PEN-200 Practice Test 21 — 15 Questions

Question 1

During an internal penetration test you compromise a domain-joined workstation and recover a user's NTLMv2 hash via a forced authentication attempt. SMB signing is enforced on all servers, and the client will not initiate outbound SMB connections. You want to crack the credential offline rather than relay it. Which approach is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Responder in analyze mode to capture the challenge/response, then run Hashcat with mode 5600 against the captured netntlmv2 hash and a targeted wordlist.. The captured artifact is an NTLMv2 challenge/response, which is only useful for offline cracking. SMB signing prevents relay, and the client's outbound SMB restriction blocks additional capture avenues. Hashcat mode 5600 is the correct cracking mode for netntlmv2, and a targeted wordlist improves efficiency against a real user's password.

Answer

Use ntlmrelayx.py with the --no-smb-server flag to forward the authentication to a domain controller and dump the SAM database.

Answer

Use CrackMapExec with the --hash option to spray the netntlmv2 response across the domain and identify where the account is valid.

Answer

Run Mimikatz with the sekurlsa::pth module to inject the captured NTLMv2 response into a new logon session and authenticate as the user.

Question 2

A junior penetration tester is preparing a payload for a Windows 10 target with Windows Defender enabled. The tester wants to avoid writing the payload to disk and decides to use a PowerShell one-liner that downloads and executes a script in memory. Which PowerShell feature allows the script to be executed directly from a downloaded string without saving it to a file?

Accepted Answer

Invoke-Expression (IEX) with a downloaded string.. Invoke-Expression takes a string and runs it as PowerShell code. By pairing it with a download cradle, the tester can retrieve a script into memory and execute it without touching disk. This is a standard in-memory execution technique for PowerShell. The other cmdlets either do not execute arbitrary PowerShell code, require local files, or are intended for different purposes such as loading .NET types or modules, so they do not fulfill the requirement.

Answer

Add-Type with a downloaded assembly.

Answer

Start-Process with the -FilePath parameter pointing to a URL.

Answer

Import-Module with a URL to a .psm1 file.

Question 3

A public exploit for a Windows service is written in Python and uses the 'impacket' library. On your Kali attacker machine, running it fails with an ImportError for impacket. What is the most appropriate next step?

Accepted Answer

Install the impacket package on Kali using the distribution's package manager or pip, then rerun the exploit.. The ImportError indicates a missing Python dependency, not a flaw in the exploit. Installing impacket through the package manager or pip restores the required protocol library and lets the script run as written. Rewriting the exploit, changing interpreter versions, or copying library folders all introduce new problems without addressing the missing package.

Answer

Copy the impacket directory from a different tool's installation folder into the exploit's working directory.

Answer

Rewrite the exploit to use raw sockets so no external library is required.

Answer

Run the exploit with Python 2 instead of Python 3 to avoid the import error.

Question 4

During a Windows privilege escalation assessment, you encounter a service with an unquoted service path: 'C:\Program Files\Vulnerable Service\service.exe'. The service runs as LocalSystem. Which TWO conditions must be true for you to successfully exploit this unquoted service path? (Choose two.)

Accepted Answer

You must be able to restart the service or trigger a system reboot.. To exploit an unquoted service path, you need write access to a directory that Windows searches before the legitimate binary, and you must be able to cause the service to execute (by restarting it or rebooting). The other conditions are not required: the service can be manual, the binary can be present, and you do not need admin rights.

Answer

The service must be configured to start automatically.

Answer

The service binary must be missing from its intended location.

Answer

You must have administrative privileges to exploit the service.

Question 5

You are reviewing a public exploit for a Linux-based web application. The exploit script contains a function that constructs a payload using a format string vulnerability. Which of the following best describes the primary risk of using this exploit without modification on a target with a different libc version?

Accepted Answer

The addresses of libc functions such as system() may differ, causing the exploit to jump to an invalid location.. When an exploit relies on hardcoded addresses of libc functions, those addresses are specific to the libc version used during development. On a target with a different libc, the addresses will differ, causing the exploit to fail or crash. This is a common pitfall when using public exploits across varied environments.

Answer

The exploit may trigger a stack canary check, which is not present in the original environment.

Answer

The format string offset may differ, causing the exploit to write to an incorrect memory address.

Answer

The format string vulnerability may be patched in the newer libc, rendering the exploit ineffective.

Question 6

During an internal penetration test, you compromise a Linux host that has outbound SSH access to your attacking machine but cannot directly reach an internal Windows server on 10.10.10.5:445. You need to forward SMB traffic through the compromised host so that your local tools can connect to 10.10.10.5:445. Which command should you run from your attacking machine to create the required tunnel?

Accepted Answer

ssh -L 127.0.0.1:4450:10.10.10.5:445 user@compromised-host. A local port forward with -L listens on your attacking machine and forwards through the SSH server to a destination reachable from that server. The syntax is -L [bind_address:]local_port:target_host:target_port. Here, the compromised host can reach 10.10.10.5:445, so binding locally and pointing the forward at the internal SMB service provides the required access.

Answer

ssh -R 127.0.0.1:4450:10.10.10.5:445 user@compromised-host

Answer

ssh -D 127.0.0.1:4450 user@compromised-host

Answer

ssh -L 10.10.10.5:445:127.0.0.1:4450 user@compromised-host

Question 7

Which THREE of the following are essential steps when manually exploiting a stack-based buffer overflow?

Accepted Answer

Identifying the crash offset by using a pattern generator.. Exploiting a buffer overflow requires a structured methodology to ensure the payload executes correctly. The process begins with identifying the crash and the exact offset to the return address. Once the offset is found, the investigator must locate a viable jump address and filter for bad characters that would break the payload. Finally, the shellcode is generated and tested to confirm that execution is successfully redirected to the desired payload.

Answer

Disabling all firewall rules on the victim machine.

Answer

Upgrading the target application to the latest version.

Question 8

You have obtained a copy of a Windows SAM file from a compromised host. You want to extract the NTLM hashes for offline cracking. Which of the following tools is specifically designed for this task?

Accepted Answer

secretsdump.py. Extracting NTLM hashes from a SAM file is a common post-exploitation step. secretsdump.py from Impacket is specifically built to parse SAM, SYSTEM, and other registry hives to recover local account hashes. Mimikatz focuses on memory extraction, Responder captures network traffic, and Hydra performs online brute force. Therefore, secretsdump.py is the correct tool for offline SAM parsing.

Answer

Mimikatz

Answer

Responder

Answer

Hydra

Question 9

Which TWO of the following statements correctly describe the function of a NOP sled in a buffer overflow exploit?

Accepted Answer

It provides a wider range of addresses for successful jump redirection.. A NOP sled (No-Operation) is a sequence of instructions that do nothing but pass control to the next instruction. It is critical for increasing the reliability of an exploit by providing a larger landing zone for the instruction pointer. If the exact address of the shellcode fluctuates due to environment variables or minor stack shifts, the NOP sled ensures the CPU eventually slides into the functional payload.

Answer

It acts as a primary payload to bypass antivirus software.

Answer

It executes complex arithmetic to prepare registers for shellcode.

Answer

It is required to disable hardware-based stack protections.

Question 10

During enumeration of a Windows host, you run `whoami /priv` and see that the current user has SeImpersonatePrivilege enabled. You have also uploaded a custom executable to C:\Windows\Temp. Which privilege escalation technique is most directly applicable in this situation?

Accepted Answer

Exploit the SeImpersonatePrivilege using a tool such as PrintSpoofer or RoguePotato to impersonate a SYSTEM token.. SeImpersonatePrivilege permits a process to impersonate another user's token, and tools like PrintSpoofer exploit this by tricking a privileged service into connecting to a controlled endpoint, then impersonating the resulting token. This is a direct escalation path when the privilege is enabled, making it the most applicable technique here.

Answer

Dump LSASS memory using a tool like Mimikatz to extract plaintext credentials and then use them to log in as an administrator.

Answer

Modify the service binary path of a running service to point to your uploaded executable and restart the service.

Answer

Use `runas /savecred` to execute a command as the local administrator without knowing the password.

Question 11

During an internal assessment, you compromise a Windows host that can reach a segmented network. You want to run a SOCKS proxy on the compromised Windows host so that your Kali tools can reach internal targets through it. Which tool is specifically designed for this purpose and commonly used in PEN-200 scenarios?

Accepted Answer

Chisel. Chisel is purpose-built for tunneling and can run as a SOCKS proxy server on a compromised host, with a client on the attacker machine connecting back or forward. This makes it well suited for Windows pivots where you want a single binary that handles HTTP transport and SOCKS. Netcat, Nmap, and Wireshark serve different roles and cannot provide a SOCKS proxy service for arbitrary tools.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 12

You are exploiting a buffer overflow in a 32-bit Windows application and have overwritten EIP with a JMP ESP address. However, when the shellcode executes, it fails to establish a reverse shell, and the application crashes. You suspect that the shellcode contains bad characters. Which of the following is the most effective way to identify bad characters in the shellcode?

Accepted Answer

Send all possible byte values (0x00 to 0xFF) in a buffer and observe which bytes are missing or altered in memory after the crash.. The most effective way to identify bad characters is to send all possible byte values and inspect memory for alterations. This reveals exactly which bytes are filtered or cause truncation. Stepping through shellcode or encoding blindly does not systematically identify bad characters. The all-bytes test is a standard step in exploit development to ensure shellcode integrity.

Answer

Encode the shellcode with an XOR encoder and assume that all bad characters are resolved.

Answer

Send a series of 'A' characters followed by the shellcode and check if the shellcode executes.

Answer

Use a debugger to set a breakpoint at the start of the shellcode and step through each instruction to see where it fails.

Question 13

Given the exhibit, what is the correct strategy to redirect control flow to the shellcode?

Accepted Answer

Overwrite the EIP value with the address 0x77E14C29.. To redirect execution, you must replace the EIP value (currently 0x41414141) with the memory address of a JMP ESP instruction. The JMP ESP instruction serves as a pivot point that redirects the CPU to the stack, where your shellcode is located. By placing the address 0x77E14C29 in the exact offset where EIP is overwritten, the CPU will execute the jump instead of attempting to return to the original, now-corrupted address.

Answer

Replace the EIP value with 0x0012FF70.

Answer

Nop out the EIP value with 0x90909090.

Answer

Force the program to jump to the base address 0x00400000.

Question 14

During a buffer overflow exploit development, you need to determine the exact number of bytes required to overwrite the EIP register. Which method is most commonly used to find this offset?

Accepted Answer

Generate a unique cyclic pattern, send it as input, and observe the value of EIP to calculate the offset.. The cyclic pattern method is the most efficient and precise way to find the EIP offset. By sending a unique pattern, the value in EIP after a crash directly indicates the offset when compared to the pattern. Other methods like sending 'A's or binary search are less precise or more labor-intensive. Debugger inspection can complement but is not the primary method for offset discovery.

Answer

Perform a binary search by sending payloads of varying lengths and checking if EIP is overwritten.

Answer

Send a series of 'A' characters in increasing lengths until the application crashes.

Answer

Use a debugger to set a breakpoint on the return instruction and inspect the stack pointer.

Question 15

Which of the following describes the security benefit of the 'HttpOnly' flag shown in the exhibit?

Accepted Answer

It prevents the cookie from being accessed by JavaScript.. The 'HttpOnly' flag prevents client-side scripts from accessing the cookie via the document.cookie API. This is a crucial defense against session hijacking attacks, as it ensures that even if an attacker successfully executes a Cross-Site Scripting (XSS) payload, they cannot steal the session identifier. This protection layer is a standard security configuration for sensitive session cookies in modern web applications.

Answer

It ensures the cookie is only sent over encrypted HTTPS connections.

Answer

It stops the browser from sending the cookie in cross-site requests.

Answer

It automatically regenerates the session ID every 30 minutes.