PEN-200 Practice Test 14 — 15 Questions

Question 1

A penetration tester has a working PowerShell-based stager that is being blocked by AMSI on a Windows 11 target. The tester wants to keep using PowerShell for convenience but needs the stager to run without AMSI inspecting the script content. Which technique most directly targets AMSI's inspection of the script?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obfuscate the stager and split it across multiple string concatenations and variable substitutions so the script text does not contain recognizable AMSI signatures.. AMSI inspects PowerShell script content by matching patterns against known malicious code. If the script text no longer contains those patterns, the inspection passes. Obfuscation through string splitting, concatenation, and dynamic construction changes the textual form while preserving the executed logic, so the stager runs. Execution policy and code signing are separate controls, and version downgrade is unreliable on patched Windows 11 systems where AMSI enforcement is not tied to the PowerShell version.

Answer

Set the PowerShell execution policy to Bypass using the -ExecutionPolicy Bypass parameter.

Answer

Sign the PowerShell script with a trusted code-signing certificate before execution.

Answer

Run the stager through a PowerShell downgrade to version 2 using the -Version 2 parameter.

Question 2

During an authorized internal penetration test, you discover that the corporate proxy does not perform SSL inspection and allows outbound HTTPS to any destination. You need to deliver a client-side payload over HTTPS while evading signature-based network detection. Which technique is most appropriate?

Accepted Answer

Serve the payload from a valid TLS certificate on a domain categorized as business-related, using domain fronting through a CDN.. Domain fronting through a CDN with a valid certificate and a business-categorized domain conceals the true destination in the TLS SNI, allowing the payload to be delivered over HTTPS while blending with legitimate traffic. This evades signature-based network detection that relies on domain or IP reputation.

Answer

Send the payload as a base64-encoded attachment in a plain SMTP email to the target user.

Answer

Host the payload on an unregistered domain with a self-signed certificate and rely on the user to click through the browser warning.

Answer

Embed the payload in an ICMP echo request and use a custom tunnel to the target workstation.

Question 3

You are tasked with delivering a Meterpreter payload to a Windows Server 2019 target protected by a next-generation antivirus that performs userland API hooking on NtAllocateVirtualMemory and NtProtectVirtualMemory. Your current C loader uses these APIs directly and is detected. Which technique is most appropriate to bypass the userland hooks without requiring kernel-level privileges?

Accepted Answer

Direct system calls by manually constructing the syscall stub and invoking the syscall instruction.. Direct system calls bypass userland API hooks because the hooks are placed in ntdll's exported functions, and invoking the syscall instruction directly skips that code. The other options either require kernel privileges, still transit the hooked APIs, or only address static detection rather than the behavioral hooks causing the detection.

Answer

Install a kernel-mode driver to remove the hooks from ntdll and restore original bytes.

Answer

Encrypt the payload with AES and decrypt it in memory just before execution.

Answer

Use PowerShell's Add-Type to compile the loader in memory, relying on the .NET runtime to bypass native hooks.

Question 4

You have a low-privileged shell on a Windows 10 workstation and discover that the folder 'C:\ProgramData\Updater' has weak permissions: the 'Users' group has 'Write' and 'Modify' rights. A scheduled task runs 'C:\ProgramData\Updater\update.exe' every hour as SYSTEM. What is the most reliable way to escalate privileges?

Accepted Answer

Replace update.exe with a malicious executable that adds your user to the Administrators group.. A writable directory containing a scheduled task's executable allows a low-privileged user to replace that executable with a malicious payload. When the task runs as SYSTEM, the payload executes with elevated privileges. This technique is straightforward and does not require additional vulnerabilities. The other options either require administrative rights or rely on unconfirmed application behavior.

Answer

Run a DLL hijacking attack by placing a malicious DLL in the folder and restarting the service.

Answer

Create a new scheduled task that runs as SYSTEM using schtasks /create /ru SYSTEM.

Answer

Use icacls to grant yourself Full Control on the folder, then modify the task's XML definition.

Question 5

You have compromised a Linux host and extracted the /etc/shadow file. The file contains a hash starting with `$6$`. Which hashing algorithm does this prefix indicate?

Accepted Answer

SHA-512crypt. In the modular crypt format, the prefix before the second `$` indicates the hashing algorithm. `$6$` is the standard identifier for SHA-512crypt, which is commonly used on modern Linux systems for storing password hashes in /etc/shadow. Recognizing this prefix allows a penetration tester to choose the correct cracking tool and mode, such as Hashcat mode 1800 or John the Ripper's sha512crypt format, to efficiently recover plaintext passwords.

Answer

MD5crypt

Answer

SHA-256crypt

Answer

bcrypt

Question 6

You have obtained a Windows domain user's NTLM hash and want to authenticate to a remote SMB service without cracking the hash or knowing the plaintext. Which tool and technique should you use to perform pass-the-hash against the target?

Accepted Answer

Use `crackmapexec smb -u -H ` to authenticate with the NTLM hash.. Pass-the-hash allows an attacker to authenticate using the NTLM hash directly, bypassing the need to crack it. CrackMapExec (NetExec) is specifically designed for this and includes the `-H` flag to supply the hash. The other options either attempt to crack the hash, use tools that do not support hash authentication, or misconfigure the syntax. The correct approach leverages the hash as a credential in the NTLM challenge-response protocol.

Answer

Use `john --format=NT <hashfile>` to crack the hash and then log in with the recovered password.

Answer

Use `smbclient -U % ///share` to authenticate with the hash.

Answer

Use `hydra -l -P smb://` to replay the hash as a password.

Question 7

You are assessing a web application that uses a strict Content Security Policy (CSP) with nonce-based script-src. You discover a reflected XSS vulnerability where your input is inserted into an existing <script> block that already has a valid nonce. Which action would most likely allow your JavaScript to execute despite the CSP?

Accepted Answer

Inject JavaScript code directly into the existing script block, leveraging the valid nonce.. The most effective action is to inject JavaScript directly into the existing script block that already carries a valid nonce. Since the CSP trusts scripts with that nonce, any code within that block executes without violation. This bypasses the need to create new script elements or guess nonces. It exploits the fact that the application reflects user input into a trusted script context, allowing arbitrary code execution.

Answer

Inject a new <script> tag with a guessed nonce value.

Answer

Use a data: URI in an iframe to execute JavaScript.

Answer

Break out of the existing script context and inject a new script element without a nonce.

Question 8

You are assessing a web application that reflects user input into an HTML attribute value without quotes, such as `<input value=USER_INPUT>`. Which payload is most likely to execute JavaScript in the victim’s browser?

Accepted Answer

`onmouseover=alert(document.domain)`. In an unquoted HTML attribute, attribute boundaries are defined by whitespace. Injecting a space followed by a new event handler attribute, such as onmouseover=alert(document.domain), adds executable JavaScript to the element. When the corresponding event fires, the code runs. Payloads that rely on quotes or script tags fail because the parser is already inside an attribute value and does not interpret them as structure.

Answer

`' onmouseover='alert(document.domain)`

Answer

`javascript:alert(document.domain)`

Answer

`"><script>alert(document.domain)</script>`

Question 9

During an internal assessment you compromise a workstation and recover a Kerberos TGS ticket from memory that belongs to a service account. Analysis shows the ticket was encrypted with the RC4-HMAC cipher using a key derived from the service account's password hash. You want to recover the plaintext password of that service account offline. Which action should you take?

Accepted Answer

Crack the ticket offline with Hashcat in mode 13100, since the ticket is encrypted with RC4-HMAC and its checksum can be attacked with a wordlist.. A service ticket encrypted with RC4-HMAC (etype 23) is protected by a key derived from the target service account's NT hash, so the ciphertext can be attacked entirely offline. Extracting the TGS-REP hash and running Hashcat mode 13100 against a wordlist recovers the plaintext password when it is weak, without generating additional authentication traffic against the domain.

Answer

Submit the ticket to the domain controller with GetUserSPNs.py and let the KDC decrypt it to disclose the service account's NT hash.

Answer

Convert the ticket to a .kirbi file and import it with Rubeus to request a service ticket that reveals the account password in the response.

Answer

Use Kerbrute to spray the recovered ticket against the domain controller and read the resulting authentication error codes.

Question 10

You are conducting a password spraying attack against an Active Directory environment. You have a list of common passwords and a list of usernames. To avoid locking out accounts, which approach should you take?

Accepted Answer

Spray one password against all usernames, then wait 30 minutes before trying the next password.. Password spraying avoids lockouts by trying a single password against many accounts, then waiting before the next password. This keeps the number of failed attempts per account below the lockout threshold within the observation window. Trying all passwords against one account or using high concurrency increases lockout risk. Rotating subsets without waiting can also accumulate attempts. Thus, spraying one password at a time with a delay is the correct approach.

Answer

Try all passwords against one username before moving to the next username.

Answer

Use a tool like Hydra to perform a dictionary attack with a high thread count to speed up the process.

Answer

Spray each password against a small subset of usernames, then rotate to another subset without waiting.

Question 11

During a penetration test, you want to exploit a client-side vulnerability by sending a link that will execute JavaScript in a victim’s browser when clicked. The target application uses a session cookie without the SameSite attribute. Which attack is most directly enabled by the missing SameSite attribute?

Accepted Answer

Cross-Site Request Forgery (CSRF). The SameSite cookie attribute controls whether cookies are sent with cross-site requests. Without it, a browser may include the session cookie when a victim’s browser makes a request to the target site from a different origin. An attacker can exploit this by crafting a page that automatically submits a state-changing request, such as a form POST, to the target application. The server sees the authenticated cookie and processes the action, which is the essence of CSRF.

Answer

Clickjacking

Answer

Reflected Cross-Site Scripting (XSS)

Answer

DOM-based Cross-Site Scripting (XSS)

Question 12

You have compromised a domain user account and discovered that the domain controller is running Windows Server 2016. You want to extract the KRBTGT account hash to create a Golden Ticket. Which two conditions are necessary to successfully perform a DCSync attack to obtain the KRBTGT hash? (Choose two.)

Accepted Answer

The compromised user account must have the Replicating Directory Changes All permission on the domain object.. To perform DCSync, the compromised account must possess both the Replicating Directory Changes and Replicating Directory Changes All permissions on the domain object. These permissions allow the account to impersonate a domain controller and request replication of directory data, including password hashes. While Domain Admins have these by default, any account with these delegated rights can execute the attack.

Answer

The compromised user account must be a member of the Domain Admins group.

Answer

The attacker must have local administrator access on the domain controller.

Answer

The domain functional level must be at least Windows Server 2008 or higher.

Question 13

You have obtained credentials for a domain user and want to enumerate Active Directory to find misconfigured ACLs that allow privilege escalation. You need to collect data that maps relationships between users, groups, computers, and sessions, and you want to visualize shortest paths to Domain Admin. Which tool and collection method best fits this requirement?

Accepted Answer

Run SharpHound with the -c All collection method and import the resulting JSON files into BloodHound for path analysis.. BloodHound with SharpHound is purpose-built for Active Directory attack path analysis. The -c All collection method gathers the full set of relationships, including ACLs and sessions, that BloodHound needs to compute shortest paths. Alternative enumeration tools may gather partial data but lack the graph-based analysis and visualization that makes escalation paths immediately actionable.

Answer

Execute CrackMapExec with the --shares and --sessions modules to enumerate shares and active sessions across the domain.

Answer

Run ldapsearch against the domain controller with a filter for objectClass=user and parse the output for group membership attributes.

Answer

Use PowerView's Invoke-ShareFinder to list accessible shares and infer privilege escalation paths from share permissions.

Question 14

You are performing a client-side attack against a web application that uses a JSON Web Token (JWT) stored in localStorage for authentication. You have identified a stored XSS vulnerability. Which two actions could you perform to escalate privileges or maintain access? (Choose two.)

Accepted Answer

Use the XSS to perform authenticated actions on behalf of the victim, such as changing their password.. The two effective actions are exfiltrating the JWT from localStorage to an attacker-controlled server and using the XSS to perform authenticated actions on behalf of the victim. Exfiltration allows the attacker to impersonate the victim from their own machine, while performing actions directly in the victim's session can achieve immediate escalation, such as changing the password. Both leverage the XSS to access the token or the authenticated session.

Answer

Inject a fake login form to capture the victim's credentials.

Answer

Overwrite the JWT in localStorage with a token from a different user account you control.

Answer

Modify the JWT in localStorage to change the user role to admin.

Question 15

During a penetration test, you discover that a web application uses an outdated version of a JavaScript library that contains a known DOM-based XSS vulnerability. The vulnerability is triggered when a specific URL parameter is processed by the library. Which action would best allow you to demonstrate the impact of this vulnerability to the client?

Accepted Answer

Craft a URL with a malicious payload in the vulnerable parameter and send it to a victim user.. The best action is to craft a URL with a malicious payload in the vulnerable parameter and send it to a victim. Because the vulnerability is DOM-based and triggered by URL parameters, visiting the link executes the payload in the victim's browser. This directly demonstrates the impact, such as session hijacking or data theft, and is a standard proof of concept for DOM-based XSS.

Answer

Perform a brute-force attack to guess the victim's credentials and log in as them.

Answer

Use a web proxy to intercept and modify the library's JavaScript file to include a malicious payload.

Answer

Exploit a SQL injection vulnerability to extract the library's source code and identify the flaw.