PEN-200 Public Exploits Practice Test 1 — 15 Questions

Question 1

Which of the following describes the safest way to test a public exploit against an exam target?

Accepted Answer

Execute the exploit only after confirming the vulnerability.. The safest approach is to first try the exploit in a controlled, non-production environment or at least perform a dry run if the exploit allows. When testing against the actual target, always be prepared for the service to crash. Start with the most benign verification techniques, documenting all steps to ensure that if a crash occurs, you understand what triggered it and can avoid it in future attempts.

Answer

Run the exploit with the maximum payload size.

Answer

Modify the exploit to run on boot for persistence.

Answer

Use an exploit that you have not reviewed.

Question 2

You are analyzing a Python exploit script that utilizes 'ctypes' to interface with a local library. Which TWO considerations are essential when porting this exploit to a different Linux distribution?

Accepted Answer

The target kernel version and the memory addresses of system functions.. When porting exploits that interact with system libraries, environment discrepancies are the primary cause of failure. Offsets and library paths are rarely static across different versions or distributions. Understanding the underlying dependencies and memory management is crucial for successful exploitation. Testing the exploit locally against a similar environment helps identify missing headers or library mismatches that would otherwise cause the script to crash during execution.

Answer

The version of the Python interpreter installed on the target machine.

Answer

The default user shell configured in the /etc/passwd file.

Answer

The current system uptime and the number of active users.

Question 3

You are preparing a C-based exploit for a Linux buffer overflow. Which THREE actions must you perform to successfully compile and run the code?

Accepted Answer

Verify the target architecture matches your compilation environment.. Compiling C exploits requires matching the environment to the target's architecture. Failure to include necessary headers or link the correct libraries leads to compilation errors. Once compiled, you must ensure the binary has the correct permissions. Understanding the target architecture is fundamental; attempting to run a 64-bit exploit on a 32-bit system, or vice versa, will result in immediate execution failure or segmentation faults.

Answer

Change the file ownership to root using the chown command.

Answer

Obfuscate the binary using a packer to bypass all antivirus software.

Question 4

You have a reliable exploit that crashes a service, but the reverse shell payload consistently fails. What is the most likely reason for this in a modern Linux environment?

Accepted Answer

ASLR or DEP/NX protections are preventing shellcode execution.. Modern Linux systems implement security features like ASLR and DEP/NX. If your exploit crashes the service but fails to execute the shellcode, the payload might be landing in a non-executable memory region or being blocked by kernel protections. Identifying the specific memory protection mechanism active on the target is essential for crafting a payload that successfully redirects execution flow without being intercepted or immediately terminated by the kernel.

Answer

The exploit script is using the wrong encoding for the payload.

Answer

The reverse shell port is blocked by the target's internal firewall.

Answer

The payload is too large for the allocated buffer space.

Question 5

You are conducting a penetration test against a Windows Server 2019 host. You identify a vulnerable version of a web application and locate a public exploit that uses a hardcoded return address of 0x1000AFC0. The exploit works in your lab on a Windows Server 2016 VM but fails on the target. What is the most likely reason for the failure?

Accepted Answer

The target's ASLR is enabled, randomizing the base address of the module containing the return address.. The exploit uses a hardcoded return address, which assumes a fixed module base. On Windows Server 2019, ASLR is enabled by default, randomizing module bases and rendering the hardcoded address invalid. This causes the exploit to fail on the target even though it worked on a different Windows version in the lab.

Answer

The target's DEP is preventing the execution of shellcode on the stack.

Answer

The exploit requires a specific service pack level that is not installed on the target.

Answer

The target's firewall is blocking the reverse shell connection.

Question 6

You are using a public exploit for a buffer overflow in a Linux service. The exploit includes shellcode that spawns /bin/sh on a local port. After running it, the service crashes but no shell is obtained. You confirm the offset is correct. Which is the MOST likely cause?

Accepted Answer

The shellcode was generated for a different architecture than the target binary.. With a correct offset, the return address is overwritten and control is redirected. A crash without a shell then points to the payload itself. Shellcode generated for a different architecture will be misinterpreted by the CPU, causing an immediate crash. Verifying the target's architecture and regenerating the shellcode accordingly is the direct fix.

Answer

The exploit's return address points to a memory region marked non-executable due to NX.

Answer

The target service runs as a user without permission to bind a local port.

Answer

The shellcode contains null bytes that terminate the string copy before execution.

Question 7

You have identified a vulnerable service using an outdated version of a CMS. You successfully locate a public exploit script on GitHub. What is the most critical first step before running this script against your target?

Accepted Answer

Read the source code to understand its mechanism and potential impact.. Before executing any public exploit, you must analyze the source code to understand its functionality, dependencies, and potential impact. Public exploits are often poorly written or intentionally malicious, potentially causing service crashes or backdooring the attacker machine. Understanding the payload ensures you do not inadvertently trigger unwanted side effects or trigger defensive alarms that could disrupt your assessment during the penetration testing engagement.

Answer

Immediately run the exploit script with administrative privileges.

Answer

Change the target IP address in the script's configuration.

Answer

Install all dependencies listed in the script's requirements file.

Question 8

Which repository is generally considered the most reliable starting point for finding verified, community-contributed public exploits during an OSCP assessment?

Accepted Answer

The Exploit Database (Exploit-DB) via Searchsploit.. Searchsploit, a command-line tool for the Exploit Database (EDB), is the industry standard for identifying public exploits. It provides a searchable, offline archive of exploits, which is crucial when internet access is limited or unavailable during an exam. Utilizing this tool helps identify specific vulnerability versions and common exploit patterns, allowing for efficient mapping of known vulnerabilities to the target services identified during the enumeration phase.

Answer

A random forum dedicated to malware distribution.

Answer

The dark web marketplace for zero-day vulnerabilities.

Answer

The latest compiled binary downloads from unknown websites.

Question 9

When modifying a public exploit to fit your specific target, which TWO of the following actions are considered best practices? (Choose TWO)

Accepted Answer

Updating the hardcoded IP address and port to match your target.. Modifying public exploits is a common task that requires precision to ensure the exploit succeeds without crashing the service. Adjusting parameters like the payload and connection information is essential for success. Properly testing these changes in a lab environment first prevents accidental service downtime or triggering defensive alerts during the actual assessment, ensuring the exploitation process is methodical, predictable, and aligned with your testing objectives.

Answer

Changing the exploit code to use a different programming language entirely.

Answer

Deleting all comments to make the exploit run faster.

Answer

Adding complex obfuscation to bypass all possible firewalls.

Question 10

Refer to the exhibit. You identify an Apache 2.4.49 vulnerability and locate the exploit. After reviewing the exploit code, you realize it requires a specific input format to trigger the path traversal. What is the most effective way to verify the vulnerability without crashing the server?

Accepted Answer

Use a simple path traversal payload to request a harmless file.. Verification is a critical phase where you test for the vulnerability's presence using non-destructive inputs. By attempting a benign request, such as reading a safe, non-sensitive file like a public README, you confirm the exploit works without risking a Denial of Service. This professional approach demonstrates a cautious mindset, essential for performing assessments that prioritize target stability while successfully confirming the vulnerability exists.

Answer

Execute the exploit immediately against the root directory.

Answer

Run the exploit as is and hope the server remains stable.

Answer

Modify the exploit to dump the entire password file immediately.

Question 11

Why might a public exploit for a specific service fail to execute even when the service version matches the vulnerability description exactly?

Accepted Answer

The target environment has different memory protections or patch levels.. Public exploits are typically written against a specific environment, which may differ from your target's configuration. Variations in operating systems, patch levels, installed libraries, or memory protection mechanisms like ASLR and DEP can prevent the exploit from succeeding. Understanding these environmental dependencies is key to troubleshooting failed exploits, as it often requires you to manually port or adjust the exploit to fit the target's unique security posture.

Answer

The exploit code is always written in an incompatible shell format.

Answer

Public exploits are intentionally corrupted to prevent usage.

Answer

You forgot to increase the network timeout settings.

Question 12

When using Searchsploit, what is the purpose of the '-m' flag?

Accepted Answer

To mirror (copy) the exploit to the current directory.. The '-m' flag in Searchsploit is used to mirror or copy an exploit file from the local database into your current working directory. This is highly useful because it allows you to easily edit and configure the exploit script without modifying the original source files, keeping your environment organized and enabling quick modifications to fit specific target requirements during a penetration test.

Answer

To move the exploit file to the root directory.

Answer

To mark the exploit as malicious.

Answer

To monitor the exploit for execution errors.

Question 13

You have found a Python exploit that uses the 'requests' library but your target machine only has standard Python installed. What is your best course of action?

Accepted Answer

Modify the script to use standard Python libraries instead.. When a public exploit has unmet dependencies, the most efficient approach is to rewrite the exploit to use standard libraries or ensure the dependency is met in a way that doesn't disrupt the target. In an exam, you often cannot install external packages on the target. Therefore, porting the functionality to native libraries like 'urllib' ensures your exploit remains portable and functional without requiring additional, potentially unavailable, software installations.

Answer

Upload the library to the target machine.

Answer

Install the library on your own machine and hope it works.

Answer

Give up on this exploit and find a different one.

Question 14

Refer to the exhibit. You are running a public exploit, but it fails with a 'Connection refused' error. What should you investigate first?

Accepted Answer

The service availability and network path to the target.. A 'Connection refused' error usually indicates that the target port is not open, the service is not running, or a firewall is blocking the connection. Investigating the network connectivity and service status using tools like Nmap or netcat is essential. This allows you to confirm the service is actually reachable and running on the expected port before assuming the exploit itself is flawed or the payload is failing.

Answer

The exploit's payload encoding settings.

Answer

The exploit's memory address offsets.

Answer

The target's operating system version.

Question 15

Why is it important to use a local listener that matches the protocol expected by your exploit's payload?

Accepted Answer

It ensures the connection is successfully captured.. If your exploit sends a reverse shell, the listener must be configured to accept the specific connection type (e.g., TCP or UDP) and handle the payload correctly. A mismatch—such as trying to catch a TCP reverse shell on a UDP listener—will result in the connection failing to establish. Proper alignment between the exploit's payload and your listener is the cornerstone of successful, stable remote command execution.

Answer

It makes the exploit run significantly faster.

Answer

It prevents the firewall from blocking your connection.

Answer

It automatically bypasses target authentication.