PEN-200 Practice Test 7 — 10 Questions

Question 1

During a buffer overflow exploit development, you need to ensure that your shellcode does not contain any null bytes. You have generated shellcode that includes a null byte. Which of the following is the most appropriate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an encoder such as Shikata Ga Nai to encode the shellcode, which will remove null bytes and add a decoder stub.. When shellcode contains bad characters like null bytes, encoding it with a tool like Shikata Ga Nai is the standard solution. The encoder transforms the shellcode into a null-free version and adds a decoder stub that reconstructs the original code in memory. This allows the exploit to deliver the payload without the bad characters causing premature termination. It is a fundamental step in exploit development, especially for stack-based overflows.

Answer

Manually replace the null byte with a NOP (0x90) instruction.

Answer

Split the shellcode into two parts and execute them sequentially using a staged payload.

Answer

Use a different shellcode that does not contain null bytes, such as one generated with the 'alpha_mixed' encoder.

Question 2

You are on a Windows 10 machine and discover that the folder 'C:\Temp' has permissions: BUILTIN\Users:(F). You also notice that a scheduled task runs every hour, executing 'C:\Temp\cleanup.exe' as SYSTEM. However, cleanup.exe does not exist in the folder. What is the most effective way to escalate privileges?

Accepted Answer

Place a malicious cleanup.exe in C:\Temp and wait for the scheduled task to run.. The scheduled task runs a missing executable from a writable directory as SYSTEM. By placing a malicious cleanup.exe in C:\Temp, you ensure that the task executes your code with SYSTEM privileges. This is a classic privilege escalation via weak folder permissions and scheduled tasks.

Answer

Use icacls to change permissions on the scheduled task file.

Answer

Create a new scheduled task that runs as SYSTEM.

Answer

Modify the scheduled task to run a different command using schtasks.

Question 3

Refer to the exhibit. You identify an Apache 2.4.49 vulnerability and locate the exploit. After reviewing the exploit code, you realize it requires a specific input format to trigger the path traversal. What is the most effective way to verify the vulnerability without crashing the server?

Accepted Answer

Use a simple path traversal payload to request a harmless file.. Verification is a critical phase where you test for the vulnerability's presence using non-destructive inputs. By attempting a benign request, such as reading a safe, non-sensitive file like a public README, you confirm the exploit works without risking a Denial of Service. This professional approach demonstrates a cautious mindset, essential for performing assessments that prioritize target stability while successfully confirming the vulnerability exists.

Answer

Execute the exploit immediately against the root directory.

Answer

Run the exploit as is and hope the server remains stable.

Answer

Modify the exploit to dump the entire password file immediately.

Question 4

Why does enabling 'SMB Signing' prevent NTLM relay attacks?

Accepted Answer

It validates the integrity of the authentication packets. SMB Signing adds a cryptographic signature to each packet in an SMB communication. When a relay attack occurs, the attacker does not possess the session key required to generate these signatures for the relayed packets. Consequently, the target server detects the missing or invalid signature and rejects the authentication attempt, effectively neutering the relay attack at the protocol level.

Answer

It encrypts the entire SMB session using TLS

Answer

It requires the client to prove they have the password

Answer

It disables NTLM authentication globally

Question 5

During an internal assessment, you compromise a workstation and recover a cached domain credential hash for a user who previously logged on. You want to use this hash to authenticate to a file server on the same network, but you do not know the plaintext password. Which of the following tools is specifically designed to perform Pass-the-Hash authentication from a Linux-based attack platform?

Accepted Answer

Impacket's psexec.py. Pass-the-Hash requires a tool that can supply an NTLM hash directly during authentication. Impacket's psexec.py is a Python implementation of PsExec that accepts -hashes, enabling authentication to SMB shares with a hash. The other tools either crack hashes offline, harvest credentials, or extract credentials locally, none of which achieve remote authentication with a hash.

Answer

Hashcat with mode 1000

Answer

Responder with the -w flag

Answer

Mimikatz with the sekurlsa::logonpasswords module

Question 6

Which repository is generally considered the most reliable starting point for finding verified, community-contributed public exploits during an OSCP assessment?

Accepted Answer

The Exploit Database (Exploit-DB) via Searchsploit.. Searchsploit, a command-line tool for the Exploit Database (EDB), is the industry standard for identifying public exploits. It provides a searchable, offline archive of exploits, which is crucial when internet access is limited or unavailable during an exam. Utilizing this tool helps identify specific vulnerability versions and common exploit patterns, allowing for efficient mapping of known vulnerabilities to the target services identified during the enumeration phase.

Answer

A random forum dedicated to malware distribution.

Answer

The dark web marketplace for zero-day vulnerabilities.

Answer

The latest compiled binary downloads from unknown websites.

Question 7

You are performing a network scan on a target network and notice that ICMP echo requests are blocked, but you need to determine if the target host is alive. Which technique should you utilize to identify active hosts without relying on standard ICMP ping?

Accepted Answer

Perform a TCP SYN scan on common ports such as 80, 443, and 22.. When ICMP is filtered by firewalls, TCP SYN scanning on common ports like 80 or 443 is an effective alternative for host discovery. This technique works because the target system responds to a SYN packet with a SYN/ACK if the port is open, or an RST if closed, confirming the host's presence. Mastering non-ICMP discovery is critical for bypass techniques in hardened network environments where security policies block traditional discovery methods.

Answer

Send a UDP packet to port 53 and wait for a DNS response.

Answer

Use ARP scanning regardless of the network topography.

Answer

Send a broadcast ping to the entire subnet range.

Question 8

Which THREE of the following are considered 'active' reconnaissance techniques, as opposed to passive techniques?

Accepted Answer

Port scanning with Nmap.. Active reconnaissance involves direct interaction with the target system, which creates a visible footprint in server logs. Techniques like port scanning, service version detection, and directory brute-forcing are all active because they involve sending packets that the target must respond to. In contrast, passive reconnaissance uses third-party services to gather information without touching the target. Understanding this distinction is vital for maintaining the desired level of stealth throughout the reconnaissance and exploitation process.

Answer

WHOIS lookup.

Answer

Searching Google for public documents.

Question 9

An application is vulnerable to Server-Side Request Forgery (SSRF). You want to use this to scan the internal network. Which target should you attempt to access first to verify the vulnerability?

Accepted Answer

The local loopback address (127.0.0.1) or localhost.. The local loopback address is the most reliable target for verifying SSRF. If the server fetches content from 127.0.0.1, it confirms that the application is making requests on behalf of the user. This is a critical prerequisite before attempting to pivot into the internal network, as it proves that the application's request-handling mechanism can be subverted to interact with restricted infrastructure.

Answer

A known external public domain like google.com.

Answer

The default gateway IP of the server's network.

Answer

An arbitrary private IP address like 10.0.0.1.

Question 10

Refer to the exhibit. An analyst observes this response header after a successful login. What is the security implication of the 'HttpOnly' and 'Secure' flags set on the 'session_id' cookie?

Accepted Answer

The session is protected against XSS theft and cleartext interception.. These security flags are critical for session hardening. 'HttpOnly' prevents client-side scripts from accessing the cookie via document.cookie, mitigating XSS-based session theft. 'Secure' ensures the cookie is only transmitted over encrypted HTTPS connections, preventing interception via man-in-the-middle attacks. Together, they provide a defense-in-depth layer protecting user session integrity, which is essential for maintaining secure authentication sessions against common web-based attacks during the post-authentication phase of an engagement.

Answer

The flags guarantee protection against all SQL injection.

Answer

The cookie will be accessible to JavaScript, but not via HTTP.

Answer

The cookie will be automatically deleted when the browser closes.