PT0-002 Attacks and Exploits Practice Test 4 — 15 Questions

Question 1

A penetration tester has gained low-privilege access on a Windows 10 machine. The tester discovers that a service runs with SYSTEM privileges and has the following binary path: C:\Program Files\MyApp\service.exe. The path is unquoted. Which exploitation technique is most likely to allow the tester to escalate privileges?

Accepted Answer

Create a malicious executable named 'MyApp.exe' and place it in C:\Program Files\.. The unquoted service binary path 'C:\Program Files\MyApp\service.exe' allows Windows to interpret spaces as separators, so it will attempt to execute 'C:\Program.exe' first, then 'C:\Program Files\MyApp.exe', and finally the intended path. By placing a malicious 'MyApp.exe' in 'C:\Program Files\', the tester exploits the space in 'Program Files' to hijack execution before the legitimate service.exe runs, achieving privilege escalation to SYSTEM.

Answer

Create a malicious executable named 'C:\Program.exe' and place it in the root of C:.

Answer

Modify the service's binary path in the registry to point to a malicious executable.

Answer

Use SeImpersonatePrivilege to impersonate the SYSTEM account and directly modify the service.

Question 2

A penetration tester has discovered a local file inclusion (LFI) vulnerability in a PHP web application. The vulnerable code uses the following pattern: include($_GET['page']);. The application runs on a Linux server with Apache and PHP. The tester wants to achieve remote code execution (RCE). Which technique is most likely to succeed given this LFI?

Accepted Answer

Use the php://input wrapper and send PHP code in the POST body.. The correct technique is to use the php://input wrapper because it allows the attacker to pass arbitrary PHP code in the HTTP POST body, which the include() function will execute as PHP. Since the vulnerable code directly includes user input without sanitization, the php://input stream reads the raw POST data and processes it as a PHP script, achieving remote code execution.

Answer

Use the file:// wrapper to read sensitive files like /etc/passwd.

Answer

Use the data:// wrapper with a base64-encoded PHP payload.

Answer

Set allow_url_include to On in php.ini via the LFI.

Question 3

A penetration tester has gained a shell on a Linux machine as a low-privileged user. The user can execute the binary 'less' with sudo privileges without a password. Which technique can the tester use to escalate privileges to root?

Accepted Answer

Use the '!' command within 'less' to execute a shell.. The 'less' binary, when executed with sudo, retains its ability to spawn a shell via the '!' command. Since the user can run 'less' as root without a password, typing '!/bin/bash' (or simply '!bash') inside 'less' will execute a shell with root privileges, effectively escalating to root.

Answer

Exploit a buffer overflow in the 'less' binary.

Answer

Run 'sudo -u root bash' to switch to a root shell.

Answer

Modify the PATH to trick sudo into running a malicious binary.

Question 4

During an internal penetration test, a tester captures a NetNTLMv2 hash via an SMB relay attack. The target network does not enforce SMB signing. What is the most effective next step to gain access to a remote server?

Accepted Answer

Relay the captured hash to authenticate to another server.. Since SMB signing is not enforced, the tester can relay the captured NetNTLMv2 hash directly to another server without needing to crack it. This works because the relay attack forwards the authentication challenge-response to a target server, allowing the tester to authenticate as the victim user without knowing the plaintext password. This is the most effective step because it provides immediate access without the time and resource cost of offline cracking.

Answer

Crack the hash offline using a dictionary attack.

Answer

Perform a pass-the-hash attack using the captured hash.

Answer

Use the hash to perform an LLMNR poisoning attack.

Question 5

A penetration tester is testing a web application that uses JSON Web Tokens (JWTs) for authentication. The tester discovers that the server does not verify the JWT signature properly. The tester crafts a JWT with an arbitrary payload and sets the algorithm to 'none'. Which attack does this enable?

Accepted Answer

Authentication bypass. Option C is correct because setting the JWT algorithm to 'none' removes all cryptographic verification. If the server does not validate the signature, it will accept a token with an arbitrary payload, allowing the attacker to impersonate any user without knowing the secret key. This directly results in an authentication bypass, as the server trusts the forged token.

Answer

SQL injection

Answer

Server-side request forgery

Answer

Cross-site request forgery

Question 6

During an internal penetration test, a tester gains a shell as the 'www-data' user on a Linux server. The server runs a PHP web application that connects to a PostgreSQL database using credentials stored in a config file. The tester discovers that the PostgreSQL server trusts all local connections (no password required) and that the web application's database user has the 'CREATEFUNC' privilege. Which technique is most effective for escalating privileges to database administrator (superuser) and executing system commands as the database service account?

Accepted Answer

Create a PostgreSQL function using a trusted language like Python or Perl that executes arbitrary system commands, then run it.. Option B is correct because the 'CREATEFUNC' privilege allows the web application database user to create user-defined functions in PostgreSQL. By creating a function in a trusted language (e.g., Python, Perl, or C) that executes arbitrary system commands, the tester can run those commands with the privileges of the database service account (e.g., 'postgres'), effectively escalating to superuser-level control and executing system commands without needing a password.

Answer

Use the stored credentials to log in as the web application user and run SELECT * FROM pg_shadow; to extract password hashes of other users.

Answer

Exploit a kernel vulnerability to gain root access and then dump the database files.

Answer

Use the 'sudo' command to switch to the postgres user if the www-data user has sudo privileges.

Question 7

A penetration tester with a low-privileged domain user account performs a Kerberoasting attack. What is the primary goal of this attack?

Accepted Answer

Obtain the plaintext password of a user account with a Service Principal Name (SPN).. Kerberoasting targets service accounts that have a Service Principal Name (SPN) registered in Active Directory. The attacker requests a Kerberos service ticket (TGS) for the SPN, which is encrypted with the service account's NTLM hash. The attacker then cracks this hash offline to recover the plaintext password, enabling lateral movement or privilege escalation.

Answer

Obtain the NTLM hash of the krbtgt account.

Answer

Obtain a list of all domain users.

Answer

Obtain a Kerberos ticket that can be used to impersonate a domain admin.

Question 8

During a penetration test, a tester gains shell access on a Linux server as a low-privileged user. The user is identified to be a member of the 'docker' group. Which technique is most effective for escalating privileges to root?

Accepted Answer

Use docker to mount the entire host filesystem and modify the root password.. Membership in the 'docker' group grants the user effective root-equivalent access because the Docker daemon runs as root and allows any member of the 'docker' group to issue commands that can mount arbitrary host paths. By running a container with the host filesystem mounted (e.g., `docker run -v /:/mnt --privileged -it alpine chroot /mnt`), the tester can directly modify the `/etc/shadow` file or the root password, thereby escalating privileges to root without needing any additional exploit.

Answer

Use docker to run a container with network host mode to access internal services.

Answer

Use docker to pull a malicious image from the internet to compromise other containers.

Answer

Use docker to create a new user with root privileges inside a container.

Question 9

A penetration tester discovers that a web application uses a vulnerable Java deserialization endpoint. The classpath includes the Apache Commons Collections library. Which attack technique is most likely to achieve remote code execution?

Accepted Answer

Java deserialization of untrusted data (RCE via Commons Collections).. The correct answer is A because the presence of the Apache Commons Collections library in the classpath, combined with a vulnerable Java deserialization endpoint, enables the classic 'gadget chain' attack. Attackers craft a malicious serialized object that, when deserialized, invokes methods in Commons Collections (e.g., InvokerTransformer) to execute arbitrary system commands, achieving remote code execution (RCE). This is a well-documented exploit chain (e.g., CVE-2015-7501) that directly leverages the library's reflection-based classes.

Answer

SQL injection.

Answer

Cross-site scripting.

Answer

Command injection.

Question 10

During an internal penetration test, a tester captures an NTLMv2 hash of a domain admin account using a Responder attack. The organization's password policy requires at least 12 characters with uppercase, lowercase, numbers, and special characters. Which password cracking technique is most likely to succeed first?

Accepted Answer

Hybrid attack combining dictionary words with numbers and special characters. Option C is correct because NTLMv2 hashes are computationally expensive to crack, and a hybrid attack that combines dictionary words with numbers and special characters is the most efficient approach given the 12-character minimum policy. This technique leverages common password patterns (e.g., 'Password123!') that users often create to meet complexity requirements, making it faster than brute-forcing all possible 12-character combinations.

Answer

Dictionary attack with common passwords

Answer

Brute-force attack with all possible 8-character combinations

Answer

Rainbow table attack on the hash

Question 11

A penetration tester has compromised a host and wants to move laterally to a server using pass-the-hash. Which of the following is required for a successful pass-the-hash attack against a Windows target?

Accepted Answer

The target must have the same local admin password hash. Pass-the-hash (PtH) attacks exploit the NTLM challenge-response authentication mechanism. When a target has the same local administrator password hash as the compromised host, the attacker can use the captured hash to authenticate to the target without knowing the plaintext password. This works because Windows caches the password hash in LSASS, and tools like Mimikatz can extract it for replay.

Answer

The target must have SMB signing enabled

Answer

The target must have a user account with the same password

Answer

The target must have the same machine account hash

Question 12

A penetration tester gains a low-privileged shell on a Linux server and discovers that the user is a member of the 'docker' group. The tester wants to escalate privileges to root. Which technique is most effective?

Accepted Answer

Run a Docker container with the host filesystem mounted and access it as root. Option C is correct because members of the 'docker' group can run Docker containers with the `-v /:/mnt` flag to mount the host filesystem into the container. Inside the container, the user effectively has root privileges (since the container runs as root by default) and can access the host's `/mnt` directory, allowing them to modify files like `/mnt/etc/shadow` or add an SSH key to `/mnt/root/.ssh/authorized_keys` to gain root access on the host.

Answer

Use cron job misconfigurations to execute a reverse shell

Answer

Exploit kernel vulnerabilities using a local exploit suggester

Answer

Abuse SETUID binaries to execute commands as root

Question 13

During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without proper escaping or encoding. The input is not sanitized and is included in the page's HTML. Which type of vulnerability is most likely present?

Accepted Answer

Cross-Site Scripting (XSS). The vulnerability is reflected Cross-Site Scripting (XSS) because the web application immediately echoes user-supplied input in the HTTP response without proper escaping or encoding, allowing an attacker to inject arbitrary HTML or JavaScript that executes in the victim's browser. This matches the classic definition of reflected XSS, where the payload is part of the request and reflected back, not stored on the server.

Answer

SQL injection

Answer

Stored XSS

Answer

Cross-Site Request Forgery (CSRF)

Question 14

A penetration tester has gained low-privilege shell access on a Linux server. The tester runs `sudo -l` and sees the following entry: `(root) NOPASSWD: /usr/bin/python3 /opt/scripts/*.py` The `/opt/scripts/` directory is owned by the tester's current user. Which technique is most effective for escalating privileges to root?

Accepted Answer

Write a malicious Python script to /opt/scripts/ that spawns a root shell. Option B is correct because the tester's user owns `/opt/scripts/` and can write arbitrary files there. The sudo rule allows executing any `.py` file in that directory as root without a password. By writing a Python script that calls `os.setuid(0); os.system('/bin/bash')` or similar, the tester can spawn a root shell, directly leveraging the misconfigured sudoers entry.

Answer

Create a symbolic link from a Python script to a system file like /etc/shadow

Answer

Exploit a kernel vulnerability to overwrite the sudo binary

Answer

Overwrite an existing Python script in /usr/bin/ with a malicious payload

Question 15

A tester has low-privilege shell access on a Linux server. Which two checks are most appropriate for local privilege escalation enumeration? (Choose 2.)

Accepted Answer

Review sudo privileges with sudo -l.. Option A is correct because `sudo -l` lists the commands the current user can execute with elevated privileges, which is a standard first step in privilege escalation enumeration. If the user has sudo rights to any command without a password or with a known password, they can potentially run that command as root, leading to full system compromise.

Answer

Run a full SYN scan of the public IP range.

Answer

Send phishing emails to the finance department.