PEN-200 Practice Exam 4 — 20 Questions

Question 1

During a buffer overflow exploit development, you need to ensure that your shellcode does not contain any null bytes. You have generated shellcode that includes a null byte. Which of the following is the most appropriate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an encoder such as Shikata Ga Nai to encode the shellcode, which will remove null bytes and add a decoder stub.. When shellcode contains bad characters like null bytes, encoding it with a tool like Shikata Ga Nai is the standard solution. The encoder transforms the shellcode into a null-free version and adds a decoder stub that reconstructs the original code in memory. This allows the exploit to deliver the payload without the bad characters causing premature termination. It is a fundamental step in exploit development, especially for stack-based overflows.

Answer

Manually replace the null byte with a NOP (0x90) instruction.

Answer

Split the shellcode into two parts and execute them sequentially using a staged payload.

Answer

Use a different shellcode that does not contain null bytes, such as one generated with the 'alpha_mixed' encoder.

Question 2

You are on a Windows 10 machine and discover that the folder 'C:\Temp' has permissions: BUILTIN\Users:(F). You also notice that a scheduled task runs every hour, executing 'C:\Temp\cleanup.exe' as SYSTEM. However, cleanup.exe does not exist in the folder. What is the most effective way to escalate privileges?

Accepted Answer

Place a malicious cleanup.exe in C:\Temp and wait for the scheduled task to run.. The scheduled task runs a missing executable from a writable directory as SYSTEM. By placing a malicious cleanup.exe in C:\Temp, you ensure that the task executes your code with SYSTEM privileges. This is a classic privilege escalation via weak folder permissions and scheduled tasks.

Answer

Use icacls to change permissions on the scheduled task file.

Answer

Create a new scheduled task that runs as SYSTEM.

Answer

Modify the scheduled task to run a different command using schtasks.

Question 3

Refer to the exhibit. You identify an Apache 2.4.49 vulnerability and locate the exploit. After reviewing the exploit code, you realize it requires a specific input format to trigger the path traversal. What is the most effective way to verify the vulnerability without crashing the server?

Accepted Answer

Use a simple path traversal payload to request a harmless file.. Verification is a critical phase where you test for the vulnerability's presence using non-destructive inputs. By attempting a benign request, such as reading a safe, non-sensitive file like a public README, you confirm the exploit works without risking a Denial of Service. This professional approach demonstrates a cautious mindset, essential for performing assessments that prioritize target stability while successfully confirming the vulnerability exists.

Answer

Execute the exploit immediately against the root directory.

Answer

Run the exploit as is and hope the server remains stable.

Answer

Modify the exploit to dump the entire password file immediately.

Question 4

Why does enabling 'SMB Signing' prevent NTLM relay attacks?

Accepted Answer

It validates the integrity of the authentication packets. SMB Signing adds a cryptographic signature to each packet in an SMB communication. When a relay attack occurs, the attacker does not possess the session key required to generate these signatures for the relayed packets. Consequently, the target server detects the missing or invalid signature and rejects the authentication attempt, effectively neutering the relay attack at the protocol level.

Answer

It encrypts the entire SMB session using TLS

Answer

It requires the client to prove they have the password

Answer

It disables NTLM authentication globally

Question 5

During an internal assessment, you compromise a workstation and recover a cached domain credential hash for a user who previously logged on. You want to use this hash to authenticate to a file server on the same network, but you do not know the plaintext password. Which of the following tools is specifically designed to perform Pass-the-Hash authentication from a Linux-based attack platform?

Accepted Answer

Impacket's psexec.py. Pass-the-Hash requires a tool that can supply an NTLM hash directly during authentication. Impacket's psexec.py is a Python implementation of PsExec that accepts -hashes, enabling authentication to SMB shares with a hash. The other tools either crack hashes offline, harvest credentials, or extract credentials locally, none of which achieve remote authentication with a hash.

Answer

Hashcat with mode 1000

Answer

Responder with the -w flag

Answer

Mimikatz with the sekurlsa::logonpasswords module

Question 6

Which repository is generally considered the most reliable starting point for finding verified, community-contributed public exploits during an OSCP assessment?

Accepted Answer

The Exploit Database (Exploit-DB) via Searchsploit.. Searchsploit, a command-line tool for the Exploit Database (EDB), is the industry standard for identifying public exploits. It provides a searchable, offline archive of exploits, which is crucial when internet access is limited or unavailable during an exam. Utilizing this tool helps identify specific vulnerability versions and common exploit patterns, allowing for efficient mapping of known vulnerabilities to the target services identified during the enumeration phase.

Answer

A random forum dedicated to malware distribution.

Answer

The dark web marketplace for zero-day vulnerabilities.

Answer

The latest compiled binary downloads from unknown websites.

Question 7

You are performing a network scan on a target network and notice that ICMP echo requests are blocked, but you need to determine if the target host is alive. Which technique should you utilize to identify active hosts without relying on standard ICMP ping?

Accepted Answer

Perform a TCP SYN scan on common ports such as 80, 443, and 22.. When ICMP is filtered by firewalls, TCP SYN scanning on common ports like 80 or 443 is an effective alternative for host discovery. This technique works because the target system responds to a SYN packet with a SYN/ACK if the port is open, or an RST if closed, confirming the host's presence. Mastering non-ICMP discovery is critical for bypass techniques in hardened network environments where security policies block traditional discovery methods.

Answer

Send a UDP packet to port 53 and wait for a DNS response.

Answer

Use ARP scanning regardless of the network topography.

Answer

Send a broadcast ping to the entire subnet range.

Question 8

Which THREE of the following are considered 'active' reconnaissance techniques, as opposed to passive techniques?

Accepted Answer

Port scanning with Nmap.. Active reconnaissance involves direct interaction with the target system, which creates a visible footprint in server logs. Techniques like port scanning, service version detection, and directory brute-forcing are all active because they involve sending packets that the target must respond to. In contrast, passive reconnaissance uses third-party services to gather information without touching the target. Understanding this distinction is vital for maintaining the desired level of stealth throughout the reconnaissance and exploitation process.

Answer

WHOIS lookup.

Answer

Searching Google for public documents.

Question 9

An application is vulnerable to Server-Side Request Forgery (SSRF). You want to use this to scan the internal network. Which target should you attempt to access first to verify the vulnerability?

Accepted Answer

The local loopback address (127.0.0.1) or localhost.. The local loopback address is the most reliable target for verifying SSRF. If the server fetches content from 127.0.0.1, it confirms that the application is making requests on behalf of the user. This is a critical prerequisite before attempting to pivot into the internal network, as it proves that the application's request-handling mechanism can be subverted to interact with restricted infrastructure.

Answer

A known external public domain like google.com.

Answer

The default gateway IP of the server's network.

Answer

An arbitrary private IP address like 10.0.0.1.

Question 10

Refer to the exhibit. An analyst observes this response header after a successful login. What is the security implication of the 'HttpOnly' and 'Secure' flags set on the 'session_id' cookie?

Accepted Answer

The session is protected against XSS theft and cleartext interception.. These security flags are critical for session hardening. 'HttpOnly' prevents client-side scripts from accessing the cookie via document.cookie, mitigating XSS-based session theft. 'Secure' ensures the cookie is only transmitted over encrypted HTTPS connections, preventing interception via man-in-the-middle attacks. Together, they provide a defense-in-depth layer protecting user session integrity, which is essential for maintaining secure authentication sessions against common web-based attacks during the post-authentication phase of an engagement.

Answer

The flags guarantee protection against all SQL injection.

Answer

The cookie will be accessible to JavaScript, but not via HTTP.

Answer

The cookie will be automatically deleted when the browser closes.

Question 11

You have identified an outdated version of a web application running on a target. You found a public exploit script for this version on Exploit-DB. Which step is most critical before executing the exploit script against the target?

Accepted Answer

Review the source code to verify target parameters and modify hardcoded configurations.. Validating the exploit code is essential because public scripts often contain hardcoded IP addresses, paths, or shellcode that may not match your environment. Modifying the script ensures it executes properly, avoids unintended network traffic, and prevents potential instability on the target service. Failure to review code can lead to silent failure, false positives, or accidental service crashes, hindering your overall progress during an assessment.

Answer

Immediately run the script with root privileges to ensure full access.

Answer

Upload the script directly to the target system via a browser-based upload form.

Answer

Convert the script into a binary executable using a compiler to hide its nature.

Question 12

Which resource is most reliable for verifying that a public exploit is legitimate and does not contain hidden backdoors?

Accepted Answer

A reputable source like Exploit-DB or a verified GitHub repository.. Verifying exploit integrity is crucial to prevent self-compromise. Official repositories and reputable security platforms provide peer-reviewed code. By examining the source code manually and checking the history of the repository, you can identify suspicious commands like hardcoded reverse shells to unknown addresses. Relying on reputable sources minimizes the risk of executing malicious code designed to target the researcher's own machine during an engagement.

Answer

The 'Download' link from an anonymous search result page.

Answer

A public exploit video on social media showcasing the hack.

Answer

Running the script inside a browser-based online compiler.

Question 13

You have found a Python exploit that uses the 'requests' library but your target machine only has standard Python installed. What is your best course of action?

Accepted Answer

Modify the script to use standard Python libraries instead.. When a public exploit has unmet dependencies, the most efficient approach is to rewrite the exploit to use standard libraries or ensure the dependency is met in a way that doesn't disrupt the target. In an exam, you often cannot install external packages on the target. Therefore, porting the functionality to native libraries like 'urllib' ensures your exploit remains portable and functional without requiring additional, potentially unavailable, software installations.

Answer

Upload the library to the target machine.

Answer

Install the library on your own machine and hope it works.

Answer

Give up on this exploit and find a different one.

Question 14

When analyzing the memory of a compromised system, you find that your shellcode is being detected by behavioral monitoring. What is the most effective approach to reduce the likelihood of detection by EDR systems during process injection?

Accepted Answer

Utilizing indirect syscalls to execute memory operations without triggering API hooks.. Behavioral detection focuses on suspicious API calls, such as VirtualAllocEx and WriteProcessMemory, being called by an unauthorized or unexpected process. By using indirect syscalls or alternative memory allocation methods, you can bypass the hooks that security products place on high-level Windows APIs. This is critical in modern testing because EDRs monitor process interactions in real-time, making standard injection techniques trivial for security software to identify and block immediately.

Answer

Increasing the sleep interval between shellcode execution stages.

Answer

Injecting the shellcode into a low-privilege process to minimize impact.

Answer

Replacing the shellcode with an equivalent set of PowerShell commands.

Question 15

You have gained a low-privileged shell on a Linux system and discovered a binary with the SUID bit set. The binary executes a system call to 'cat' without specifying an absolute path. How can you leverage this to escalate privileges?

Accepted Answer

Prepend a directory containing a malicious 'cat' script to the PATH variable and run the binary.. By manipulating the PATH environment variable, you can point the system to a malicious 'cat' executable created in a writable directory. When the SUID binary runs, it executes your script with the permissions of the file owner rather than yours. This technique exploits the insecure execution of external commands, a common vulnerability in improperly coded SUID binaries that allows for arbitrary command execution under an elevated security context.

Answer

Overwrite the SUID binary's source code in /usr/src to include a reverse shell.

Answer

Use 'chmod' to grant everyone execute permissions on the SUID binary to trigger a buffer overflow.

Answer

Modify the /etc/ld.so.preload file to inject a malicious library into the SUID binary's execution flow.

Question 16

When performing a kernel exploit for privilege escalation, what is the most significant risk to the stability of the target system?

Accepted Answer

The system might experience a kernel panic, causing a complete crash.. Kernel exploits operate at the lowest level of the operating system. If the exploit code contains errors or interacts incorrectly with kernel memory structures, it can lead to a kernel panic, crashing the entire system. This is a significant operational risk, as it results in downtime and potentially triggers alerts that lead to discovery, emphasizing the need for caution and testing exploits in isolated environments before deployment on production targets.

Answer

The system will automatically log the attacker's IP address.

Answer

The exploit will permanently delete all data on the disk.

Answer

The system firewall will automatically block the user account.

Question 17

Why are static memory addresses for 'JMP ESP' preferred over dynamic stack addresses?

Accepted Answer

Static addresses remain constant across different executions.. Stack addresses change during every execution of a program due to factors like system environment variables and memory allocation. If you use a hardcoded stack address in your exploit, it will likely be invalid the next time the program runs. A static JMP ESP address, found in a loaded DLL or the binary itself, remains constant, providing a reliable and stable redirect for your shellcode execution every time.

Answer

Static addresses are faster to access by the CPU.

Answer

Static addresses are less likely to contain bad characters.

Answer

Static addresses are protected by DEP and ASLR.

Question 18

When fuzzing an application to identify a buffer overflow, what is the most common symptom indicating that the application's memory boundaries have been exceeded?

Accepted Answer

The application returns an 'Access Violation' or 'Segmentation Fault'. Fuzzing involves sending large amounts of data to an application to find stability issues. The most common indicator of a buffer overflow is the application crashing, specifically resulting in a segmentation fault or an access violation. This occurs because the injected data has overwritten critical stack memory, such as the return address, causing the CPU to attempt an execution from an invalid or unauthorized memory location.

Answer

The application begins to consume high CPU resources

Answer

The application prints a stack dump to the console

Answer

The application generates a new network port listener

Question 19

You are performing a client-side phishing engagement and need to deliver a malicious payload using an ISO image file. Why is this delivery method often effective against modern Windows security warnings?

Accepted Answer

Windows natively mounts ISO files without requiring external software, and extracted payloads can evade certain Mark of the Web propagation behaviors. ISO image files can be mounted natively by Windows without third-party software, and files contained within the ISO often inherit a lower severity of Mark of the Web restrictions when extracted or executed, helping bypass certain SmartScreen prompts compared to direct web downloads.

Answer

ISO files automatically disable Windows Defender Antivirus real-time protection upon mounting

Answer

ISO files encrypt all internal payload binaries, rendering static signature analysis completely impossible

Answer

Mark of the Web attributes are permanently stripped from all files stored within virtual disk containers

Question 20

You have successfully found the exact offset to overwrite the EIP register and identified a reliable JMP ESP instruction inside an unProtected DLL. However, when your shellcode executes, the program immediately crashes with an access violation before launching the payload. Inspection reveals that the stack pointer (ESP) points directly to the beginning of your shellcode, but the memory page housing the stack lacks execution permissions. Which modern defense mechanism is preventing your exploit from succeeding?

Accepted Answer

Data Execution Prevention (DEP) configured as OptOut or OptIn across the operating system environment.. Data Execution Prevention marks memory regions such as the stack and heap as non-executable to prevent malicious code from running directly from those locations. When an exploit attempts to jump into shellcode residing on the stack, the CPU generates an access violation because execution permissions are explicitly denied on that memory page.

Answer

Control Flow Guard (CFG) validating indirect call targets against a pre-compiled bitmap of valid function entries.

Answer

Address Space Randomization relocating the base addresses of operating system libraries dynamically on every reboot.

Answer

Structured Exception Handling Overwrite Protection guarding exception handler chains from malicious pointer manipulation.