabled. Which method is most likely to bypass the WAF and achieve remote code execution?

Accepted Answer

Upload a file with a `.phtml` extension and include PHP code within an image file using exif data.. Uploading a `.phtml` file with PHP code embedded in image EXIF data is the most likely to bypass ModSecurity with OWASP CRS. The alternative extension avoids blacklisting, and EXIF embedding evades content inspection. This combination can lead to RCE if the server is configured to execute `.phtml` files. Other methods either use blocked extensions or rely on `.htaccess`, which is often restricted.

Answer

Upload a `.htaccess` file to enable execution of `.jpg` files as PHP, then upload a malicious `.jpg`.

Answer

Use a polyglot file that is both a valid image and PHP script, and upload it with a `.php` extension.

Answer

Upload a PHP file with a `.php` extension and obfuscate the code using base64 encoding.

Question 9

You are exploiting a stack-based buffer overflow on a Linux x86 binary with NX enabled and ASLR disabled. You have identified a suitable JMP ESP instruction in a non-ASLR module. However, the binary is compiled with stack canaries. Which approach is most likely to succeed in bypassing the stack canary and achieving code execution?

Accepted Answer

Leak the canary value via an information disclosure vulnerability and then include it in the payload. Stack canaries are designed to detect stack buffer overflows by placing a random value before the saved return address. To successfully overwrite the return address, the attacker must not corrupt the canary. If an information disclosure vulnerability exists, the attacker can leak the canary value and then include it in the payload, allowing the overflow to proceed without detection. This is a common bypass when ASLR is disabled, as the canary is static per process. Other methods like brute-forcing require specific conditions.

Answer

Use a return-to-libc attack that does not require overwriting the return address

Answer

Brute-force the canary value byte by byte using a format string vulnerability

Answer

Overwrite the saved return address without triggering the canary check by using a stack pivot

Question 10

During an external penetration test, you have compromised a web server and established a reverse shell. You now need to escalate privileges on the Linux host. You discover that the /etc/passwd file is writable by your current user. Which method is most effective for privilege escalation in this scenario?

Accepted Answer

Add a new user with UID 0 to /etc/passwd and set a password hash. When /etc/passwd is writable, an attacker can add a new user with UID 0 and a known password hash. This new user will have root privileges, allowing the attacker to execute commands as root. This technique is reliable and does not depend on other misconfigurations. Modifying root's shell or relying on sudo rules are less direct and may not work without additional conditions. Overwriting /etc/shadow is not possible if only /etc/passwd is writable.

Answer

Overwrite /etc/shadow with a known password hash for root

Answer

Modify the root user's shell to /bin/bash in /etc/passwd

Answer

Use a sudo rule that allows the current user to edit /etc/passwd

Question 11

During a penetration test, you successfully inject a payload into a web application that results in the server executing system commands with elevated privileges. Which phase of the exploitation lifecycle does this action primarily represent?

Accepted Answer

Exploitation. This scenario demonstrates the execution of arbitrary code, which is the core of the exploitation phase. Exploitation is the process of leveraging a vulnerability to gain unauthorized access or control over a target system. Understanding this transition from vulnerability discovery to exploitation is critical for testers to effectively assess the impact of security flaws and demonstrate real-world risk to stakeholders during the assessment reporting phase.

Answer

Reconnaissance

Answer

Vulnerability Assessment

Answer

Post-Exploitation

Question 12

When selecting an exploit for a target system, which TWO factors are most critical to ensure the exploit succeeds without crashing the target service?

Accepted Answer

The exact version of the application or OS service.. Successful exploitation requires precise alignment between the exploit's memory address assumptions and the target's environment. Crashes typically occur when the exploit targets an incorrect memory offset or assumes a different architecture than the one present. By verifying target versioning and architectural requirements, a tester minimizes the risk of service instability, ensuring that the exploit fulfills its objective while maintaining the operational integrity of the production environment.

Answer

The color scheme of the target's command shell.

Answer

The network bandwidth available to the target.

Answer

The number of users currently logged in.

Question 13

Refer to the exhibit. Which step should a tester prioritize next based on the server header information?

Accepted Answer

Search for known vulnerabilities for Apache 2.4.41.. The server header indicates a specific version of Apache running on Ubuntu. A tester should cross-reference this version with known vulnerabilities, such as CVEs in the Apache HTTP Server. This is a foundational step in identifying applicable exploits. Knowing the specific version allows for targeted research into public or private exploit modules, increasing the probability of a successful engagement by focusing on documented, verifiable weaknesses within that specific software build.

Answer

Run a brute-force password attack against the server.

Answer

Immediately deploy a rootkit on the server.

Answer

Close the connection and report the server as secure.

Question 14

Why is it important to use 'staged' payloads during a penetration test when the target has limited memory or strict filtering?

Accepted Answer

To fit within small buffer constraints during initial exploitation.. Staged payloads are split into a small initial stub and a larger secondary component. The small stub fits into tight buffer constraints or bypasses initial inspection, then downloads the rest of the shellcode. This is crucial for environments with limited memory or security products that block large, anomalous network traffic, as it allows for stealthy, efficient exploitation where a full-sized monolithic payload would fail or trigger an alarm.

Answer

To bypass the system's firewall rules permanently.

Answer

To automatically upgrade the shell to root privileges.

Answer

To increase the target's CPU usage for testing stability.

Question 15

Which of the following describes the purpose of 'encoding' shellcode in an exploitation context?

Accepted Answer

To bypass character-based filters and detection systems.. Encoding is used to transform shellcode to bypass security filters, such as Intrusion Detection Systems (IDS) or character filtering (like null bytes). By changing the signature of the payload, it avoids triggering pattern-based detection. This is a fundamental technique for ensuring the payload reaches its intended execution point without being sanitized or blocked by input validation controls that inspect data for known malicious sequences.

Answer

To increase the execution speed of the exploit.

Answer

To encrypt the traffic for legal compliance.

Answer

To permanently store the payload on the target's disk.

Question 16

Refer to the exhibit. What does this output indicate regarding the current exploitation attempt?

Accepted Answer

The tester has successfully redirected execution flow.. The Instruction Pointer (EIP/RIP) being set to 0x41414141 (the hex representation of 'AAAA') proves that the tester has successfully overwritten the return address on the stack. This confirms the vulnerability is exploitable because the tester now has control over the execution flow. The next logical step is to replace the padding ('AAAA') with a valid memory address that points to the desired malicious shellcode.

Answer

The application is secure from buffer overflow attacks.

Answer

The system is protected by DEP/NX.

Answer

The payload is too large for the allocated buffer.

Question 17

Which technique is most effective for exploiting a heap-based buffer overflow compared to a stack-based overflow?

Accepted Answer

Manipulating heap metadata to achieve write-what-where.. Heap overflows are significantly more complex because they involve manipulating heap management metadata (like chunk headers) rather than simply overwriting a return address on the stack. Techniques like 'unlink' or 'house of force' are used to corrupt the heap structures to gain arbitrary write-what-where primitives. Understanding this distinction is vital, as stack-based knowledge does not directly transfer to the more intricate heap exploitation landscape required for modern applications.

Answer

Overwriting the return address on the stack.

Answer

Using a simple NOP sled to reach the shellcode.

Answer

Increasing the size of the input string.

Question 18

Which of the following is considered a 'client-side' exploitation scenario?

Accepted Answer

Tricking a user into opening a malicious PDF.. Client-side exploitation involves targeting an application running on a user's machine, such as a browser, document viewer, or email client. Unlike server-side exploitation, which targets a persistent service, client-side attacks rely on tricking a user into interacting with a malicious resource. This shift in vector requires testers to consider social engineering and user behavior as key components of the attack chain, which is distinct from direct network-based vulnerability exploitation.

Answer

Exploiting an unpatched web server service.

Answer

Attacking an open database port.

Answer

Brute-forcing an SSH login on a server.

Question 19

When planning an exploit that requires a specific memory address, which THREE techniques can a tester use to increase the reliability of the exploit?

Accepted Answer

Heap spraying to fill memory with the payload.. Memory reliability is the primary hurdle in binary exploitation. Techniques like heap spraying, NOP sleds, and ROP gadgets are designed to circumvent the uncertainty of memory addresses. By using these methods, a tester creates a more robust exploit that does not rely on perfect, single-point accuracy, which is almost impossible to achieve in modern systems with complex memory management and various active security mitigations.

Answer

Disabling the target's operating system logging.

Answer

Increasing the network MTU size.

Question 20

What is the primary danger of using a 'bind shell' payload in a penetration test?

Accepted Answer

It opens a listening port that is easily discovered.. A bind shell opens a listening port on the target machine, which is highly visible to firewalls and network monitoring. This makes it an insecure choice, as it allows anyone else on the network to potentially connect to the listener. In a professional engagement, using a reverse shell is preferred, as it initiates the connection from the target back to the tester, which is far more likely to bypass perimeter firewalls.

Answer

It is always detected by local antivirus.

Answer

It requires the target to have an internet connection.

Answer

It automatically crashes the target's kernel.