PEN-200 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. The command failed to crack the NTLM hash despite using a comprehensive wordlist. What is the most likely reason for this result?

Accepted Answer

The password is not present in the provided wordlist.. The 'Exhausted' status in Hashcat indicates that all candidates in the provided wordlist were tested against the hash, but none resulted in a match. In a penetration test, this suggests that the password complexity exceeds the provided dictionary content. The attacker must now pivot to alternative strategies such as rule-based attacks, mask attacks, or using a more extensive, custom-generated wordlist tailored to the target organization's password policies.

Answer

The hash type was incorrectly specified for NTLM.

Answer

The GPU memory limit was exceeded during processing.

Answer

The hash format is corrupted or invalid.

Question 2

Refer to the exhibit. As an attacker attempting to brute-force a web login, why is receiving this specific error message beneficial to your engagement?

Accepted Answer

It reveals information that allows you to prune your wordlist to only relevant password candidates.. This error message provides actionable intelligence regarding the target's password policy. By confirming the complexity requirements, you can refine your wordlists or mask attacks to target only valid password formats, drastically reducing the search space. This minimizes the time spent on invalid attempts and increases the probability of finding a match. Understanding how to leverage application feedback is a hallmark of efficient password-based exploitation.

Answer

It indicates that the account is currently locked and will not accept further attempts.

Answer

It confirms that the application uses a weak hashing algorithm that ignores complexity.

Answer

It implies that the application is vulnerable to SQL injection because of poor error handling.

Question 3

You have an SSH dynamic forward running on port 1080 to a compromised Linux host, and you want to use it with a tool that supports SOCKS5 natively. Which environment variable or configuration is most appropriate to direct the tool through the proxy without using proxychains?

Accepted Answer

Use the tool's native SOCKS5 option, such as --proxy socks5://127.0.0.1:1080 or the equivalent for that tool.. When a tool supports SOCKS5 natively, the cleanest approach is to use its built-in proxy option, specifying the SOCKS5 scheme and the local address and port of the SSH dynamic forward. This avoids the limitations of LD_PRELOAD-based wrappers and ensures the tool handles proxy negotiation correctly. Environment variables can work in some cases but are less consistent across different tools and libraries.

Answer

Set the ALL_PROXY environment variable to 127.0.0.1:1080.

Answer

Configure the tool to use a PAC file that points to 127.0.0.1:1080.

Answer

Set the http_proxy environment variable to socks5://127.0.0.1:1080.

Question 4

In the context of password cracking, what is a 'rule' in tools like Hashcat or John the Ripper?

Accepted Answer

A transformation applied to dictionary words to simulate common password modifications.. Rules allow attackers to transform wordlist entries into more complex passwords, such as adding numbers, changing casing, or substituting characters. This is a critical technique because it allows a small wordlist to cover a much larger search space of possible passwords. Mastering rules is essential for efficient credential recovery, as it enables the simulation of common user password creation habits without needing massive, unmanageable wordlists.

Answer

A predefined security policy set by the organization to ensure password complexity.

Answer

A configuration setting that defines the maximum length of the cracked password.

Answer

A list of known leaked passwords that the tool compares against the hash directly.

Question 5

While pivoting through a compromised host, you want to route an Impacket tool through a SOCKS proxy you established with SSH dynamic forwarding. The tool does not support SOCKS natively. Which approach allows the Impacket tool to use the proxy correctly?

Accepted Answer

Run the Impacket tool under proxychains, ensuring the proxychains configuration lists the SOCKS proxy and uses the appropriate proxy type.. Proxychains is the standard bridge for tools that cannot speak SOCKS. It hooks the process's network calls and forwards them to the SOCKS listener created by SSH dynamic forwarding, allowing Impacket tools to reach internal services. The configuration file must correctly identify the proxy address, port, and SOCKS version, otherwise connections fail or leak outside the tunnel.

Answer

Add a static route on the attacking machine for the internal subnet pointing at the SSH server's IP address.

Answer

Set the HTTP_PROXY environment variable to point at the SSH dynamic forwarding port before launching the Impacket tool.

Answer

Re-run the SSH session with the -L flag instead of -D so Impacket can connect directly to the internal host through a fixed local port.

Question 6

What is the primary objective of an 'AS-REP Roasting' attack?

Accepted Answer

To crack the password of an account without preauth. AS-REP Roasting targets user accounts where Kerberos preauthentication is disabled. By sending an AS-REQ without preauthentication, the domain controller returns an AS-REP containing a TGT encrypted with the user's password hash. The attacker can then extract this hash and perform offline brute-force cracking to recover the user's cleartext password. This is highly effective against service accounts that have been misconfigured to skip preauthentication.

Answer

To capture the KRBTGT hash from the domain controller

Answer

To bypass the need for an NTLM hash during relay

Answer

To escalate privileges via a forged Kerberos ticket

Question 7

Given the exhibit, why might using the address 0x00401020 to overwrite EIP be ineffective for shellcode execution?

Accepted Answer

The instruction does not redirect the CPU to the stack.. The instruction at 0x00401020 is a CALL [EAX], which does not transfer control to the stack where your shellcode resides. Instead, it attempts to call an address stored in the EAX register. Since you do not control EAX, this instruction will not lead to your shellcode. A successful exploit requires a direct jump to the stack pointer (JMP ESP) or a register you control, not a CALL instruction.

Answer

The memory address contains bad characters.

Answer

The address is located in the data segment.

Answer

The stack has already been corrupted by the padding.

Question 8

When an exploit script uses hardcoded memory addresses, why is it likely to fail on a modern target system?

Accepted Answer

Address Space Layout Randomization (ASLR) makes addresses dynamic.. Modern systems utilize Address Space Layout Randomization (ASLR), which randomizes the memory addresses of key system components and loaded libraries every time a program executes. Since hardcoded memory addresses in old or poorly written exploits rely on fixed locations, they will almost certainly point to invalid or incorrect memory areas on a modern system, causing the program to crash instead of executing the desired payload.

Answer

The hardcoded addresses are too long for modern systems.

Answer

Modern systems use 64-bit addresses instead of 32-bit.

Answer

The exploit code is missing the necessary buffer size.

Question 9

Refer to the exhibit. What is the primary vulnerability shown here?

Accepted Answer

The task executes a batch file that may be writable by users.. The scheduled task '\SystemTask' runs as 'SYSTEM' and executes 'C:\scripts\run.bat'. If a standard user has write access to 'run.bat' or the directory 'C:\scripts', they can modify the script to run any command. Since the task runs as SYSTEM, the modified command will also run as SYSTEM, leading to a simple and effective privilege escalation path via scheduled task hijacking.

Answer

The task is not running, so it is secure.

Answer

The task name '\SystemTask' is too generic.

Answer

Scheduled tasks cannot be used for privilege escalation.

Question 10

What is the primary purpose of using 'accesschk' during the enumeration phase of Windows privilege escalation?

Accepted Answer

To identify files and services with weak permissions.. Accesschk is a powerful tool from the Sysinternals suite used to check the permissions of files, directories, registry keys, and services. In privilege escalation, it allows an attacker to quickly find misconfigured resources that the current user can modify. By identifying these 'weak' permissions, the attacker can pinpoint specific targets for exploitation, such as replacing a service binary or modifying a sensitive script.

Answer

To bypass Windows Firewall rules.

Answer

To dump the SAM database for password hashes.

Answer

To automate the deployment of kernel exploits.

Question 11

Which tool is primarily used to perform BloodHound data collection to map out attack paths within an Active Directory environment?

Accepted Answer

SharpHound. BloodHound uses SharpHound as its data collector. SharpHound queries the Active Directory environment to identify relationships between users, groups, computers, and permissions. This data is then imported into the BloodHound graph database, allowing testers to visualize complex attack paths, such as shortest paths to Domain Admin, which would be difficult to identify through manual enumeration alone.

Answer

Mimikatz

Answer

Responder

Answer

PowerSploit

Question 12

While debugging a custom TCP server running on a Windows target, you send an overly long string of 'A' characters and notice that the application crashes, overwriting the EIP register with 0x41414141. What does this specific hex value indicate about the state of the debugger?

Accepted Answer

The instruction pointer has successfully been overwritten with user-controlled input consisting of the character 'A'.. The hexadecimal value 0x41 corresponds directly to the ASCII character 'A'. When the instruction pointer contains four of these bytes, it proves that the input buffer successfully overflowed the local stack frame and precisely replaced the saved return address, confirming vulnerability and providing exact control over the execution flow.

Answer

The application encountered an unhandled memory access violation due to a null pointer dereference in the heap management routines.

Answer

The operating system security controls detected a stack cookie mismatch and deliberately terminated the application process.

Answer

The CPU executed an illegal instruction opcode that triggered an exception within the kernel-mode driver framework.

Question 13

Why might a penetration tester use a 'jump host' when attempting to access an internal network segment?

Accepted Answer

Because the target segment is firewalled from the attacker.. A jump host acts as an intermediary system that has dual-homed network access, connecting the untrusted zone (or the internet) to the restricted internal segment. By compromising the jump host, the tester gains a foothold within the internal network. This is a standard strategy because direct access to backend servers is often blocked by firewalls, and the jump host is often the only permitted pathway for remote administration.

Answer

To increase the bandwidth of the connection.

Answer

To hide the attacker's IP from the destination server.

Answer

To provide a GUI-based interface for database management.

Question 14

You have compromised a Windows host and obtained credentials for a low-privileged domain user. You discover that this user has 'GenericWrite' permissions on a computer object in Active Directory. Which attack technique can you use to escalate privileges on that computer?

Accepted Answer

Use Resource-Based Constrained Delegation (RBCD) by modifying the computer's msDS-AllowedToActOnBehalfOfOtherIdentity attribute.. GenericWrite on a computer object permits modification of its attributes. Setting msDS-AllowedToActOnBehalfOfOtherIdentity enables Resource-Based Constrained Delegation, allowing a controlled account to impersonate users to that computer. This can lead to full compromise of the target machine. The other techniques require different permissions or local access, making them ineffective here.

Answer

Perform a Kerberoasting attack to extract service account hashes.

Answer

Exploit an unquoted service path on the target computer.

Answer

Conduct a DCSync attack to replicate domain controller hashes.

Question 15

When testing for DOM-based XSS, where should you focus your analysis to find the vulnerable code?

Accepted Answer

The application's source code, specifically looking for sinks like eval() or innerHTML.. DOM-based XSS occurs entirely on the client side, where JavaScript takes data from a 'source' (like the URL fragment) and passes it to a 'sink' (like innerHTML) without proper sanitization. Analyzing the client-side JavaScript code is essential to trace the data flow from these sources to the execution sinks. This is critical because the server might never see the malicious payload at all.

Answer

The server-side application logs for suspicious input patterns.

Answer

The database queries for evidence of script injection.

Answer

The server's response headers to check for security misconfigurations.