PEN-200 Practice Test 8 — 10 Questions

Question 1

You have identified an outdated version of a web application running on a target. You found a public exploit script for this version on Exploit-DB. Which step is most critical before executing the exploit script against the target?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the source code to verify target parameters and modify hardcoded configurations.. Validating the exploit code is essential because public scripts often contain hardcoded IP addresses, paths, or shellcode that may not match your environment. Modifying the script ensures it executes properly, avoids unintended network traffic, and prevents potential instability on the target service. Failure to review code can lead to silent failure, false positives, or accidental service crashes, hindering your overall progress during an assessment.

Answer

Immediately run the script with root privileges to ensure full access.

Answer

Upload the script directly to the target system via a browser-based upload form.

Answer

Convert the script into a binary executable using a compiler to hide its nature.

Question 2

Which resource is most reliable for verifying that a public exploit is legitimate and does not contain hidden backdoors?

Accepted Answer

A reputable source like Exploit-DB or a verified GitHub repository.. Verifying exploit integrity is crucial to prevent self-compromise. Official repositories and reputable security platforms provide peer-reviewed code. By examining the source code manually and checking the history of the repository, you can identify suspicious commands like hardcoded reverse shells to unknown addresses. Relying on reputable sources minimizes the risk of executing malicious code designed to target the researcher's own machine during an engagement.

Answer

The 'Download' link from an anonymous search result page.

Answer

A public exploit video on social media showcasing the hack.

Answer

Running the script inside a browser-based online compiler.

Question 3

You have found a Python exploit that uses the 'requests' library but your target machine only has standard Python installed. What is your best course of action?

Accepted Answer

Modify the script to use standard Python libraries instead.. When a public exploit has unmet dependencies, the most efficient approach is to rewrite the exploit to use standard libraries or ensure the dependency is met in a way that doesn't disrupt the target. In an exam, you often cannot install external packages on the target. Therefore, porting the functionality to native libraries like 'urllib' ensures your exploit remains portable and functional without requiring additional, potentially unavailable, software installations.

Answer

Upload the library to the target machine.

Answer

Install the library on your own machine and hope it works.

Answer

Give up on this exploit and find a different one.

Question 4

When analyzing the memory of a compromised system, you find that your shellcode is being detected by behavioral monitoring. What is the most effective approach to reduce the likelihood of detection by EDR systems during process injection?

Accepted Answer

Utilizing indirect syscalls to execute memory operations without triggering API hooks.. Behavioral detection focuses on suspicious API calls, such as VirtualAllocEx and WriteProcessMemory, being called by an unauthorized or unexpected process. By using indirect syscalls or alternative memory allocation methods, you can bypass the hooks that security products place on high-level Windows APIs. This is critical in modern testing because EDRs monitor process interactions in real-time, making standard injection techniques trivial for security software to identify and block immediately.

Answer

Increasing the sleep interval between shellcode execution stages.

Answer

Injecting the shellcode into a low-privilege process to minimize impact.

Answer

Replacing the shellcode with an equivalent set of PowerShell commands.

Question 5

You have gained a low-privileged shell on a Linux system and discovered a binary with the SUID bit set. The binary executes a system call to 'cat' without specifying an absolute path. How can you leverage this to escalate privileges?

Accepted Answer

Prepend a directory containing a malicious 'cat' script to the PATH variable and run the binary.. By manipulating the PATH environment variable, you can point the system to a malicious 'cat' executable created in a writable directory. When the SUID binary runs, it executes your script with the permissions of the file owner rather than yours. This technique exploits the insecure execution of external commands, a common vulnerability in improperly coded SUID binaries that allows for arbitrary command execution under an elevated security context.

Answer

Overwrite the SUID binary's source code in /usr/src to include a reverse shell.

Answer

Use 'chmod' to grant everyone execute permissions on the SUID binary to trigger a buffer overflow.

Answer

Modify the /etc/ld.so.preload file to inject a malicious library into the SUID binary's execution flow.

Question 6

When performing a kernel exploit for privilege escalation, what is the most significant risk to the stability of the target system?

Accepted Answer

The system might experience a kernel panic, causing a complete crash.. Kernel exploits operate at the lowest level of the operating system. If the exploit code contains errors or interacts incorrectly with kernel memory structures, it can lead to a kernel panic, crashing the entire system. This is a significant operational risk, as it results in downtime and potentially triggers alerts that lead to discovery, emphasizing the need for caution and testing exploits in isolated environments before deployment on production targets.

Answer

The system will automatically log the attacker's IP address.

Answer

The exploit will permanently delete all data on the disk.

Answer

The system firewall will automatically block the user account.

Question 7

Why are static memory addresses for 'JMP ESP' preferred over dynamic stack addresses?

Accepted Answer

Static addresses remain constant across different executions.. Stack addresses change during every execution of a program due to factors like system environment variables and memory allocation. If you use a hardcoded stack address in your exploit, it will likely be invalid the next time the program runs. A static JMP ESP address, found in a loaded DLL or the binary itself, remains constant, providing a reliable and stable redirect for your shellcode execution every time.

Answer

Static addresses are faster to access by the CPU.

Answer

Static addresses are less likely to contain bad characters.

Answer

Static addresses are protected by DEP and ASLR.

Question 8

When fuzzing an application to identify a buffer overflow, what is the most common symptom indicating that the application's memory boundaries have been exceeded?

Accepted Answer

The application returns an 'Access Violation' or 'Segmentation Fault'. Fuzzing involves sending large amounts of data to an application to find stability issues. The most common indicator of a buffer overflow is the application crashing, specifically resulting in a segmentation fault or an access violation. This occurs because the injected data has overwritten critical stack memory, such as the return address, causing the CPU to attempt an execution from an invalid or unauthorized memory location.

Answer

The application begins to consume high CPU resources

Answer

The application prints a stack dump to the console

Answer

The application generates a new network port listener

Question 9

You are performing a client-side phishing engagement and need to deliver a malicious payload using an ISO image file. Why is this delivery method often effective against modern Windows security warnings?

Accepted Answer

Windows natively mounts ISO files without requiring external software, and extracted payloads can evade certain Mark of the Web propagation behaviors. ISO image files can be mounted natively by Windows without third-party software, and files contained within the ISO often inherit a lower severity of Mark of the Web restrictions when extracted or executed, helping bypass certain SmartScreen prompts compared to direct web downloads.

Answer

ISO files automatically disable Windows Defender Antivirus real-time protection upon mounting

Answer

ISO files encrypt all internal payload binaries, rendering static signature analysis completely impossible

Answer

Mark of the Web attributes are permanently stripped from all files stored within virtual disk containers

Question 10

You have successfully found the exact offset to overwrite the EIP register and identified a reliable JMP ESP instruction inside an unProtected DLL. However, when your shellcode executes, the program immediately crashes with an access violation before launching the payload. Inspection reveals that the stack pointer (ESP) points directly to the beginning of your shellcode, but the memory page housing the stack lacks execution permissions. Which modern defense mechanism is preventing your exploit from succeeding?

Accepted Answer

Data Execution Prevention (DEP) configured as OptOut or OptIn across the operating system environment.. Data Execution Prevention marks memory regions such as the stack and heap as non-executable to prevent malicious code from running directly from those locations. When an exploit attempts to jump into shellcode residing on the stack, the CPU generates an access violation because execution permissions are explicitly denied on that memory page.

Answer

Control Flow Guard (CFG) validating indirect call targets against a pre-compiled bitmap of valid function entries.

Answer

Address Space Randomization relocating the base addresses of operating system libraries dynamically on every reboot.

Answer

Structured Exception Handling Overwrite Protection guarding exception handler chains from malicious pointer manipulation.