PEN-200 Practice Test 2 — 30 Questions

Question 1

During a red team engagement, a tester writes a C# loader that calls the Win32 API function VirtualAllocEx to allocate memory in a remote process, writes shellcode, and creates a remote thread. The loader compiles and runs, but the endpoint's EDR blocks it before the remote thread executes. The tester confirms the EDR is hooking user-mode API functions in ntdll.dll. Which approach most directly avoids the user-mode hooks that triggered the block?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement direct system calls by reading the syscall numbers from a clean copy of ntdll.dll and executing the syscall instruction directly from the loader's own code.. User-mode EDR hooks are implemented by patching the entry points of functions inside ntdll.dll. Any call that goes through those functions, whether via the kernel32 wrapper or the Nt-prefixed export, passes through the hook. Direct system calls sidestep the problem by placing the syscall instruction in the loader's own code with the correct service number, so execution transitions to kernel mode without touching the hooked ntdll stubs. This is the most reliable way to bypass user-mode hooking without altering system DLLs.

Answer

Add the /DYNAMICBASE:NO linker flag so the loader's base address does not change between runs.

Answer

Replace the calls to VirtualAllocEx and CreateRemoteThread with their NtAllocateVirtualMemory and NtCreateThreadEx equivalents from ntdll.dll.

Answer

Call VirtualProtect on the ntdll.dll .text section to restore the original bytes before invoking the API.

Question 2

During a PEN-200 lab, a penetration tester develops a custom C# loader that allocates memory, writes shellcode, and executes it. Windows Defender's AMSI flags the process when the shellcode buffer is passed to a scanning routine. The tester wants to prevent AMSI from inspecting the buffer at runtime without disabling Defender. Which technique should the tester apply?

Accepted Answer

Use the AmsiScanBuffer function's memory patching to force it to return a clean result.. AMSI scans buffers passed to functions like AmsiScanBuffer; to evade it without disabling Defender, the tester can patch AmsiScanBuffer in memory to return a benign result. This prevents the shellcode from being flagged. Encoding, CFG, or user privileges do not stop AMSI from scanning the buffer at runtime.

Answer

Run the loader under a different user account with limited privileges.

Answer

Base64-encode the shellcode and decode it at runtime before execution.

Answer

Compile the loader with the /guard:cf flag to enable Control Flow Guard.

Question 3

A penetration tester needs to deliver a Meterpreter payload to a Windows target protected by an EDR that performs both static file scanning and behavioral monitoring of process creation. The tester wants to reduce the chance of detection during initial execution while still obtaining a session. Which two techniques most directly reduce detection in this combined scenario? (Choose two.)

Accepted Answer

Spawn the payload by injecting into a legitimate, already-running process such as explorer.exe rather than starting a new process.. The scenario involves two distinct controls: static file scanning and behavioral process monitoring. A custom loader with encrypted shellcode removes recognizable bytes from disk, defeating static signatures. Injecting into an existing trusted process avoids the new-process creation event that behavioral engines monitor, placing execution inside a process already deemed legitimate. Together these address both controls. Renaming, UPX packing, and registry tampering either leave the static bytes intact or generate their own high-signal events.

Answer

Disable Windows Defender real-time protection by modifying the registry before executing the payload.

Answer

Rename the payload executable to svchost.exe and place it in the user's temp directory.

Answer

Compress the payload with UPX and deliver it as a self-extracting archive.

Question 4

An attacker gains a low-privilege shell on a Windows 10 machine and discovers a third-party service named 'DataSync'. The attacker notes that the service runs as SYSTEM and they have 'FILE_WRITE_DATA' permissions on the service executable 'C:\Program Files\DataSync\sync.exe'. Which action is the most direct method to escalate privileges to SYSTEM?

Accepted Answer

Stop the service, replace 'sync.exe' with a malicious payload, and restart the service.. Service binary hijacking is a powerful technique where an attacker replaces a legitimate executable with a malicious one. Since the service runs as SYSTEM, the replaced binary will execute with those high privileges upon the next service start. This method is often more reliable than DLL hijacking because it directly controls the primary execution flow of the service, provided the attacker can restart the service or wait for a system reboot.

Answer

Place a malicious DLL named 'sync.dll' in the 'C:\Windows\System32' directory to intercept calls.

Answer

Modify the service configuration using 'sc config' to point to a different malicious executable.

Answer

Create a new service with the same name in the 'HKCU' registry hive to override the system service.

Question 5

A junior penetration tester is preparing a payload for a Windows 10 target and wants to avoid signature-based detection by changing the binary's appearance without altering its functionality. Which technique is specifically designed to achieve this?

Accepted Answer

Encoding the payload with msfvenom's shikata_ga_nai encoder multiple times.. Shikata_ga_nai is a polymorphic encoder that mutates the payload's bytes while preserving its functionality, directly targeting signature-based detection by changing the binary appearance. The other options either do not alter the binary signature, are easily unpacked, or change only the delivery mechanism rather than the payload's bytes.

Answer

Splitting the payload into multiple chunks and reassembling at runtime.

Answer

Running the payload from a remote SMB share instead of the local disk.

Answer

Compressing the payload with UPX to reduce its size.

Question 6

When reviewing 'sudo -l' output, what does the 'NOPASSWD' tag signify for the listed command?

Accepted Answer

The command can be run as root without entering a password.. The 'NOPASSWD' tag indicates that the user can execute the specified command with sudo privileges without being prompted for their own password. This is a critical misconfiguration, as it removes the authentication barrier for privilege escalation. In an attack scenario, it allows for immediate, automated execution of commands as root, which is significantly more dangerous than configurations that still require a user to authenticate via their password.

Answer

The user is automatically added to the root group.

Answer

The command is not logged by the system administrator.

Answer

The command will run in a sandbox for security.

Question 7

Which command-line tool is primarily used during the reconnaissance phase to identify open ports and service versions on a remote target?

Accepted Answer

Nmap. Nmap is the industry-standard tool for port scanning and service enumeration. By identifying open ports and the software versions running on them, a tester can pinpoint specific vulnerabilities to research. This step is the foundation of the reconnaissance phase, as it maps the target's attack surface and guides the subsequent selection of exploits, ensuring a focused and efficient penetration testing process.

Answer

netcat

Answer

Wireshark

Answer

grep

Question 8

You have compromised a Windows server and want to escalate privileges using the `AlwaysInstallElevated` setting. You check the registry and find that both `HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` are set to 1. What is the most direct way to leverage this misconfiguration?

Accepted Answer

Create a malicious MSI package and execute it with `msiexec /quiet /qn /i malicious.msi` to run with SYSTEM privileges.. With AlwaysInstallElevated enabled in both registry hives, any MSI package installed by a user runs with SYSTEM privileges. The most direct exploitation is to create a malicious MSI that performs a privileged action, such as adding a user to the Administrators group, and then install it using `msiexec`. This leverages the misconfiguration exactly as designed.

Answer

Leverage the setting to bypass UAC and run any executable as an administrator without an MSI package.

Answer

Use `reg add` to modify the service binary path of a running service to point to a malicious executable.

Answer

Extract the MSI to a writable directory and replace a DLL to achieve privilege escalation.

Question 9

You identify a cron job running as root that executes a script located in a writable directory. What is the most reliable way to escalate privileges in this scenario?

Accepted Answer

Append a reverse shell command to the writable script.. When a cron job runs as root, any script it executes also runs with root privileges. If the script is writeable by a low-privileged user, it can be modified to include a reverse shell. This is a common misconfiguration that highlights the importance of checking file permissions and cron job schedules during the post-exploitation phase of a penetration test or a professional security assessment.

Answer

Modify the /etc/shadow file directly.

Answer

Restart the crond service to force execution.

Answer

Change the ownership of the script using chmod.

Question 10

You are developing an exploit for a 32-bit Windows application that contains a stack-based buffer overflow. After overwriting EIP with a JMP ESP address, you place a payload that includes a reverse shell. During testing, the shell connects back successfully, but the application crashes immediately after the shell terminates. What is the most likely cause of the crash?

Accepted Answer

The shellcode lacks a proper exit sequence, causing the process to execute invalid memory after the shell ends.. The crash after the shell terminates suggests that the shellcode does not properly exit the process. When shellcode completes, it must call a termination function like ExitProcess; otherwise, the CPU continues executing whatever bytes follow, often leading to an access violation. The other options are inconsistent with the observed successful shell connection, which confirms that the overwrite and shellcode execution were correct.

Answer

The offset to EIP was miscalculated, causing the return address to be overwritten with an incorrect value.

Answer

The shellcode was encoded with an XOR encoder that corrupted the payload after execution.

Answer

The JMP ESP address contains a null byte, which truncates the payload during transmission.

Question 11

Why might a public exploit for a specific service fail to execute even when the service version matches the vulnerability description exactly?

Accepted Answer

The target environment has different memory protections or patch levels.. Public exploits are typically written against a specific environment, which may differ from your target's configuration. Variations in operating systems, patch levels, installed libraries, or memory protection mechanisms like ASLR and DEP can prevent the exploit from succeeding. Understanding these environmental dependencies is key to troubleshooting failed exploits, as it often requires you to manually port or adjust the exploit to fit the target's unique security posture.

Answer

The exploit code is always written in an incompatible shell format.

Answer

Public exploits are intentionally corrupted to prevent usage.

Answer

You forgot to increase the network timeout settings.

Question 12

You have identified an open port 445 on a Windows machine. Which tool is most effective for checking if the machine is vulnerable to common SMB-based exploits like EternalBlue?

Accepted Answer

Use Nmap with the --script smb-vuln-ms17-010 argument.. Nmap's scripting engine (NSE) is the most effective way to check for specific vulnerabilities like EternalBlue without requiring a full-scale vulnerability scanner. The 'smb-vuln-ms17-010' script is specifically designed to detect this vulnerability. Using such targeted scripts allows for accurate assessment with minimal footprint, which is a hallmark of professional penetration testing practices, ensuring the system's security posture is evaluated safely and effectively during the reconnaissance phase.

Answer

Use ping to verify the host is reachable.

Answer

Run a full Nessus scan against the IP.

Answer

Use telnet to manually send an exploit string.

Question 13

You need to fingerprint the web server technology behind an HTTP service without sending malformed or intrusive requests. Which two actions best accomplish passive-leaning banner and behavior fingerprinting during enumeration? (Choose two.)

Accepted Answer

Inspect the Server and X-Powered-By response headers returned in the HTTP reply.. Header inspection and error-page analysis both identify server technology using ordinary, non-destructive requests. Headers may name the server and runtime directly, while distinctive 404 templates expose the stack when banners are hidden. Together they fingerprint the web service safely, whereas crash attempts, full port sweeps, and credential guessing are intrusive or simply unrelated to identifying the technology.

Answer

Send a buffer of several thousand bytes in the request line to provoke a crash signature.

Answer

Run a full TCP port scan of all 65535 ports on the host to infer the web stack.

Answer

Attempt default administrative credentials against the web login form.

Question 14

You have a Windows host with outbound internet access but want to avoid installing a full agent. You decide to use Chisel to pivot. Which statement accurately describes how Chisel establishes the tunnel in this scenario?

Accepted Answer

The Chisel client on the compromised host connects outbound to the Chisel server on your attacking machine, and the server can expose a SOCKS proxy on your side.. Chisel's client dials the server, so a compromised host with only outbound access can still establish a tunnel. When the server is started with reverse tunneling and SOCKS support, the operator gets a SOCKS proxy locally that routes through the client into the internal network. This makes Chisel a practical choice when a full agent is undesirable.

Answer

Chisel encrypts traffic only when the --tls flag is used, and otherwise sends plaintext over the wire.

Answer

The Chisel server must run on the compromised host so the client on your attacking machine can pull traffic from the internal network.

Answer

Chisel requires a kernel TUN interface on both endpoints to carry the tunneled traffic.

Question 15

Why must you carefully identify 'bad characters' before finalizing an exploit payload?

Accepted Answer

To ensure the shellcode is correctly copied into memory in its entirety.. Bad characters are bytes that cause a function or protocol to stop processing input prematurely. If these characters exist in your shellcode, the application will truncate the payload. Identifying these characters ensures that the full exploit string is correctly placed into memory, allowing the overflow to reach the return address and execute the shellcode as intended without corruption or partial injection.

Answer

To prevent the shellcode from triggering an antivirus alert.

Answer

To allow the CPU to perform faster instruction decoding.

Answer

To bypass DEP (Data Execution Prevention) controls.

Question 16

You are performing a penetration test against a Linux server and have obtained a copy of the /etc/shadow file. The file contains a hash for user 'admin' that starts with '$6$'. You want to crack this hash offline. Which hashcat mode should you use?

Accepted Answer

Mode 1800 (sha512crypt). The '$6$' prefix in /etc/shadow denotes SHA-512 crypt, which is handled by hashcat mode 1800 (sha512crypt). The other modes correspond to different algorithms: mode 500 for md5crypt ('$1$'), mode 3200 for bcrypt ('$2a$'), and mode 7400 for sha256crypt ('$5$'). Using the correct mode is essential for successful cracking. Therefore, mode 1800 is the right choice.

Answer

Mode 7400 (sha256crypt)

Answer

Mode 3200 (bcrypt)

Answer

Mode 500 (md5crypt)

Question 17

You are testing a web application that sets a session cookie with the HttpOnly flag. You find a reflected XSS vulnerability on a page that does not require authentication. What is the primary impact of exploiting this XSS given the HttpOnly flag?

Accepted Answer

You can execute arbitrary JavaScript in the victim’s browser to perform actions as the victim, but you cannot directly read the session cookie via document.cookie.. HttpOnly is designed to prevent client-side scripts from reading cookie values, but it does not prevent script execution or stop the browser from sending the cookie with requests. An attacker who achieves XSS can still act as the victim by issuing requests, reading page content, or capturing keystrokes. The session cookie may be inaccessible to document.cookie, but the authenticated session remains exploitable.

Answer

You can read the session cookie using document.cookie because HttpOnly only applies to cookies set over HTTPS.

Answer

You can bypass HttpOnly by using XMLHttpRequest to fetch the cookie from the server’s response headers.

Answer

You cannot execute JavaScript at all because HttpOnly blocks all script execution on the page.

Question 18

Which of the following best describes the function of the EIP register in the context of a stack-based buffer overflow?

Accepted Answer

It points to the memory address of the next instruction to be executed.. The EIP (Extended Instruction Pointer) register holds the memory address of the next instruction the CPU should execute. In an exploit, the goal is to overwrite this register by corrupting the saved return address on the stack. When the function finishes, the CPU pops this controlled value into EIP, forcing the processor to jump to the attacker's shellcode, thus hijacking the control flow of the entire application.

Answer

It stores the current stack frame's base address.

Answer

It keeps track of the number of active threads.

Answer

It holds the results of arithmetic operations.

Question 19

Refer to the exhibit. If you attempt an SSH remote port forward (-R) to bind a port to all network interfaces on the server, what will happen?

Accepted Answer

The port will be bound to 127.0.0.1 instead of 0.0.0.0.. The 'GatewayPorts no' setting in the sshd_config specifically prevents forwarded ports from binding to any interface other than the loopback (localhost). Even if the user specifies 0.0.0.0 or a public IP in their SSH command, the server will ignore this request and bind the port only to 127.0.0.1. This is a common security hardening measure to prevent unauthorized access to forwarded ports from external networks.

Answer

The request will be rejected and the connection will close.

Answer

The server will allow the binding because it is a superuser request.

Answer

The connection will hang indefinitely.

Question 20

During an authorized web application assessment, you discover a search page that reflects the query parameter directly into the HTML response body without encoding. You want to confirm the presence of a reflected cross-site scripting vulnerability using a minimal, non-destructive payload. Which of the following payloads is most likely to execute JavaScript in a victim's browser when injected into the vulnerable parameter?

Accepted Answer

. Reflected cross-site scripting occurs when user input is immediately returned by the web server without proper output encoding, allowing an attacker to inject client-side script. A script tag containing a simple alert is a reliable proof of concept because it executes in the victim's browser context when the crafted URL is visited. The other payloads target SQL injection or path traversal and do not demonstrate JavaScript execution.

Answer

1' OR '1'='1

Answer

../../../../etc/passwd

Answer

'; DROP TABLE users; --