PT0-002 Attacks and Exploits Practice Test 5 — 15 Questions

Question 1

A penetration tester gained low-privileged access to a Linux server and found that the user can run a custom script located at /opt/tool/backup.sh with setuid root. The script begins with a hashbang #!/bin/bash and uses an internal variable defined as BASEDIR=$(dirname $0) to determine paths. Which technique is most likely to allow privilege escalation?

Accepted Answer

Create a malicious executable named 'dirname' in a directory earlier in the PATH. Option B is correct because the script uses `BASEDIR=$(dirname $0)` to resolve paths. If the user can place a malicious executable named `dirname` earlier in the PATH than the legitimate `/usr/bin/dirname`, then when the script runs with setuid root, the shell will execute the attacker's `dirname` binary instead, allowing arbitrary code execution as root.

Answer

Modify the $0 variable during execution

Answer

Overwrite /opt/tool/backup.sh with a reverse shell

Answer

Exploit a buffer overflow in the Bash interpreter

Question 2

Drag and drop the steps to perform a password cracking attack using John the Ripper into the correct order.

Question 3

Drag and drop the steps to perform a web application fuzzing using Burp Suite Intruder into the correct order.

Question 4

Match each vulnerability category to its description.

Question 5

Match each reporting element to its description.

Question 6

During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without sanitization. Which attack is most likely to be successful?

Accepted Answer

Reflected cross-site scripting. Reflected cross-site scripting (XSS) is the correct answer because the vulnerability described—user input reflected in the HTTP response without sanitization—directly enables an attacker to inject malicious scripts (e.g., JavaScript) that execute in the victim's browser. This occurs when the application fails to validate or encode the input before including it in the response, allowing the attacker to craft a URL with a script payload that, when visited, runs in the context of the vulnerable web application's origin.

Answer

Server-side request forgery

Answer

SQL injection

Answer

Cross-site request forgery

Question 7

A penetration tester needs to escalate privileges on a Linux target after gaining initial shell access. The /etc/passwd file shows a user 'jake' with UID 0. What does this indicate?

Accepted Answer

The user 'jake' has the same privileges as root. In Linux, a UID (User ID) of 0 is reserved exclusively for the root superuser. When the /etc/passwd file shows a user 'jake' with UID 0, the system treats 'jake' with the same privileges as root, regardless of the username. This is because the kernel checks the UID, not the username, for permission decisions. Therefore, 'jake' has full root-level access, making option C correct.

Answer

The user 'jake' is a normal user with UID misconfiguration

Answer

The user 'jake' is a member of the root group

Answer

There is a duplicate user 'jake' and 'root'

Question 8

A penetration tester is targeting a web application that uses parameterized queries for all database interactions. Which attack vector is most likely to succeed?

Accepted Answer

Business logic flaws. Parameterized queries prevent SQL injection by separating SQL code from user input, making option B ineffective. Business logic flaws (D) are vulnerabilities in the application's design or workflow that are not mitigated by secure coding practices like parameterized queries, so they remain exploitable. This attack vector targets the intended functionality of the application, such as manipulating pricing or bypassing authentication steps, which parameterized queries do not protect against.

Answer

Cross-site request forgery

Answer

SQL injection

Answer

Cross-site scripting

Question 9

While performing a password audit, a tester finds that the hash of 'Password123' is stored in the LAN Manager (LM) hash format. What is the primary security weakness of LM hashes?

Accepted Answer

The password is split into two 7-character halves. The primary security weakness of LAN Manager (LM) hashes is that the password is converted to uppercase, padded or truncated to 14 characters, and then split into two 7-character halves. Each half is hashed independently using DES as the key for a known constant, which means an attacker can brute-force each 7-character half separately, drastically reducing the keyspace from 14 characters to two sets of 7 characters. This makes LM hashes extremely vulnerable to offline cracking, especially with modern tools like John the Ripper or Hashcat.

Answer

The hash is case-sensitive

Answer

The hash is salted with a weak random value

Answer

The hash uses the MD4 hashing algorithm

Question 10

A penetration tester is performing a man-in-the-middle attack on a network using ARP spoofing. What is the primary purpose of ARP spoofing?

Accepted Answer

To associate the attacker's MAC address with the IP address of a legitimate host. ARP spoofing works by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host (e.g., the default gateway). This causes traffic destined for that IP to be sent to the attacker instead, enabling interception and manipulation of network communications.

Answer

To assign a fake IP address to the attacker's device

Answer

To modify the routing table of the target

Answer

To poison the DNS cache of the target

Question 11

During a penetration test, a tester exploits a buffer overflow vulnerability in a legacy application. After gaining code execution, what is the next best step to maintain access?

Accepted Answer

Create a backdoor user account. After gaining code execution via a buffer overflow, the next best step is to create a backdoor user account to maintain persistent access to the compromised system. This ensures the tester can re-enter the environment without re-exploiting the vulnerability, which may be patched or monitored. Creating a local user account (e.g., via `net user` or `useradd`) is a standard persistence technique in penetration testing, allowing continued access for lateral movement or data exfiltration.

Answer

Install an antivirus solution

Answer

Patch the buffer overflow vulnerability

Answer

Erase the application logs

Question 12

A penetration tester is using a vulnerability scanner that reports a 'Critical' severity for an 'SMBv1 vulnerability' on a Windows server. Which of the following is the correct remediation recommendation?

Accepted Answer

Disable SMBv1 on the server. The correct remediation for an SMBv1 vulnerability is to disable SMBv1 on the server. SMBv1 is a legacy protocol that lacks modern security features and is known to be exploited by malware like EternalBlue (used in WannaCry). Disabling SMBv1 eliminates the attack surface without affecting SMBv2 or SMBv3, which are secure and still functional.

Answer

Apply the latest Windows security patches

Answer

Enable SMB signing

Answer

Enable SMB encryption

Question 13

A penetration tester is exploiting a web application that stores session tokens in HTTP cookies without the HttpOnly flag. Which attack is most likely to succeed?

Accepted Answer

Session hijacking through cross-site scripting. The absence of the HttpOnly flag on session cookies allows client-side scripts (e.g., JavaScript) to access the cookie. An attacker can exploit a cross-site scripting (XSS) vulnerability to execute arbitrary JavaScript in the victim's browser, which then reads the session cookie and sends it to the attacker. This enables session hijacking without needing to guess or brute-force the token.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Server-side request forgery

Question 14

During a red team engagement, a penetration tester needs to pivot from a compromised internal web server to a database server that is not directly accessible. The web server has two network interfaces: 10.0.1.5 and 192.168.1.5. The database server is at 192.168.1.10. Which technique should the tester use to reach the database?

Accepted Answer

Pivoting through the web server. D is correct because the web server has two network interfaces (10.0.1.5 and 192.168.1.5), making it a dual-homed host that can act as a pivot point. The tester can use the compromised web server as a proxy or relay to route traffic from the attacker's machine (reachable via 10.0.1.5) to the database server at 192.168.1.10, which is on a separate subnet not directly accessible. This technique, known as pivoting, typically involves tools like SSH port forwarding, Metasploit's route add, or a SOCKS proxy to forward traffic through the compromised host.

Answer

ARP spoofing

Answer

DNS tunneling

Answer

Port knocking

Question 15

Which TWO of the following are common techniques used during a pass-the-hash attack? (Select TWO.)

Accepted Answer

Extracting NTLM hashes from LSASS. Option A is correct because in a pass-the-hash attack, the attacker first extracts NTLM hashes from the Local Security Authority Subsystem Service (LSASS) process memory. LSASS stores user credentials, including NTLM hashes, after successful authentication. By dumping LSASS (e.g., using Mimikatz sekurlsa::logonpasswords), the attacker obtains the hash without needing the plaintext password.

Answer

Performing a brute-force attack on the hash

Answer

Using a password spray attack

Answer

Requesting Kerberos TGS tickets