PEN-200 Practice Test 13 — 15 Questions

Question 1

You have a low-privileged shell on a Linux host. You discover a cron job that runs every minute as root and executes a script located at /opt/backup/backup.sh. The script is world-writable. However, you also notice that the directory /opt/backup is owned by root and has permissions 755. Which of the following is the MOST reliable way to escalate privileges?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Overwrite the backup.sh script with a reverse shell payload.. The script is world-writable, so you can modify its contents directly. Because the cron job executes it as root, any commands you insert will run with root privileges. A reverse shell payload is a common and effective method. The directory permissions prevent replacing the file or creating symlinks, but do not prevent editing the file's contents. Therefore, overwriting the script is the most reliable approach.

Answer

Replace the backup.sh script with a symbolic link to a file you control.

Answer

Modify the script to add a new user with UID 0 to /etc/passwd.

Answer

Use the `crontab` command to edit the root user's crontab and add a new job.

Question 2

A web application uses JSON Web Tokens for authentication. You capture a token whose header is `{"alg":"HS256","typ":"JWT"}` and payload is `{"user":"guest","role":"user"}`. The server verifies the signature with a symmetric secret. Which attack is most likely to let you forge a token with `"role":"admin"` if the application is misconfigured?

Accepted Answer

Crack the HS256 secret offline with a wordlist using a tool like hashcat or john, then re-sign a modified payload.. When HS256 is enforced but the secret is weak, the practical attack is an offline dictionary or brute-force attack against the HMAC using a captured token. Recovering the secret allows the attacker to mint arbitrary tokens, including one with elevated privileges. Algorithm-confusion and `alg:none` attacks require different misconfigurations that are not present in this scenario.

Answer

Replay the captured token after changing only the payload `role` field to `admin`, keeping the original signature.

Answer

Switch the header `alg` to `RS256` and sign the token with the server's public key as an HMAC secret.

Answer

Change the header `alg` to `none` and remove the signature segment, then submit the token.

Question 3

You have identified a stack-based buffer overflow in a Windows application. The application is compiled with SafeSEH, and you have confirmed that no SafeSEH-protected exception handlers can be overwritten. However, you notice that the stack is executable. You need to redirect execution to your shellcode. Which technique is most likely to succeed?

Accepted Answer

Overwrite the saved return address with a pointer to a JMP ESP instruction in a non-ASLR module.. With an executable stack and SafeSEH in place, the most straightforward method is to overwrite the saved return address with a JMP ESP instruction from a module not protected by ASLR. This transfers control to the stack where the shellcode resides. SafeSEH is irrelevant because no exception handler is overwritten. This technique is a staple in OSCP-style buffer overflow exploitation.

Answer

Overwrite the saved return address with the address of the shellcode on the stack.

Answer

Overwrite the SEH chain with a pointer to a POP POP RET sequence in a SafeSEH-compatible module.

Answer

Use a return-to-libc attack by overwriting the return address with the address of the system() function.

Question 4

You have obtained a low-privileged shell on a Linux server. During enumeration, you discover a file named `backup.sh` in `/opt/scripts` that is owned by root and has permissions `-rwxr-xr-x`. A cron job runs this script every night as root. The directory `/opt/scripts` has permissions `drwxrwxr-x` and is owned by root:developers. Your user is a member of the `developers` group. What is the most reliable way to escalate privileges?

Accepted Answer

Replace `/opt/scripts/backup.sh` with a malicious script by deleting the original and creating a new file with the same name.. The key vulnerability is that the directory `/opt/scripts` is writable by the `developers` group, of which your user is a member. Although the script file itself is not writable, you can delete it and create a new file with the same name because directory write permission allows file deletion and creation. The cron job will then execute your malicious script as root, granting privilege escalation. This is a common misconfiguration in Linux environments.

Answer

Use the `sudo` command to edit the script with `sudoedit`.

Answer

Add a new cron job that runs a reverse shell as your user.

Answer

Modify the contents of `/opt/scripts/backup.sh` to include a reverse shell payload.

Question 5

While enumerating a Linux host, you notice that the `passwd` command has the SUID bit set and is owned by root. You recall that SUID binaries run with the privileges of the file owner. Which of the following is the most direct way to leverage this to gain root access?

Accepted Answer

The SUID bit on `passwd` is standard and does not by itself allow privilege escalation.. The SUID bit on `/usr/bin/passwd` is a standard, secure configuration present on most Linux systems. It allows unprivileged users to change their own passwords by temporarily elevating privileges to write to `/etc/shadow`. This is not a vulnerability; the binary enforces strict access controls. Therefore, it does not provide a direct path to root. Testers should focus on non-standard SUID binaries or misconfigurations rather than expected ones.

Answer

Run `passwd` and change the root password.

Answer

Use the SUID bit to read the `/etc/shadow` file and crack the root hash.

Answer

Exploit a vulnerability in the `passwd` binary to execute arbitrary code.

Question 6

You are exploiting a 32-bit Windows FTP server that uses a fixed-size stack buffer and a vulnerable call to strcpy. After overwriting EIP with a JMP ESP address, you notice that your shellcode executes but the connection drops immediately without a shell. You suspect bad characters corrupted the payload. Which method is most effective for identifying all bad characters in this scenario?

Accepted Answer

Send a byte array from 0x00 to 0xFF and inspect the stack in a debugger to see which bytes are truncated or altered.. Sending the full 0x00-0xFF byte range and inspecting stack memory in a debugger is the definitive way to identify bad characters. It shows which bytes are truncated or transformed by the vulnerable function. Static analysis and encoding do not replace this dynamic test. This step must precede shellcode generation to ensure payload integrity.

Answer

Run a strings command on the vulnerable binary to list all characters that appear in the code.

Answer

Encode your shellcode with shikata_ga_nai and assume any remaining corruption is due to the encoder.

Answer

Use a disassembler to check whether the binary contains any null bytes in its machine code.

Question 7

You are exploiting a 32-bit Windows application that reads a line of input into a 256-byte stack buffer using a vulnerable function. After sending a payload of 300 'A' characters, the application crashes and the debugger shows EIP contains 0x41414141. You need to determine the exact number of bytes from the start of the buffer to the saved return address. Which approach is most appropriate?

Accepted Answer

Send a unique, non-repeating pattern of characters (e.g., generated by pattern_create) and calculate the offset from the value in EIP.. The pattern-based approach is the de facto standard for determining the offset to the return address in a buffer overflow. By sending a unique cyclic pattern, the overwritten EIP value directly maps to a specific offset, which can be calculated with pattern_offset. This method is reliable because it does not rely on assumptions about stack layout and works even when the buffer size is not exactly known.

Answer

Incrementally increase the number of 'A' characters until the application crashes, then subtract 4 from the total length.

Answer

Send a payload of 256 'A's followed by 4 'B's and check if EIP contains 0x42424242.

Answer

Use a debugger to inspect the stack and manually count the bytes between the start of the buffer and the saved return address.

Question 8

A penetration tester has obtained a low-privilege shell on a Windows 10 host protected by Windows Defender with real-time protection enabled. The tester wants to execute a custom .NET assembly in memory to avoid writing a payload to disk, but Defender's AMSI integration repeatedly flags the assembly when loaded via the standard reflection technique. Which modification to the in-memory loading approach is MOST likely to prevent AMSI from inspecting the assembly's content?

Accepted Answer

Patch the AmsiScanBuffer function in amsi.dll in the current process before loading the assembly.. AMSI integrates with the .NET runtime and submits assembly content to AmsiScanBuffer before execution. Patching that function in the current process causes the scan to return a benign result, allowing the in-memory assembly to load without Defender receiving the buffer. Encryption, encoding, and remote loading do not prevent the runtime from passing the decrypted or fetched bytes to AMSI, so they fail against runtime inspection even though they may help against static file signatures.

Answer

Base64-encode the assembly bytes and load them with Assembly.LoadFrom after decoding.

Answer

Store the assembly on a remote SMB share and load it with Assembly.LoadFrom over the network path.

Answer

Encrypt the assembly with AES and decrypt it directly into a memory region allocated with PAGE_EXECUTE_READWRITE.

Question 9

During an exploit development exercise on a 32-bit Windows application, you have identified that a JMP ESP instruction resides at 0x625011AF inside a module that is not protected by ASLR or SafeSEH. You need to place your shellcode after the overwritten return address. What is the primary reason for using this JMP ESP address rather than jumping directly to a stack address where your shellcode resides?

Accepted Answer

The JMP ESP instruction provides a stable, predictable target because the module's base address is fixed, while direct stack addresses vary between runs and debugger sessions.. JMP ESP is preferred because its address in a non-ASLR module is constant, whereas stack addresses fluctuate, making direct jumps unreliable. It provides a deterministic pivot to shellcode placed after the return address. It does not encode payloads, resize buffers, or change privileges; those are separate concerns in exploit development.

Answer

JMP ESP increases the size of the stack buffer so that larger shellcode can be placed.

Answer

JMP ESP automatically encodes the shellcode to bypass antivirus signature detection.

Answer

JMP ESP ensures that the shellcode executes with SYSTEM privileges.

Question 10

A penetration tester has a working unmanaged PowerShell runner in C# that executes a script block on a Windows 10 host with AMSI enabled. The runner currently fails because AMSI scans the script content. The tester wants to disable AMSI scanning for the current process without touching files on disk and without requiring administrative privileges. Which technique best fits these constraints?

Accepted Answer

Patch the AmsiScanBuffer function in memory by overwriting its first bytes with a return value that indicates a clean scan.. AMSI performs in-process scanning through functions resolved from amsi.dll, most notably AmsiScanBuffer. Because the DLL is loaded into the calling process, a user-mode patch of that function in memory changes scan results for that process only, needs no administrative rights, and writes nothing to disk. Deleting system files, inventing registry policies, or adjusting execution policy do not alter the in-memory scanning path AMSI uses.

Answer

Set the registry value HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAMSI to 1.

Answer

Run the PowerShell runner from a session launched with the -NoProfile and -ExecutionPolicy Bypass switches.

Answer

Delete the amsi.dll file from C:\Windows\System32 and reboot the target host.

Question 11

During an authorized penetration test, you discover that a web application’s password reset page reflects the `email` parameter inside a JavaScript string literal with no output encoding. You want to execute arbitrary JavaScript in a victim’s browser when they click a crafted password-reset link. Which payload should you use?

Accepted Answer

`";alert(document.domain)//`. The reflection occurs inside a JavaScript string literal, so the payload must first break out of that string using a matching quote, then execute code. The double-quote-based payload with a comment terminator achieves this while preserving the rest of the script’s syntax. HTML-oriented payloads fail because the parser is already inside a script data state, not an HTML tag or attribute context.

Answer

`<script>alert(document.domain)</script>`

Answer

`' onmouseover='alert(document.domain)`

Answer

`javascript:alert(document.domain)`

Question 12

You have a low-privileged shell on a Windows 10 machine. While enumerating, you find that the folder C:\Program Files\CustomApp is writable by the Everyone group. Inside, there is an executable named updater.exe that is run as a service with SYSTEM privileges. However, the service is currently stopped. You want to escalate privileges by replacing updater.exe with a malicious binary. What is the most reliable way to ensure your malicious binary is executed with SYSTEM privileges?

Accepted Answer

Replace updater.exe with your malicious executable and then start the service using `sc start <servicename>`.. When a service binary is in a writable directory, replacing it with a malicious executable and then starting the service will run the payload as SYSTEM. Because the service is stopped, you can overwrite the file without issues. Using `sc start` is the direct way to trigger execution. Waiting for a reboot is uncertain, and schtasks is for scheduled tasks, not services.

Answer

Replace updater.exe and wait for the system to reboot, as services are automatically started on boot.

Answer

Replace updater.exe and then use `schtasks /run /tn <servicename>` to trigger the service.

Answer

Replace updater.exe and then use `wmic service where name='<servicename>' call startservice`.

Question 13

During a penetration test on a Windows Server 2019 host, you obtain a low-privileged shell as user 'webuser'. You run 'whoami /priv' and observe that the account has SeImpersonatePrivilege enabled. Which exploitation technique is most directly applicable?

Accepted Answer

Use a token impersonation attack such as JuicyPotato or PrintSpoofer to impersonate a SYSTEM token.. SeImpersonatePrivilege permits a process to impersonate another user's token. Attackers exploit this by forcing a privileged service to authenticate to a controlled endpoint, then impersonating its token to gain SYSTEM-level access. Tools like JuicyPotato, RoguePotato, or PrintSpoofer automate this. The other options require permissions not granted by this privilege, such as file write or administrative task creation.

Answer

Schedule a task to run as SYSTEM using schtasks with the /RU SYSTEM flag.

Answer

Modify a service binary that runs as SYSTEM to execute a reverse shell.

Answer

Extract password hashes from the SAM database using Mimikatz and pass-the-hash.

Question 14

A penetration tester is preparing a Windows payload for a client engagement where the target endpoint runs a traditional signature-based antivirus product that does not perform cloud lookups. The tester wants to reduce the chance that the raw output of msfvenom is flagged during initial delivery. Which action best addresses this goal?

Accepted Answer

Compile a custom loader that embeds the shellcode in an encrypted form and decrypts it at runtime, rather than delivering the raw msfvenom executable.. Signature-based antivirus matches known byte patterns in files. To avoid that match, the delivered artifact must not contain those known patterns. Building a custom loader that stores shellcode in encrypted form produces a file whose bytes differ entirely from the raw msfvenom output, so the original signature no longer applies. Compression and renaming leave the executable bytes intact, and well-known encoders like shikata_ga_nai are themselves signatured.

Answer

Rename the payload file to a benign-looking name such as invoice.pdf.exe and set the archive attribute.

Answer

Use msfvenom's -e encoder option with shikata_ga_nai and iterate the encoding multiple times.

Answer

Pipe the msfvenom output through gzip and deliver the compressed archive to the target.

Question 15

You have compromised a Linux system and extracted the /etc/shadow file. The root account's hash is prefixed with $6$. Which of the following statements is true regarding cracking this hash?

Accepted Answer

The hash is a SHA-512 crypt hash and can be cracked with tools like John the Ripper or Hashcat.. The $6$ prefix in /etc/shadow indicates SHA-512 crypt, a secure password hashing algorithm. It is not encryption, so it cannot be decrypted; it must be cracked. John the Ripper and Hashcat both support SHA-512 crypt and are commonly used for this purpose. The other options misidentify the algorithm or misunderstand the nature of password hashing.

Answer

The hash is a bcrypt hash and requires the Blowfish algorithm to crack.

Answer

The hash is a DES hash and can be cracked quickly due to its short key length.

Answer

The hash is encrypted with AES-256 and requires a key to decrypt.