PEN-200 Public Exploits Practice Test 2 — 15 Questions

Question 1

When analyzing a public exploit, which TWO elements should you specifically look for to understand its networking behavior? (Choose TWO)

Accepted Answer

The target port the exploit connects to.. Understanding how an exploit communicates is vital for both success and stealth. By identifying the hardcoded target port and the type of callback payload (e.g., reverse shell vs. bind shell), you can align your listener and firewall configuration to ensure the exploit functions correctly. This level of technical oversight is essential to avoid common pitfalls where the exploit succeeds, but the attacker fails to receive the connection due to network-level misconfigurations.

Answer

The author's name and email address.

Answer

The date the exploit was uploaded.

Answer

The color scheme used in the code.

Question 2

When an exploit script uses hardcoded memory addresses, why is it likely to fail on a modern target system?

Accepted Answer

Address Space Layout Randomization (ASLR) makes addresses dynamic.. Modern systems utilize Address Space Layout Randomization (ASLR), which randomizes the memory addresses of key system components and loaded libraries every time a program executes. Since hardcoded memory addresses in old or poorly written exploits rely on fixed locations, they will almost certainly point to invalid or incorrect memory areas on a modern system, causing the program to crash instead of executing the desired payload.

Answer

The hardcoded addresses are too long for modern systems.

Answer

Modern systems use 64-bit addresses instead of 32-bit.

Answer

The exploit code is missing the necessary buffer size.

Question 3

What is the primary danger of using a public exploit without first auditing the source code?

Accepted Answer

The script might contain hidden malicious payloads.. Public exploits are often shared without security vetting. They may contain hidden payloads designed to compromise the researcher's system, execute unauthorized commands, or send sensitive information to a third-party server. Auditing the code ensures you understand exactly what the script does, protecting your own infrastructure and confirming that the exploit is safe and focused only on the intended target system during your assessment.

Answer

The script might use too much disk space.

Answer

The script will always work perfectly as intended.

Answer

The script might be written in an obscure language.

Question 4

You have identified an outdated version of a web application running on a target. You found a public exploit script for this version on Exploit-DB. Which step is most critical before executing the exploit script against the target?

Accepted Answer

Review the source code to verify target parameters and modify hardcoded configurations.. Validating the exploit code is essential because public scripts often contain hardcoded IP addresses, paths, or shellcode that may not match your environment. Modifying the script ensures it executes properly, avoids unintended network traffic, and prevents potential instability on the target service. Failure to review code can lead to silent failure, false positives, or accidental service crashes, hindering your overall progress during an assessment.

Answer

Immediately run the script with root privileges to ensure full access.

Answer

Upload the script directly to the target system via a browser-based upload form.

Answer

Convert the script into a binary executable using a compiler to hide its nature.

Question 5

Which resource is most reliable for verifying that a public exploit is legitimate and does not contain hidden backdoors?

Accepted Answer

A reputable source like Exploit-DB or a verified GitHub repository.. Verifying exploit integrity is crucial to prevent self-compromise. Official repositories and reputable security platforms provide peer-reviewed code. By examining the source code manually and checking the history of the repository, you can identify suspicious commands like hardcoded reverse shells to unknown addresses. Relying on reputable sources minimizes the risk of executing malicious code designed to target the researcher's own machine during an engagement.

Answer

The 'Download' link from an anonymous search result page.

Answer

A public exploit video on social media showcasing the hack.

Answer

Running the script inside a browser-based online compiler.

Question 6

You are reviewing a public exploit for a Linux-based web application. The exploit is a Python script that uses a hardcoded offset to overwrite a return address, and it includes a comment stating it was tested on a specific kernel version. Your target runs a different kernel but the same application version. After running the exploit, the service crashes but no shell is obtained. Which action is the MOST appropriate next step?

Accepted Answer

Modify the exploit's offset to match the target's kernel by debugging the crash and calculating the correct offset.. A crash with no shell typically means the offset to the return address is wrong for the target's memory layout. Debugging the crash to find the correct offset and updating the exploit is the precise, minimal fix. This preserves the working parts of the exploit and directly addresses the kernel-dependent difference.

Answer

Recompile the target's kernel to match the version the exploit was tested on.

Answer

Search for a different public exploit that targets the same application version but is written in a different language.

Answer

Assume the exploit is unreliable and discard it, then attempt to exploit a different service on the target.

Question 7

You are reviewing a public exploit for a Linux-based web application. The exploit script contains a function that constructs a payload using a format string vulnerability. Which of the following best describes the primary risk of using this exploit without modification on a target with a different libc version?

Accepted Answer

The addresses of libc functions such as system() may differ, causing the exploit to jump to an invalid location.. When an exploit relies on hardcoded addresses of libc functions, those addresses are specific to the libc version used during development. On a target with a different libc, the addresses will differ, causing the exploit to fail or crash. This is a common pitfall when using public exploits across varied environments.

Answer

The exploit may trigger a stack canary check, which is not present in the original environment.

Answer

The format string offset may differ, causing the exploit to write to an incorrect memory address.

Answer

The format string vulnerability may be patched in the newer libc, rendering the exploit ineffective.

Question 8

You download a public exploit for a known vulnerability from an untrusted source. Before running it against a client's production system, what is the most important action to take?

Accepted Answer

Review the exploit's source code to understand its actions and check for malicious payloads.. Reviewing the exploit's source code is the most important step because it reveals exactly what the code will execute. Permission and sandboxing are valuable but secondary to understanding the code, which protects both the client and the tester from unintended consequences.

Answer

Check the exploit's file hash against online databases to confirm it is known.

Answer

Run the exploit in a sandboxed virtual machine first to see if it works.

Answer

Ask the client for permission to run the exploit on their production system.

Question 9

You are assessing a Windows host and discover the Print Spooler service is running. You locate a public PoC for CVE-2021-1675 that requires an attacker-controlled SMB share hosting a malicious DLL. You want to execute the exploit from your Kali machine against the target. Which action must you take FIRST before running the PoC?

Accepted Answer

Configure a Samba share on your Kali machine with anonymous read access that hosts the malicious DLL.. The PrintNightmare PoC abuses the Spooler's driver installation to load a DLL from a UNC path. The attacker must therefore host that DLL on an SMB share reachable by the target, typically with anonymous read access. The other options either target the wrong delivery mechanism or assume capabilities the attacker does not yet possess.

Answer

Upload the DLL to C:\Windows\Temp on the target using an existing low-privilege session.

Answer

Start a Metasploit handler on port 445 to catch the reverse shell from the Spooler service.

Answer

Disable Windows Defender Real-Time Protection on the target through a registry remoting call.

Question 10

During a PEN-200 lab engagement you locate a public exploit for a web application running on the target. The exploit's banner string is 'Mozilla/5.0' and the script appends the payload to a URL parameter. Before running it against the target, which action best reduces the risk of unintended side effects on the production web service?

Accepted Answer

Review the exploit's HTTP request construction and test it against a local instance of the same application version.. Examining how the exploit builds its HTTP request and replaying it against a matching local instance is the only approach that both reveals the payload's behavior and prevents production impact. Local reproduction lets the tester observe success or failure and confirm the exploit is appropriate before touching the live service, which is the safe validation workflow emphasized in PEN-200.

Answer

Increase the exploit's timeout value to ensure the request completes fully before you observe the result.

Answer

Change the target URL to a non-existent host so the exploit exits early, then redirect it to the real target.

Answer

Run the exploit with a --safe flag if the script supports it, then immediately run it against the target.

Question 11

During an internal assessment, you find a public exploit for a Jenkins script console vulnerability. The exploit sends a Groovy script to /script via a POST request. When you run it, the server returns HTTP 403. The Jenkins version matches the vulnerable range, and the endpoint is reachable. Which is the MOST likely reason the exploit fails?

Accepted Answer

The exploit requires an authenticated session, and the request is being rejected due to missing or invalid credentials.. Jenkins protects the script console with authentication and authorization. Even on a vulnerable version, an unauthenticated request to /script is rejected with 403 before any Groovy executes. The exploit must include a valid session or API token belonging to a user with administrative rights. Version matching alone does not bypass access controls.

Answer

The target uses HTTPS and the exploit is sending plaintext HTTP requests to port 8080.

Answer

The Groovy script contains syntax errors that Jenkins rejects at parse time.

Answer

The Groovy payload is blocked by a Web Application Firewall rule matching common reverse-shell strings.

Question 12

A public exploit for a Linux service includes a compiled payload that connects back to a hardcoded IP address. You need to adapt it for your PEN-200 engagement. Which TWO actions are most appropriate? (Choose two.)

Accepted Answer

Edit the exploit source to replace the hardcoded IP with your attacker IP, then recompile the payload if the exploit includes source.. The hardcoded callback address must be replaced with the tester's reachable address, and the payload must match the target architecture. Regenerating with msfvenom or editing and recompiling the source both accomplish this while preserving the exploit's vulnerability trigger. Router forwarding and firewall changes do not alter the embedded address, and a bind shell changes the exploitation model unnecessarily.

Answer

Disable the target firewall with an initial command so the hardcoded callback address becomes reachable.

Answer

Replace the payload with a bind shell on a common port so no callback address is needed.

Answer

Run the exploit as-is and rely on port forwarding on your router to redirect the callback to your machine.

Question 13

You download a public exploit from Exploit-DB for a known vulnerability in a web application. Before running it against a client's production server, which action is the MOST appropriate next step?

Accepted Answer

Review the exploit's source code to understand its actions and test it in a lab environment first.. Public exploits are not inherently trustworthy. Reviewing the source reveals destructive actions, unexpected network callbacks, or hidden backdoors, and lab testing validates behavior safely. Only after understanding the exploit should it be considered for use against a production target, consistent with professional and OSCP-aligned methodology.

Answer

Run the exploit immediately because Exploit-DB entries are verified by OffSec.

Answer

Ask the client to disable their antivirus so the exploit runs without interference.

Answer

Submit the exploit to VirusTotal to confirm it is not malicious, then run it.

Question 14

You download a public exploit archive from an unknown source. Before using it in the PEN-200 lab, which step best protects your own attacking machine from a trojanized exploit?

Accepted Answer

Run the exploit inside a disposable virtual machine with no shared folders and no host network bridging.. Isolating the exploit in a disposable VM without shared folders or bridged networking contains any malicious behavior and prevents it from reaching the host or other lab systems. Antivirus scans, hash lookups, and author claims all fail to prove safety because a trojanized exploit is designed to evade exactly those checks.

Answer

Scan the archive with the antivirus installed on your host before extracting it.

Answer

Read the exploit's comments and README to confirm the author claims it is safe.

Answer

Check the exploit's file hash against an online malware database and proceed if it is unknown.

Question 15

You are adapting a public Python exploit for a Windows target. The exploit was written for a different architecture and uses a hardcoded payload. Which TWO actions are MOST appropriate to make the exploit work reliably? (Choose two.)

Accepted Answer

Update the exploit's target IP address and port variables to match your listener and the victim host.. Public exploits frequently contain hardcoded payloads and network settings from the original author's environment. Regenerating the payload for the target's architecture and OS, and updating the target and callback addresses, are the two changes that directly make the exploit function against your specific host. Other modifications are unnecessary or require prior access.

Answer

Rewrite the exploit in C to improve execution speed against the target.

Answer

Change the exploit's delivery mechanism from HTTP to SMB to bypass network filtering.

Answer

Disable the target's firewall to allow the reverse shell to connect back.