PEN-200 Practice Test 19 — 15 Questions

Question 1

A penetration tester discovers that the current user can write to a script located in /opt/backup/ that is executed every minute by a cron job running as root. The script has permissions `-rwxr-xr-x 1 root root`. What is the MOST reliable way to escalate privileges?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the script to add a reverse shell command, then wait for the cron job to execute.. Because the script is writable and executed by root, an attacker can insert arbitrary commands that run with root privileges. Modifying the script to spawn a reverse shell or create a SUID backdoor is the most direct and reliable method. The cron job will execute the modified script as root, granting escalation.

Answer

Use the `at` command to schedule a script that modifies the cron job.

Answer

Change the script's permissions to 777 and then execute it manually.

Answer

Create a symbolic link to /etc/passwd in the same directory and modify the script to write to it.

Question 2

You are exploiting a 32-bit Linux buffer overflow and have overwritten EIP with the address of a `JMP ESP` instruction located in a non-ASLR module. However, when you run the exploit, the program crashes with a segmentation fault, and no shell is obtained. You verify that the offset is correct and the JMP ESP address is accurate. What is the most likely reason for the failure?

Accepted Answer

The stack is not executable, so the shellcode placed on the stack cannot run.. The most likely reason is that the stack is non-executable (NX enabled). Even with a correct JMP ESP and offset, the CPU cannot execute shellcode on the stack, leading to a segmentation fault. This is a common obstacle on modern Linux systems. The other options are ruled out because the scenario confirms the offset and JMP ESP address are correct, and bad characters would not prevent the JMP ESP from executing.

Answer

The shellcode contains bad characters that were not filtered, causing it to be truncated.

Answer

The JMP ESP instruction address contains a null byte, which terminates the string copy.

Answer

The offset to EIP was miscalculated, so the return address is overwritten with an incorrect value.

Question 3

During a client-side assessment, you find that an application accepts a user-supplied URL parameter and later uses it to redirect the browser away from the site without validating the destination. Which vulnerability class does this behavior represent, and what is its most direct client-side impact?

Accepted Answer

Open redirect, because the browser can be sent to an attacker-controlled destination for phishing or credential harvesting. An unvalidated redirect parameter turns the trusted application into an open redirect. Because the link points at the legitimate domain, victims are more likely to trust it, and the attacker can land them on a credential-harvesting page or malicious download. The key impact is phishing facilitation, not script execution or request forgery.

Answer

CSRF, because the redirect causes the victim to submit a forged request

Answer

Clickjacking, because the redirect overlays a transparent frame on the page

Answer

DOM-based XSS, because the redirect executes script in the victim's browser

Question 4

You are analyzing a target web application that reflects user input directly into an HTML attribute without proper sanitization. Which vulnerability class should you primarily investigate for exploitation?

Accepted Answer

Cross-Site Scripting (XSS). Reflected Cross-Site Scripting occurs when untrusted user input is immediately processed and returned by a web application in an unsafe context, such as within an HTML attribute. Identifying this flaw allows attackers to craft malicious URLs that execute arbitrary JavaScript in the victim browser.

Answer

SQL Injection

Answer

Remote Code Execution

Answer

Cross-Site Request Forgery

Question 5

You have obtained a low-privileged shell on a Windows Server 2016 machine. While enumerating, you notice that the 'SeImpersonatePrivilege' is enabled for your user account. You also find that the machine is running a service with a named pipe '\.\pipe\svcctl' that is accessible. Which tool is specifically designed to exploit this privilege to escalate to SYSTEM?

Accepted Answer

JuicyPotato. JuicyPotato is designed to exploit SeImpersonatePrivilege by coercing a privileged process to authenticate to a malicious named pipe, then impersonating its token. This allows escalation to SYSTEM. PowerUp and WinPEAS are enumeration tools, and Mimikatz is for credential dumping, not privilege escalation via token impersonation.

Answer

WinPEAS

Answer

PowerUp

Answer

Mimikatz

Question 6

You are conducting a client-side attack using a weaponized Microsoft Office document containing a malicious VBA macro. Which user interaction and application setting combination is required for the macro to execute successfully by default?

Accepted Answer

The user must click 'Enable Content' in the security banner after the file opens in Protected View. By default, modern Microsoft Office applications block macros in files obtained from the internet using Office Protected View and Antimalware Scan Interface integrations. Users must explicitly click 'Enable Content' in the Security Warning banner after opening the file for the VBA code to run.

Answer

The user must double-click the document while holding down the Shift key to bypass AutoOpen restrictions

Answer

The file must be saved in the local startup directory and the user must open the application normally

Answer

The target workstation must have macro auditing disabled via Group Policy Objects before execution

Question 7

When using Searchsploit, what is the purpose of the '-m' flag?

Accepted Answer

To mirror (copy) the exploit to the current directory.. The '-m' flag in Searchsploit is used to mirror or copy an exploit file from the local database into your current working directory. This is highly useful because it allows you to easily edit and configure the exploit script without modifying the original source files, keeping your environment organized and enabling quick modifications to fit specific target requirements during a penetration test.

Answer

To move the exploit file to the root directory.

Answer

To mark the exploit as malicious.

Answer

To monitor the exploit for execution errors.

Question 8

Which THREE 'Living off the Land' (LotL) binaries are frequently used by penetration testers to download or execute malicious code while bypassing basic antivirus restrictions?

Accepted Answer

certutil.exe. Living off the Land binaries (LoLBins) are legitimate, pre-installed Windows tools that can be repurposed for malicious activities. Using these tools is effective for evasion because they are signed by Microsoft and are often whitelisted by security policies. Certutil, Mshta, and Regsvr32 are classic examples that can fetch remote files or execute scripts while appearing as normal system operations.

Answer

calc.exe

Answer

notepad.exe

Question 9

You are enumerating a Linux host and discover TCP port 2049 open. You need to determine what is being exported and to whom before deciding on any exploitation path. Which action most directly answers that question?

Accepted Answer

Run showmount -e <target> to list exported filesystems and permitted clients.. NFS enumeration centers on the mount protocol, which advertises exported directories and the client hosts or networks authorized to mount them. The showmount utility with the -e flag performs exactly that query against the target. Other tools suggested here speak SMB, RDP, or FTP, none of which correspond to the NFS service listening on port 2049, so they cannot reveal export details or access restrictions.

Answer

Run smbclient -L //<target> -N to list available SMB shares.

Answer

Use ftp <target> 2049 and authenticate anonymously to browse the share.

Answer

Connect with rdesktop <target>:2049 to inspect the remote desktop session.

Question 10

During a penetration test against a web application, you identify a parameter vulnerable to Blind SQL Injection. The backend database is Microsoft SQL Server, and the application does not return any error messages or query results. Which technique should you use to exfiltrate data character by character based on application behavior?

Accepted Answer

Using conditional statements paired with database delay functions like WAITFOR DELAY to measure response time variations. Time-based blind SQL injection relies on database-specific delay functions like WAITFOR DELAY in Microsoft SQL Server to force the server to pause execution when a logical condition is true. This technique is critical during assessments when out-of-band channels are blocked and standard response inspection fails, allowing testers to systematically recover sensitive information through latency measurements.

Answer

Injecting UNION SELECT statements combined with string concatenation to dump table contents directly into the main HTTP response body

Answer

Leveraging stacked queries with xp_cmdshell to execute operating system commands and retrieve files via a reverse shell connection

Answer

Triggering detailed database syntax errors to leak table names and column definitions through the application error handler

Question 11

Refer to the exhibit. The 'find' binary has the SUID bit set. How can you leverage this to gain a root shell?

Accepted Answer

find . -exec /bin/sh -p \;. The 'find' command includes an '-exec' flag that allows executing arbitrary commands on the files it locates. When an SUID-bit 'find' binary is used with the '-exec' flag, the command spawned by '-exec' will also run with the SUID owner's privileges. This is a well-documented technique for privilege escalation, demonstrating why SUID binaries must be audited to ensure they do not offer functionality that can be abused for command execution.

Answer

find . -name "*" -delete

Answer

find . -exec chmod 777 /etc/shadow \;

Answer

find / -user web -exec ls -l {}

Question 12

Which TWO methods are effective for obfuscating a PowerShell script to bypass AMSI without modifying the underlying system DLLs?

Accepted Answer

String Concatenation. PowerShell obfuscation for AMSI bypass focuses on making the script content unrecognizable to the scanner. String concatenation breaks up known malicious keywords, while variable randomization ensures that simple signature matches fail. These techniques are applied directly to the script code and do not require administrative privileges to patch memory or modify protected system files like amsi.dll.

Answer

Memory Patching

Answer

Registry Modification

Answer

Kernel Driver Loading

Question 13

Which TWO of the following techniques are most effective for enumerating SMB shares on a Windows host during a penetration test?

Accepted Answer

Use smbclient -L //target_ip -N to list available shares.. Enumerating SMB shares is crucial for identifying sensitive data, configuration files, or scripts that can lead to privilege escalation. Tools like smbclient and specialized scripts allow testers to interact with the SMB protocol to list shares and check for null sessions. Understanding these methods is fundamental for gathering intelligence in Windows environments, as misconfigured SMB permissions often provide an easy path to sensitive information and potential system compromise.

Answer

Perform a brute-force attack on the C$ share.

Answer

Attempt to ping the host using ICMP to check SMB connectivity.

Answer

Use the telnet command to connect to port 445.

Question 14

While auditing a web application, you identify an endpoint that retrieves profile images via a URL parameter: 'image.php?file=profile.jpg'. Changing the parameter to 'image.php?file=/etc/passwd' returns the contents of the system password file. Which vulnerability is present, and what is the primary risk?

Accepted Answer

Path Traversal, allowing arbitrary file disclosure.. This scenario demonstrates Path Traversal, where improper input validation allows access to unauthorized files outside the web root. Exploiting this flaw can lead to sensitive information disclosure, such as configuration files, credentials, or system binaries. It is a critical finding because it grants an attacker arbitrary file read access, which is often the precursor to full system compromise if sensitive keys or database credentials are exposed.

Answer

Remote Code Execution via file inclusion.

Answer

SQL Injection, allowing database schema enumeration.

Answer

Cross-Site Scripting, allowing session hijacking.

Question 15

During an internal penetration test, you obtain an NTDS.dit file and the associated SYSTEM registry hive. You need to crack the NTLM password hashes extracted from these files using Hashcat. Which command-line argument correctly specifies the hash type for standard Windows NTLM hashes?

Accepted Answer

hashcat -m 1000 -a 0 hashes.txt wordlist.txt. Hashcat mode 1000 specifically targets Windows NTLM password hashes extracted from Active Directory or SAM databases. Specifying the correct hash mode is essential because Hashcat uses specialized algorithms and optimization routines tailored to the exact cryptographic structure of each supported hash format during the attack.

Answer

hashcat -m 0 -a 0 hashes.txt wordlist.txt

Answer

hashcat -m 5600 -a 0 hashes.txt wordlist.txt

Answer

hashcat -m 3000 -a 0 hashes.txt wordlist.txt