GPEN Metasploit — Timed 25 Questions

Question 1

Which TWO of the following steps are required to properly configure a multi-handler exploit listener for a reverse TCP payload?

Accepted Answer

Set PAYLOAD to match the target architecture. Configuring the exploit/multi/handler module requires precisely setting the payload and the listener's binding parameters. The handler is a specialized module that mimics various exploits to receive incoming connections. Setting the LHOST and LPORT correctly ensures the target machine can route the callback back to the attacker's machine, and defining the payload ensures the handler knows how to interpret the incoming traffic from the remote agent.

Answer

Set RHOST to the target IP address

Answer

Execute the exploit with the -e flag

Answer

Set the TARGET architecture to x64 only

Question 2

Which Metasploit post-exploitation module is best suited for gathering stored credentials from a compromised Windows machine?

Accepted Answer

post/windows/gather/credentials/mimikatz. The 'post/windows/gather/hashdump' or 'mimikatz' modules are standard for credential harvesting. Mimikatz, often used via the 'kiwi' extension in Meterpreter, is the industry standard for extracting plain-text passwords and NTLM hashes from the LSASS process. Using these tools safely is critical, as interacting with the LSASS process can trigger endpoint detection systems if not performed with appropriate care during a penetration test engagement.

Answer

post/windows/gather/hashdump

Answer

exploit/windows/local/bypassuac

Answer

auxiliary/scanner/smb/smb_login

Question 3

Which THREE actions can be performed directly within a Meterpreter session?

Accepted Answer

Migrate to other system processes. Meterpreter is powerful because it allows a penetration tester to perform complex system interactions without leaving a heavy footprint. Being able to migrate processes, capture screenshots, and interact with the file system are standard requirements for post-exploitation. Understanding these capabilities is vital for ensuring that data collection and privilege escalation remain effective throughout the testing engagement without unnecessarily crashing the target system or triggering alerts.

Answer

Enable persistent backdoor installation

Answer

Update the host operating system

Question 4

Which TWO settings are absolutely necessary for an auxiliary scanner to function against a target?

Accepted Answer

RHOSTS. Auxiliary scanners in Metasploit require a defined target host range and sometimes specific service ports depending on the module. Setting RHOSTS is universal across almost all modules, as the framework must know where to send the packets. RPORT is often required for specific service-based scanners, ensuring the module interacts with the correct service on the target machine, which is critical for accurate vulnerability assessment during the reconnaissance phase.

Answer

PAYLOAD

Answer

SESSION

Answer

ENCODER

Question 5

A tester has a Meterpreter session on a Windows 10 host but needs to execute a PowerShell script that is only available on the attacker's machine, without writing the script to disk on the target. Which Meterpreter command should the tester use?

Accepted Answer

powershell_execute. The powershell_execute command is designed to run PowerShell code in memory on a compromised host. It can accept a script block or a local file path and executes it without creating a file on the target. This directly fulfills the need to run an attacker-side script without disk writes, unlike commands that stage files or require manual invocation.

Answer

execute -f powershell.exe -a "-Command"

Answer

powershell_import

Answer

upload

Question 6

A penetration tester has gained a Meterpreter session on a Windows host and wants to route all subsequent Metasploit traffic through that session to reach an isolated internal subnet. Which Metasploit command should the tester run to add the target network to the route table?

Accepted Answer

route add 10.10.20.0/24 <session_id>. Metasploit maintains an internal route table that modules consult before sending traffic. Adding a route with route add tells the framework to tunnel traffic for that subnet through the specified Meterpreter session. This enables pivoting into networks that are not directly reachable from the attacker, and it works with any module type that uses the framework's socket abstraction.

Answer

portfwd add -l 10.10.20.0 -p 24 -r 10.10.20.0

Answer

autoroute 10.10.20.0/24

Answer

ip route add 10.10.20.0/24 via <session_id>

Question 7

A penetration tester is using Metasploit and wants to pivot into an internal network through a compromised dual-homed Windows host. The tester has a Meterpreter session on the host and needs to route traffic from Metasploit modules to the internal subnet 10.10.10.0/24. Which sequence of commands should the tester use?

Accepted Answer

background, then use post/multi/manage/autoroute, set SESSION 1, run. To pivot into an internal network, the tester must add routes to Metasploit's routing table. The most reliable method is to background the Meterpreter session, then use the post/multi/manage/autoroute module with the correct SESSION ID. This automatically discovers and adds routes for reachable subnets, allowing other modules to traverse the pivot.

Answer

portfwd add -l 10.10.10.0 -p 255.255.255.0 -r 1

Answer

run autoroute -s 10.10.10.0/24

Answer

route add 10.10.10.0 255.255.255.0 1

Question 8

A penetration tester has a Meterpreter session on a Windows 10 host and wants to execute a PowerShell script that is stored on the target at C:\Tools\enum.ps1 without writing the script content into the Meterpreter command line. Which Meterpreter command should the tester use?

Accepted Answer

powershell_execute -f C:\Tools\enum.ps1. powershell_execute is the Meterpreter command designed to run PowerShell code or a script file on the target. The -f switch tells it to execute the specified file path, so C:\Tools\enum.ps1 is run directly on the compromised host. Loading the extension or importing a script does not execute an existing file, and post modules are run from the console rather than as Meterpreter commands.

Answer

powershell_import

Answer

load powershell

Answer

run post/windows/manage/powershell/exec_powershell

Question 9

During a penetration test, a tester uses msfvenom to generate a Windows executable payload. The tester wants the payload to connect back to the attacker's machine at 192.168.1.50 on port 4444, but the generated file fails to execute on the target. The target is a 64-bit Windows 10 system with no antivirus. Which msfvenom option is most likely missing or incorrect in the command that generated the payload?

Accepted Answer

The -a x64 architecture option was not specified, so the payload was built for a 32-bit architecture.. msfvenom defaults to x86 architecture unless specified. On a 64-bit Windows 10 target, a 32-bit payload may fail to execute properly, especially if it relies on 64-bit system libraries or injects into 64-bit processes. Specifying -a x64 ensures the payload is built for the target's architecture, which is a common oversight when generating payloads for modern Windows systems.

Answer

The LHOST and LPORT were set with the -o option instead of the required --lhost and --lport flags.

Answer

The -e encoder option was omitted, so the payload was not encoded and therefore blocked by Windows Defender.

Answer

The -f exe format option was not specified, so the output was not a valid executable.

Question 10

A penetration tester is configuring a Metasploit exploit module that requires a reverse HTTPS payload to bypass egress filtering. The tester needs to ensure the payload connects back to the correct host and port and that the listener is properly set up. Which two actions must the tester perform? (Choose two.)

Accepted Answer

Set the LHOST option to the attacker's reachable IP address.. For a reverse HTTPS payload to work, the tester must configure the callback address and port correctly. LHOST must be an address the target can reach, and LPORT must be a port permitted by egress filtering, such as 443. These two settings ensure the payload can establish a connection back to the attacker, bypassing network restrictions.

Answer

Set the PAYLOAD option to windows/meterpreter/reverse_tcp.

Answer

Set the RHOST option to the target's IP address.

Answer

Set the ExitOnSession option to false.

Question 11

A penetration tester has compromised a Windows host and obtained a Meterpreter session. The tester now wants to use the compromised host as a pivot to scan an internal network. Which two actions must the tester perform to enable Metasploit modules to route traffic through the session? (Choose two.)

Accepted Answer

Ensure the Meterpreter session has the necessary privileges to forward traffic and that the target subnet is reachable from the compromised host.. To pivot through a Meterpreter session, the tester must add the target subnet to Metasploit's route table using route add, and ensure the compromised host can reach that subnet with appropriate privileges. These two actions enable other modules to send traffic through the session. Without the route, modules would attempt direct connections; without reachability and privileges, the pivot would fail.

Answer

Background the Meterpreter session and use the autoroute post-exploitation module.

Answer

Configure a SOCKS proxy server using the auxiliary/server/socks4a module and set the Proxies option in the scanning module.

Answer

Set the RHOSTS option of the scanning module to the target subnet and set the Proxies option to the Meterpreter session.

Question 12

A penetration tester has an active Meterpreter session on a Windows 10 host. The tester needs to run a PowerShell script that resides on the target's C:\Temp\cleanup.ps1 without uploading a separate payload or opening a new session. Which Meterpreter command should the tester use?

Accepted Answer

load powershell. Loading the PowerShell extension into the existing Meterpreter session adds the commands needed to import and run local scripts without creating a new session or separate payload. This matches the requirement to execute an existing .ps1 file through the current channel. Spawning a new PowerShell process or invoking a post module would work differently and is not the direct in-session method.

Answer

execute -f powershell.exe -a "-File C:\Temp\cleanup.ps1"

Answer

import C:\Temp\cleanup.ps1

Answer

run post/windows/manage/powershell/exec_powershell

Question 13

A penetration tester has gained a Meterpreter session on a Linux server and wants to escalate privileges by exploiting a local kernel vulnerability. Which Metasploit module type is specifically designed for this purpose?

Accepted Answer

post. Post-exploitation modules are designed to run inside an existing session and perform actions like privilege escalation. They can leverage local exploits and system misconfigurations to elevate privileges. In contrast, exploit modules are for initial access, auxiliary modules for scanning, and payloads for establishing sessions.

Answer

exploit

Answer

auxiliary

Answer

payload

Question 14

A penetration tester is preparing a Metasploit resource script to automate a repeatable engagement workflow. The script must set global datastore values that apply to all modules and then launch a specific auxiliary scanner. Which two resource script commands should the tester use to accomplish these goals? (Choose two.)

Accepted Answer

setg RHOSTS 10.10.10.0/24. Resource scripts automate Metasploit workflows by executing console commands in sequence. The setg command establishes global datastore values that persist across modules, which is ideal for a target range used by multiple scans. The use command selects a specific module by path so it becomes active. Together they configure a global target scope and then launch the intended auxiliary scanner.

Answer

set RHOSTS 10.10.10.0/24

Answer

run auxiliary/scanner/portscan/tcp

Answer

loadportscan

Question 15

Which command in the Metasploit Framework allows a user to interact with a backgrounded session after a successful exploit execution?

Accepted Answer

sessions -i. The 'sessions' command is the primary method for managing active connections within Metasploit. Once an exploit establishes a payload, the session moves to the background. Using 'sessions -i <id>' connects the user to the specific meterpreter shell, enabling post-exploitation activities. This is crucial for maintaining persistence and executing lateral movement tasks in a penetration test, as it allows the operator to toggle between multiple compromised targets effectively.

Answer

exploit -j

Answer

run -s

Answer

use -session

Question 16

Refer to the exhibit. Why did the EternalBlue exploit attempt fail despite the scanner identifying the target as vulnerable?

Accepted Answer

The target environment rejected the payload execution. The exhibit shows the module successfully detected vulnerability but failed exploitation. This often occurs due to differences in the target's operating system build, unexpected memory protection, or a race condition where the service crashed during the initial check. In professional testing, this highlights the instability of kernel-level exploits. Even if a target appears vulnerable, environmental variables like patches, antivirus interference, or DEP/ASLR settings can prevent the shellcode from executing correctly in memory.

Answer

The RHOSTS value is configured incorrectly

Answer

The exploit module requires an active session

Answer

The listener port is already in use by another process

Question 17

What is the purpose of the 'meterpreter' payload in the Metasploit framework?

Accepted Answer

To provide an extensible, memory-only command interface. Meterpreter is a sophisticated, memory-resident payload that provides an advanced interactive shell. It operates entirely in memory, which helps it evade disk-based antivirus detection. Its importance lies in its extensibility; it allows testers to load modules dynamically, perform file system operations, dump memory, and migrate processes without writing files to the disk, making it a critical component for stealthy and efficient post-exploitation operations in modern security assessments.

Answer

To perform network scanning

Answer

To encode payloads for bypass

Answer

To generate shellcode for hardware

Question 18

Refer to the exhibit. What is the most likely cause of the 'Connection reset by peer' error when using the PsExec module?

Accepted Answer

Endpoint security or a firewall terminated the SMB connection. The error 'Connection reset by peer' during a PsExec exploit attempt usually indicates that an active security control, such as a host-based firewall or endpoint protection, terminated the connection. PsExec relies on the Admin$ share and the service control manager. If the target system detects the service installation attempt or the connection from an unauthorized source, it will forcefully drop the connection to block the exploitation attempt, a common scenario in hardened enterprise environments.

Answer

The SMB credentials provided are incorrect

Answer

The listener port is blocked by the target firewall

Answer

The payload architecture does not match the target

Question 19

Which of the following describes the function of the 'msfvenom' tool within the Metasploit ecosystem?

Accepted Answer

To generate and encode custom payloads. Msfvenom combines the functionality of the old 'msfpayload' and 'msfencode' tools. It is used to generate standalone, malicious payloads for a variety of platforms. Understanding how to generate custom shellcode is essential for penetration testers who need to tailor their delivery mechanism to bypass specific security controls, such as application whitelisting or signature-based antivirus, which often block default, well-known Metasploit payload binaries.

Answer

To act as a central vulnerability database

Answer

To automate the exploitation of remote services

Answer

To manage active sessions and post-exploitation

Question 20

In Metasploit, what is the significance of the 'LHOST' parameter when setting up a reverse shell?

Accepted Answer

It identifies the attacker's IP address for the callback. The LHOST parameter is the IP address of the attacker's machine. It tells the target machine where to send its callback once the payload is executed. Misconfiguring this is a common point of failure for beginners. Ensuring the correct LHOST is set is critical for establishing a stable connection between the target and the penetration tester's workstation during the exploitation phase of the engagement.

Answer

It defines the target's listening port

Answer

It is used to scan the local network

Answer

It defines the exploit's remote host target