PEN-200 Hard Questions — 25 Difficult Questions

Question 1

During an internal penetration test, you capture a NetNTLMv2 challenge-response hash from a Windows host. You want to crack it offline to recover the plaintext password. Which tool and mode should you use to maximize efficiency against this hash type?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hashcat with mode 5600 and a wordlist combined with rule-based mutations.. NetNTLMv2 hashes are challenge-response pairs that cannot be used directly for pass-the-hash. To recover the plaintext, offline cracking is required. Hashcat mode 5600 is designed for NetNTLMv2, and combining a wordlist with rules significantly improves success rates by mimicking common password transformations. Other modes or tools may work but are less efficient or incorrect for this hash type.

Answer

Hashcat with mode 1000 and a mask attack targeting eight-character passwords.

Answer

John the Ripper with `--format=netntlmv2` and the `--incremental` mode.

Answer

Use `responder` to relay the hash to another host and gain access without cracking.

Question 2

During an internal Active Directory assessment, you have compromised a standard domain user account. You run BloodHound and identify that this user has the 'GenericAll' permission over a computer object named WEB01. You want to leverage this permission to compromise WEB01 and obtain administrative access to it. Which of the following is the most direct and reliable technique to achieve this?

Accepted Answer

Use the GenericAll permission to perform a shadow credentials attack by adding a Key Credential to the msDS-KeyCredentialLink attribute of WEB01.. GenericAll over a computer object allows full control, including modifying the msDS-KeyCredentialLink attribute. By adding a Key Credential, an attacker can authenticate as the computer account via PKINIT and obtain a TGT, effectively taking over the machine. This shadow credentials technique is direct and does not require cracking or additional accounts, making it the most efficient path to compromise WEB01.

Answer

Use the GenericAll permission to perform a targeted Kerberoasting attack by setting an SPN on a user account you control, then request a service ticket.

Answer

Perform a Kerberoasting attack against the machine account of WEB01 to obtain its hash and then crack it offline.

Answer

Use the GenericAll permission to perform a resource-based constrained delegation attack by modifying the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

Question 3

When evaluating a web application for Cross-Site Scripting vulnerabilities during a penetration test, which TWO input contexts should you examine because they frequently lead to executable script injection?

Accepted Answer

Input reflected directly between opening and closing HTML tags, such as

USER_INPUT

. XSS occurs when untrusted user input is rendered in an unsafe context within the HTML document. Examining input reflected directly inside HTML body tags or inside event handler attributes (like onload or onerror) are primary areas where browsers will evaluate injected strings as executable JavaScript.

Answer

Input processed by a backend database stored procedure for primary key generation

Answer

Input stored as an encrypted binary blob inside the browser local session storage

Answer

Input utilized as a parameter value inside a server-side JSON response header without content-type sniffing

Question 4

You are adapting a public exploit whose payload is a reverse shell. The exploit runs and the service reports success, but your netcat listener never receives a connection. Which cause is most likely?

Accepted Answer

The target's outbound firewall blocks the callback port, or the payload is calling back to an address the target cannot route to.. When exploitation succeeds but no callback arrives, the network path from target to listener is the prime suspect. Outbound firewall rules or a payload addressed to an unroutable interface stop the reverse shell even though the vulnerability was triggered. Offset errors would crash the service, netcat is a valid listener, and high-port binding needs no elevated privileges.

Answer

Netcat is not capable of receiving reverse shells and a different listener is required.

Answer

The exploit's buffer overflow offset is incorrect, so the payload never reaches the instruction pointer.

Answer

The exploit was run without administrative privileges on the attacker machine, preventing the listener from binding.

Question 5

Refer to the exhibit. ```http HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

Welcome

``` Based on the HTTP response headers and body shown in the exhibit, what significant security risk is present regarding client-side attacks?

Accepted Answer

The 'unsafe-inline' directive permits the execution of inline scripts, undermining CSP protections against Cross-Site Scripting. The inclusion of the 'unsafe-inline' directive in the Content Security Policy script-src allows the browser to execute inline script blocks present in the HTML. This configuration largely defeats the protective benefits of a CSP against Cross-Site Scripting, as attackers who can inject inline scripts will achieve execution.

Answer

The application is completely immune to Cross-Site Scripting because a Content Security Policy is strictly enforced

Answer

The server is vulnerable to remote code execution because the nginx version header is explicitly exposed

Answer

The session token is vulnerable to interception because the response is transmitted over unencrypted HTTP

Question 6

Which of the following describes the 'Open Redirect' vulnerability often used in phishing attacks?

Accepted Answer

The application uses user-supplied parameters to control the destination of a redirect.. Open Redirect occurs when an application accepts user-supplied input to determine a destination URL without validating it against a whitelist. Attackers exploit this to redirect users to a malicious site. Because the URL starts with the trusted domain, victims are less likely to suspect a phishing attempt, making it a highly effective social engineering technique to steal credentials or deliver malware.

Answer

The application reflects user input into the HTML body, allowing for XSS.

Answer

The application fails to set the Secure flag on cookies during redirection.

Answer

The application allows arbitrary file uploads to the server's redirect directory.

Question 7

You are auditing a file upload feature that restricts uploaded files based solely on extension blacklisting and client-side JavaScript validation. Which TWO techniques can you use to bypass these controls and achieve remote code execution on a Linux-based web server?

Accepted Answer

Uploading a file with an alternative executable extension such as .php5 or .phtml that is still processed by the backend web server. Bypassing weak file upload filters requires exploiting server-side parsing weaknesses or manipulating the transmission data. Since client-side validation is easily circumvented by intercepting requests with an HTTP proxy, testers must focus on server-side extension handling discrepancies and path traversal flaws to place executable scripts in web-accessible directories.

Answer

Modifying the client-side JavaScript validation function in the browser developer tools to allow PHP file extensions before submission

Answer

Modifying the Content-Type header in the HTTP request from application/octet-stream to text/plain to satisfy server-side MIME type checks

Answer

Disabling JavaScript completely in your browser settings to prevent the upload form from performing any input sanitization

Question 8

A penetration tester is investigating scheduled tasks for potential privilege escalation. Which TWO conditions must be met for a scheduled task to be successfully exploited for gaining SYSTEM privileges?

Accepted Answer

The task is configured to run under the context of the SYSTEM account or a member of the Administrators group.. Scheduled tasks are a common persistence and escalation vector. For escalation, the task must execute with higher privileges than the current user, typically as SYSTEM or an Administrator. Additionally, the attacker must have the ability to influence what the task executes, either by modifying the executable file, a script it calls, or the task configuration itself to point to a malicious file.

Answer

The task must have a trigger set to 'At log on' for any user on the system.

Answer

The 'Hidden' attribute must be enabled in the task settings to bypass Windows Defender detection.

Answer

The task must be part of the default Windows installation rather than a third-party application.

Question 9

Refer to the exhibit. A penetration tester analyzing a Linux host finds the SUID binary shown in the exhibit. Running 'ltrace /usr/local/bin/check_logs' reveals that the program invokes the C library function system("tail -n 10 /var/log/syslog"). How can this SUID binary be exploited?

Accepted Answer

Exporting a custom PATH variable containing a malicious script named tail and executing the SUID binary.. When a SUID binary executes a command via the C system() function without providing an absolute path to the target executable, it spawns a shell that relies on the PATH environment variable. In older or misconfigured environments, or when debugging wrappers fail to scrub PATH properly, attackers can manipulate PATH to execute a malicious binary named tail, resulting in elevated command execution.

Answer

Supplying a crafted format string as an argument to the binary to overwrite the Global Offset Table and hijack execution flow.

Answer

Injecting arbitrary shell metacharacters such as semicolons directly into the system log file to break out of the tail command.

Answer

Triggering a buffer overflow by supplying an excessively long filename as an argument to the check_logs binary execution.

Question 10

You are performing a password audit and want to generate targeted candidate passwords based on company-specific terms, years, and common suffixes using Hashcat's rule-based engine. Which built-in Hashcat rule file applies standard capitalization toggles and appends common digit suffixes?

Accepted Answer

hashcat -a 0 -r rules/best64.rule wordlist.txt hashes.txt. Rule-based attacks allow penetration testers to drastically increase password cracking success rates by mutating wordlist entries with predictable human patterns. The best64.rule file contains a highly optimized set of transformation rules that cover capitalization, reversal, and common numeric appends without introducing excessive computational overhead.

Answer

hashcat -a 1 -r rules/combinator.rule wordlist1.txt wordlist2.txt hashes.txt

Answer

hashcat -a 3 -r rules/T1048.rule mask.hcmask hashes.txt

Answer

hashcat -a 6 -r rules/leetspeak.rule wordlist.txt mask.hcmask hashes.txt

Question 11

Refer to the exhibit. You are running a public exploit, but it fails with a 'Connection refused' error. What should you investigate first?

Accepted Answer

The service availability and network path to the target.. A 'Connection refused' error usually indicates that the target port is not open, the service is not running, or a firewall is blocking the connection. Investigating the network connectivity and service status using tools like Nmap or netcat is essential. This allows you to confirm the service is actually reachable and running on the expected port before assuming the exploit itself is flawed or the payload is failing.

Answer

The exploit's payload encoding settings.

Answer

The exploit's memory address offsets.

Answer

The target's operating system version.

Question 12

You have obtained a low-privileged shell on a Windows Server 2019 machine. During enumeration, you discover that the user account you compromised has the SeBackupPrivilege enabled. You want to leverage this privilege to extract the SAM and SYSTEM registry hives for offline credential extraction. Which of the following commands correctly uses the built-in Windows utility `reg` to save these hives, and what is the required privilege?

Accepted Answer

reg save HKLM\SAM C:\Temp\SAM.hiv and reg save HKLM\SYSTEM C:\Temp\SYSTEM.hiv; SeBackupPrivilege allows this because it grants backup rights to read any file, including registry hives.. SeBackupPrivilege allows a user to read any file regardless of ACLs, which is why it can be abused to save the SAM and SYSTEM registry hives using `reg save`. These hives contain local account password hashes and boot key, which can be extracted offline with tools like secretsdump. The `reg save` command is the correct method because it writes the binary hive data to a file, unlike `reg export` which produces a text .reg file.

Answer

reg copy HKLM\SAM C:\Temp\SAM.hiv and reg copy HKLM\SYSTEM C:\Temp\SYSTEM.hiv; SeBackupPrivilege must be explicitly enabled using whoami /priv before these commands will work.

Answer

reg export HKLM\SAM C:\Temp\SAM.reg and reg export HKLM\SYSTEM C:\Temp\SYSTEM.reg; SeBackupPrivilege is not needed because these keys are world-readable.

Answer

reg save HKLM\SAM C:\Temp\SAM.hiv and reg save HKLM\SYSTEM C:\Temp\SYSTEM.hiv; SeBackupPrivilege is irrelevant because the reg command always runs with SYSTEM privileges.

Question 13

You have compromised a service account that has the SeEnableDelegationPrivilege right on a domain controller. You want to abuse Kerberos delegation to gain access to a target server's file share. Which two steps are required to configure and exploit unconstrained delegation on a controlled computer object? (Choose two.)

Accepted Answer

Set the TRUSTED_FOR_DELEGATION flag on the controlled computer object so the domain controller will forward TGTs to it.. Unconstrained delegation abuse requires two things: enabling the TRUSTED_FOR_DELEGATION flag on a controlled computer so the DC forwards TGTs to it, and coercing a privileged user to authenticate to that computer so a TGT is cached in memory. Extracting the TGT then allows impersonation. The other options describe constrained delegation, an unrelated SPN configuration, or a security control that blocks the attack.

Answer

Configure a Service Principal Name on the controlled computer object for the target file share service (cifs/target).

Answer

Modify the msDS-AllowedToDelegateTo attribute on the controlled computer to include the target server's CIFS service.

Answer

Add the controlled computer to the Protected Users group to ensure delegation tokens are cached securely.

Question 14

You have compromised a Linux host that acts as a pivot into a segmented network. You want to use SSH remote port forwarding to expose an internal service (192.168.1.100:3389) to your attacking machine. You run the command: ssh -R 9001:192.168.1.100:3389 user@attacker.com. Which TWO statements about this setup are correct? (Choose two.)

Accepted Answer

The SSH server (attacker.com) will listen on port 9001 and forward connections to 192.168.1.100:3389 via the compromised host.. Remote port forwarding (-R) makes the SSH server listen on a specified port and forward incoming connections back through the tunnel to the SSH client, which then connects to the target. By default, the listening socket is bound to loopback on the server, limiting access. The client does not need a public IP; only outbound SSH connectivity is required.

Answer

The compromised host will listen on port 9001 and forward connections to attacker.com.

Answer

This setup requires the attacker to run a separate listener on port 9001.

Answer

The compromised host must have a public IP address for this to work.

Question 15

You have compromised a Linux host that dual-homes between your attacking network (192.168.1.0/24) and an internal network (10.0.0.0/24). The internal network contains a server at 10.0.0.5 running an SSH service on port 22. You want to use SSH dynamic port forwarding to create a SOCKS proxy on your attacking machine, allowing you to scan the internal network with Nmap. Which command should you run on your attacking machine?

Accepted Answer

ssh -D 1080 -N user@192.168.1.100. The ssh -D command creates a dynamic SOCKS proxy on the local machine, which can be used to tunnel traffic through the SSH server. The -N flag is optional but prevents a shell. The correct target is the compromised host's external IP (192.168.1.100). This allows tools like Nmap to scan the internal network via the proxy. Other options either create the wrong type of forward, use the wrong target, or are incomplete.

Answer

ssh -L 1080:10.0.0.5:22 user@192.168.1.100

Answer

ssh -D 1080 user@10.0.0.5

Answer

ssh -R 1080 user@192.168.1.100

Question 16

During a red team engagement, a tester writes a C# loader that calls the Win32 API function VirtualAllocEx to allocate memory in a remote process, writes shellcode, and creates a remote thread. The loader compiles and runs, but the endpoint's EDR blocks it before the remote thread executes. The tester confirms the EDR is hooking user-mode API functions in ntdll.dll. Which approach most directly avoids the user-mode hooks that triggered the block?

Accepted Answer

Implement direct system calls by reading the syscall numbers from a clean copy of ntdll.dll and executing the syscall instruction directly from the loader's own code.. User-mode EDR hooks are implemented by patching the entry points of functions inside ntdll.dll. Any call that goes through those functions, whether via the kernel32 wrapper or the Nt-prefixed export, passes through the hook. Direct system calls sidestep the problem by placing the syscall instruction in the loader's own code with the correct service number, so execution transitions to kernel mode without touching the hooked ntdll stubs. This is the most reliable way to bypass user-mode hooking without altering system DLLs.

Answer

Add the /DYNAMICBASE:NO linker flag so the loader's base address does not change between runs.

Answer

Replace the calls to VirtualAllocEx and CreateRemoteThread with their NtAllocateVirtualMemory and NtCreateThreadEx equivalents from ntdll.dll.

Answer

Call VirtualProtect on the ntdll.dll .text section to restore the original bytes before invoking the API.

Question 17

You have obtained a set of NTLM hashes from a Windows domain controller and want to perform a pass-the-hash attack to move laterally. Which TWO of the following tools can be used to authenticate to remote systems using only the NTLM hash? (Choose two.)

Accepted Answer

CrackMapExec with the -H option. Impacket's wmiexec.py and CrackMapExec both explicitly support pass-the-hash via command-line options (-hashes and -H respectively). They allow authentication using only the NTLM hash, enabling lateral movement without the plaintext password. The other tools either lack support for pass-the-hash or require additional steps.

Answer

Metasploit's psexec module with SMBPass set to the hash

Answer

Hydra with the -p option

Answer

Nmap with the smb-psexec script

Question 18

A penetration tester needs to deliver a Meterpreter payload to a Windows target protected by an EDR that performs both static file scanning and behavioral monitoring of process creation. The tester wants to reduce the chance of detection during initial execution while still obtaining a session. Which two techniques most directly reduce detection in this combined scenario? (Choose two.)

Accepted Answer

Spawn the payload by injecting into a legitimate, already-running process such as explorer.exe rather than starting a new process.. The scenario involves two distinct controls: static file scanning and behavioral process monitoring. A custom loader with encrypted shellcode removes recognizable bytes from disk, defeating static signatures. Injecting into an existing trusted process avoids the new-process creation event that behavioral engines monitor, placing execution inside a process already deemed legitimate. Together these address both controls. Renaming, UPX packing, and registry tampering either leave the static bytes intact or generate their own high-signal events.

Answer

Disable Windows Defender real-time protection by modifying the registry before executing the payload.

Answer

Rename the payload executable to svchost.exe and place it in the user's temp directory.

Answer

Compress the payload with UPX and deliver it as a self-extracting archive.

Question 19

You have gained access to a Windows Server 2019 host as a low-privileged user. You discover that the system has the SeBackupPrivilege and SeRestorePrivilege enabled for your user account. You want to extract the SAM and SYSTEM registry hives to obtain password hashes for offline cracking. Which command should you use to copy the SAM hive to a location where you can access it?

Accepted Answer

reg save HKLM\SAM C:\Temp\sam.hiv. With SeBackupPrivilege, you can use `reg save` to export a copy of the SAM and SYSTEM hives. This command leverages backup semantics to read locked registry files. Direct copy or robocopy may not work without proper flags, and esentutl is for different file types. The saved hives can then be parsed with tools like secretsdump to extract hashes.

Answer

copy C:\Windows\System32\config\SAM C:\Temp\sam.hiv

Answer

robocopy /b C:\Windows\System32\config C:\Temp SAM

Answer

esentutl /y C:\Windows\System32\config\SAM /d C:\Temp\sam.hiv

Question 20

You are performing a client-side attack against a Windows 10 workstation. The target user has Microsoft Office 2016 installed and macro execution is disabled via Group Policy. You need to execute arbitrary code when the user opens a weaponized document. Which technique is most likely to succeed?

Accepted Answer

Embed a Dynamic Data Exchange (DDE) payload in a Word document that prompts the user to enable content.. Dynamic Data Exchange (DDE) allows a document to execute commands without using VBA macros, bypassing Group Policy that disables macros. When the user opens the document and approves the prompt, the DDE payload runs. This technique is a classic client-side attack for macro-restricted environments.

Answer

Use a malicious .lnk file that executes a PowerShell one-liner when double-clicked.

Answer

Use a malicious Excel 4.0 (XLM) macro embedded in a .xlsm file.

Answer

Deliver a malicious .docm file with a VBA macro that uses AutoOpen().