PT0-002 Attacks and Exploits Practice Test 2 — 15 Questions

Question 1

A penetration tester has gained a low-privileged command shell on a Windows 10 system. The tester suspects there is a vulnerable service with an unquoted service path that can be exploited for privilege escalation. Which command should the tester use to identify all services with this vulnerability?

Accepted Answer

reg query HKLM\SYSTEM\CurrentControlSet\Services\ /s /v ImagePath. Option B is correct because the `reg query` command with the `/s` switch recursively searches the registry key `HKLM\SYSTEM\CurrentControlSet\Services` for the `ImagePath` value of each service. An unquoted service path vulnerability occurs when the `ImagePath` contains spaces and is not enclosed in quotes, allowing an attacker to execute arbitrary code by placing a malicious executable in a path that Windows interprets as a command with arguments. This command directly retrieves the raw path strings from the registry, making it the most reliable method to identify unquoted paths.

Answer

Get-Service | Format-List Name,PathName

Answer

sc query type= all state= all | findstr "SERVICE_NAME"

Answer

net start

Question 2

During an internal penetration test, a tester gains access to a domain-joined Windows 10 workstation as a local administrator. The tester wants to escalate privileges to Domain Admin. Which attack involves requesting Kerberos service tickets that can be cracked offline to reveal the plaintext password of a service account?

Accepted Answer

Kerberoasting. Kerberoasting is the correct attack because it involves requesting Kerberos service tickets (TGS-REP) for service accounts registered with Service Principal Names (SPNs) in Active Directory. These tickets are encrypted with the service account's NTLM hash, which can be cracked offline to reveal the plaintext password. Since the tester has local administrator access on a domain-joined workstation, they can use tools like Rubeus or Impacket to request these tickets without needing domain admin privileges initially.

Answer

Pass-the-hash

Answer

Golden ticket

Answer

Silver ticket

Question 3

A penetration tester has compromised a Linux web server via a remote file inclusion vulnerability. The tester wants to maintain persistent access on the system. Which technique is MOST reliable for persistence on a Linux system?

Accepted Answer

Adding a cron job to run a reverse shell every minute. A cron job is the most reliable persistence mechanism because it operates independently of user login sessions, runs with root privileges if configured in the root crontab, and can execute a reverse shell at a fixed interval (e.g., every minute). Unlike user accounts or sudoers modifications, a cron job does not require the attacker to maintain an active session or rely on system services that may be monitored or disabled.

Answer

Creating a local user account with UID 0

Answer

Modifying the sudoers file to grant the tester sudo access

Answer

Installing a kernel module rootkit

Question 4

A penetration tester has gained a low-privileged shell on a Linux server. During enumeration, the tester discovers a binary with the SUID bit set that belongs to root and is known to have a buffer overflow vulnerability. What is the MOST effective next step to escalate privileges?

Accepted Answer

Develop and execute a buffer overflow exploit against the binary to gain a root shell. The SUID binary owned by root and vulnerable to a buffer overflow allows a low-privileged user to execute it with root privileges. Developing and executing a buffer overflow exploit against the binary will overwrite the return address or function pointer to spawn a root shell, directly escalating privileges to root. This is the most effective method because it leverages the existing vulnerability to gain full control without relying on other misconfigurations.

Answer

Use the binary to execute a command that changes the root password

Answer

Modify the binary's permissions to allow execution by any user

Answer

Use sudo to run the binary as root

Question 5

During a penetration test, a tester identifies a buffer overflow vulnerability in a Linux binary that has both ASLR and NX (Non-Executable) enabled. The tester discovers a ROP gadget at a fixed address in a library that is not affected by ASLR. Which technique can be used to exploit this vulnerability and achieve code execution?

Accepted Answer

Return-oriented programming (ROP) using the fixed gadgets. Return-oriented programming (ROP) is the correct technique because ASLR and NX are both enabled, preventing direct shellcode execution and making memory addresses unpredictable. However, the tester found a ROP gadget at a fixed address in a library not affected by ASLR, allowing the construction of a chain of gadgets to achieve arbitrary code execution without needing to inject or execute shellcode on the stack.

Answer

Heap spraying to predict memory layout and inject shellcode

Answer

Stack canary bypass using information leak

Answer

Format string attack to overwrite GOT entries

Question 6

A penetration tester has successfully exploited a web application and gained a reverse shell as the www-data user on a Linux server. The tester wants to escalate privileges to root. The server is running a vulnerable version of polkit's pkexec (CVE-2021-4034). Which action should the tester take to exploit this vulnerability?

Accepted Answer

Run the 'pkexec' binary with crafted environment variables. Option B is correct because CVE-2021-4034 (PwnKit) is a memory corruption vulnerability in polkit's pkexec that allows an unprivileged user to escalate privileges to root by running the pkexec binary with crafted environment variables. Specifically, by setting the PATH and other environment variables to trigger an out-of-bounds write, the attacker can execute arbitrary code as root without authentication.

Answer

Execute the 'sudo -u root' command

Answer

Modify the PATH environment variable to include a malicious executable

Answer

Use a generic kernel exploit for privilege escalation

Question 7

A penetration tester is attempting a pass-the-hash (PtH) attack against a Windows domain-joined machine. The tester has obtained the NTLM hash of a local administrator account. Which tool can be used directly to authenticate using the hash to gain remote command execution?

Accepted Answer

Metasploit's psexec module. Metasploit's psexec module (exploit/windows/smb/psexec) directly accepts an NTLM hash via the 'SMBPass' option and uses it to authenticate over SMB, then creates a service on the target to execute commands. This is a classic pass-the-hash technique against Windows systems, as the module leverages the SMB protocol and Windows service control manager without needing the plaintext password.

Answer

John the Ripper

Answer

Mimikatz

Answer

Nmap

Question 8

A penetration tester discovers a web application that uses client-side JavaScript to validate user input before form submission. The input is then sent to the server and used directly in a SQL query without server-side validation. Which attack would most effectively exploit this vulnerability?

Accepted Answer

SQL injection. The correct answer is A because the vulnerability described—client-side JavaScript validation with no server-side sanitization, followed by direct use of input in a SQL query—is the classic precondition for SQL injection. An attacker can bypass client-side controls (e.g., by disabling JavaScript or using a proxy like Burp Suite) and submit crafted SQL syntax (e.g., `' OR 1=1 --`) to manipulate the query, extract data, or execute arbitrary SQL commands on the database server.

Answer

Cross-site scripting (XSS)

Answer

Command injection

Answer

Parameter pollution

Question 9

A penetration tester has gained administrative access to a Windows system and wants to extract NTLM password hashes from the memory of the Local Security Authority Subsystem Service (LSASS). Which tool is most commonly used for this purpose?

Accepted Answer

Mimikatz. Mimikatz is the most commonly used tool for extracting NTLM password hashes from LSASS memory on a Windows system. It leverages the `sekurlsa::logonpasswords` module to read the LSASS process memory and decrypt stored credentials, including NTLM hashes, without requiring a separate brute-force or dictionary attack.

Answer

John the Ripper

Answer

Hashcat

Answer

Netcat

Question 10

During a penetration test, a tester identifies a buffer overflow vulnerability in a Linux binary. The system has ASLR and NX (Non-Executable) enabled. The tester finds a ROP gadget at a fixed address in a library that is loaded at a constant address across reboots. Which exploitation method is the most appropriate to achieve code execution?

Accepted Answer

Return-Oriented Programming (ROP) chain. Option B is correct because Return-Oriented Programming (ROP) is specifically designed to bypass both ASLR and NX when a fixed-address ROP gadget is available. Since the library is loaded at a constant address across reboots, the tester can chain gadgets from that library to execute arbitrary code without needing to inject executable shellcode.

Answer

Return-to-libc attack

Answer

Heap spraying

Answer

SEH overwrite exploit

Question 11

A penetration tester has obtained the NTLM hash of a local administrator account on a Windows domain-joined system. The tester wants to use this hash to authenticate to another system on the network and execute commands remotely. Which tool is commonly used for pass-the-hash attacks to achieve remote code execution?

Accepted Answer

Impacket's wmiexec.py. Impacket's wmiexec.py is the correct tool because it directly supports pass-the-hash (PtH) authentication using NTLM hashes over Windows Management Instrumentation (WMI). It accepts an NTLM hash via the `-hashes` flag and establishes a remote WMI session, enabling command execution without needing the plaintext password. This makes it ideal for lateral movement in a domain environment where a local administrator hash has been captured.

Answer

Hydra

Answer

PsExec

Answer

Sqlmap

Question 12

A penetration tester discovers a remote command injection vulnerability in a Java-based web application on a Windows server. The tester wants to execute a PowerShell reverse shell. Which encoding technique is most effective to avoid filter restrictions on special characters?

Accepted Answer

Base64 encoding. Base64 encoding is the most effective technique because it allows the tester to encode the entire PowerShell command, including special characters like semicolons, pipes, and quotes, into a safe ASCII string that bypasses filter restrictions. PowerShell natively supports the `-EncodedCommand` parameter, which decodes Base64 input directly, making it ideal for remote command injection scenarios where character filtering is strict.

Answer

URL encoding

Answer

Unicode encoding

Answer

Hex encoding

Question 13

During a penetration test, a tester gains access to a Linux server as a low-privileged user. The server has a cron job that executes a script owned by root but writable by the tester's group. Which privilege escalation technique should the tester use?

Accepted Answer

Cron job exploitation via script modification. The cron job executes a script owned by root but writable by the tester's group. This means the tester can modify the script's contents. When the cron job runs (as root), the modified script executes with root privileges, allowing the tester to gain a root shell or execute arbitrary commands as root. This is a classic cron job exploitation via script modification.

Answer

Kernel exploit

Answer

Misconfigured sudo permissions

Answer

Path hijacking in the cron job

Question 14

A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?

Accepted Answer

Use dnscat2 or other DNS tunneling tool. Option C is correct because DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.

Answer

Use netcat to send data over TCP 53

Answer

Use an SSH tunnel over UDP 53

Answer

Use a bind shell listening on TCP 443 internally

Question 15

A penetration tester discovers a Java application that deserializes user-controlled data without validation. The tester crafts a malicious serialized object that executes a command upon deserialization. The application runs on a Linux server with a standard Java runtime. Which of the following is the most likely outcome if the malicious object is accepted?

Accepted Answer

The tester will be able to execute arbitrary commands on the server.. Java deserialization of untrusted data allows an attacker to supply a crafted serialized object that, when deserialized, can execute arbitrary code via gadget chains (e.g., CommonsCollections). Since the application runs on a Linux server with a standard Java runtime, the attacker can achieve remote code execution (RCE) with the privileges of the application's user, not necessarily an interactive shell. Option D is correct because the primary impact is arbitrary command execution, which may or may not yield a shell depending on the payload.

Answer

The application will crash immediately due to an exception.

Answer

The application will disclose sensitive information in the response.

Answer

The tester will gain a shell with the privileges of the current user.