PT0-002 Timed Hard Questions — 25 Difficult Questions

Question 1

A penetration tester has compromised a Linux host and wants to use it as a pivot point to access an internal network that is not directly reachable from the attacker's machine. Which tool can create a SOCKS proxy for routing traffic through the compromised host?

15 minute time limit — choose an answer to begin.

Accepted Answer

chisel. Chisel is a fast TCP/UDP tunnel over HTTP that can create a SOCKS proxy for pivoting.

Answer

Responder

Answer

nmap

Answer

netcat

Question 2

During a penetration test, a tester gains initial access to a Linux server and wants to pivot to an internal network that is not directly accessible. Which of the following tools is specifically designed for creating SOCKS proxies for pivoting?

Accepted Answer

chisel. Chisel is a tool that creates tunnels and SOCKS proxies over HTTP, ideal for pivoting through restrictive networks.

Answer

netcat

Answer

nmap

Answer

hydra

Question 3

A client is subject to PCI DSS compliance and requests a penetration test. The client's network has a mix of in-scope systems (cardholder data environment) and out-of-scope systems. During scoping, the tester recommends a specific approach to ensure accurate segmentation testing. Which of the following is the most important consideration for the rules of engagement?

Accepted Answer

The tester must have network access to both in-scope and out-of-scope systems. To perform PCI DSS segmentation testing, the tester must verify that out-of-scope systems cannot access the CDE. This requires the ROE to explicitly authorize probing out-of-scope systems and provide network access to them. A network diagram is a useful planning artifact, but it is not a rule of engagement. Without authorization to test out-of-scope systems, segmentation testing cannot be performed.

Answer

The tester must be provided with a diagram of the network segmentation

Answer

The tester must agree not to scan any out-of-scope IP addresses

Answer

The tester must obtain written authorization from the client's security team

Question 4

A penetration tester is attempting to exploit a buffer overflow vulnerability in a Linux binary. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be the MOST effective to achieve code execution?

Accepted Answer

Perform a return-to-libc attack to call system("/bin/sh"). With DEP enabled, the stack is non-executable, so injecting shellcode directly into the buffer (Option A) would fail. Since ASLR is disabled, library addresses are fixed, making a return-to-libc attack viable. Option C exploits this by overwriting the return address with the address of system() and placing the string "/bin/sh" in memory, achieving code execution without needing an executable stack.

Answer

Inject shellcode into the buffer and redirect execution to it

Answer

Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode

Answer

Use a heap spray to place shellcode at a known address and then trigger the overflow

Question 5

During an internal penetration test, a tester compromises a server that is part of a Kubernetes cluster. The tester has access to the node's operating system but not to the cluster's administrative credentials. Which of the following techniques would most likely allow the tester to escalate privileges to cluster-admin or access sensitive resources within the cluster?

Accepted Answer

Extracting a service account token from a running container and using it to access the Kubernetes API. Service account tokens are automatically mounted into pods at /var/run/secrets/kubernetes.io/serviceaccount/token. An attacker with node-level access can extract this token from a running container's filesystem and use it to authenticate to the Kubernetes API server. Since service accounts are often granted broad permissions via RBAC bindings, this token may allow the tester to access sensitive resources or even escalate to cluster-admin if the service account has such privileges.

Answer

Exploiting a kernel vulnerability on the node to escape to the host and then compromise the Kubernetes API server

Answer

Searching for a kubeconfig file on the node that contains a cluster-admin token

Answer

Modifying a ConfigMap to inject a malicious pod that runs with elevated privileges

Question 6

A penetration tester is tasked with performing vulnerability scanning on a target organization that uses a web application firewall (WAF) and an intrusion prevention system (IPS). The tester wants to avoid being blocked while still gathering comprehensive data. Which scanning approach is most effective?

Accepted Answer

Use a slow, distributed scan from multiple IP addresses with random delays. A slow, distributed scan from multiple IP addresses with random delays is most effective because it evades rate-based detection mechanisms in WAFs and IPSs. By spreading the scan across many sources and introducing jitter, the traffic appears as normal user activity rather than a coordinated attack, allowing comprehensive data collection without triggering blocks.

Answer

Perform an aggressive scan with a high thread count to complete before the WAF adapts

Answer

Only perform passive reconnaissance and avoid active scanning

Answer

Use known WAF bypass techniques for each request

Question 7

A penetration tester has obtained the NTLM hash of a service account during an internal test. The tester wants to gain access to a specific SQL server that uses Kerberos authentication. The tester does not know the plaintext password. Which attack is MOST appropriate to forge a service ticket for the SQL server?

Accepted Answer

Silver Ticket attack. A Silver Ticket attack is the most appropriate because it forges a service ticket (TGS) for a specific service, such as the SQL server, using the NTLM hash of the service account. Since the tester has the NTLM hash but not the plaintext password, they can craft a valid Kerberos service ticket without needing to authenticate to the domain controller, directly granting access to the SQL server.

Answer

Golden Ticket attack

Answer

Pass-the-hash attack

Answer

SMB relay attack

Question 8

A penetration tester is performing post-exploitation on a Windows domain controller and wants to extract Kerberos tickets for offline cracking. Which two Impacket tools can be used to obtain ticket-granting service (TGS) tickets? (Choose TWO.)

Accepted Answer

GetUserSPNs. GetUserSPNs retrieves TGS tickets for accounts with Service Principal Names (SPNs) via Kerberoasting, directly answering the question. GetNPUsers, while useful, retrieves TGTs for accounts without Kerberos pre-authentication (AS-REP roasting), not TGS tickets. Therefore, only GetUserSPNs is correct for extracting TGS tickets.

Answer

GetNPUsers

Answer

psexec

Answer

wmiexec

Answer

secretsdump

Question 9

During a red team engagement, a penetration tester needs to pivot from a compromised internal web server to a database server that is not directly accessible. The web server has two network interfaces: 10.0.1.5 and 192.168.1.5. The database server is at 192.168.1.10. Which technique should the tester use to reach the database?

Accepted Answer

Pivoting through the web server. D is correct because the web server has two network interfaces (10.0.1.5 and 192.168.1.5), making it a dual-homed host that can act as a pivot point. The tester can use the compromised web server as a proxy or relay to route traffic from the attacker's machine (reachable via 10.0.1.5) to the database server at 192.168.1.10, which is on a separate subnet not directly accessible. This technique, known as pivoting, typically involves tools like SSH port forwarding, Metasploit's route add, or a SOCKS proxy to forward traffic through the compromised host.

Answer

ARP spoofing

Answer

DNS tunneling

Answer

Port knocking

Question 10

A penetration tester is engaged to assess a corporate network that uses a centralized logging server (SIEM) with a 24/7 SOC. The tester has gained initial access to a Windows workstation via a phishing email. The goal is to move laterally to a domain controller without triggering alerts. The internal network is segmented into VLANs: a user VLAN (192.168.1.0/24) and a server VLAN (10.0.0.0/24) with strict firewall rules allowing only specific ports (e.g., RDP from user VLAN to server VLAN is denied). The tester discovers that the workstation has a PowerShell script that runs every hour to check for drive space on all servers using WinRM (port 5985) with stored domain admin credentials. The script is scheduled via a domain GPO. Which of the following actions should the tester perform to achieve lateral movement to the domain controller with the lowest chance of detection?

Accepted Answer

Modify the existing PowerShell script to include a reverse shell that connects back to the tester. Modifying the existing PowerShell script to include a reverse shell allows the tester to execute code on the domain controller using WinRM (port 5985), which is already permitted by the firewall and part of a legitimate scheduled task. This approach leverages the stored domain admin credentials and the trusted script execution path, avoiding any new connections or anomalies that would trigger SOC alerts. The reverse shell blends into the normal WinRM traffic, making detection by the SIEM or SOC highly unlikely.

Answer

Alter the firewall rules to allow direct access from the user VLAN to the server VLAN

Answer

Use a RDP client to connect directly to the domain controller from the workstation

Answer

Perform a pass-the-hash attack from the workstation to the domain controller using SMB

Question 11

A penetration tester is assessing a web application that uses JSON Web Tokens (JWT) for authentication. The tester captures a valid JWT from a user session. The JWT header contains a 'kid' (key ID) parameter. The tester suspects the application is vulnerable to a key injection attack via the 'kid' parameter. Which attack technique should the tester use to forge a valid JWT without knowing the secret key?

Accepted Answer

Set the algorithm header to 'none' (null signature attack).. Setting the algorithm header to 'none' removes the need for a signature entirely. The JWT library, if not properly configured to reject 'none' algorithm tokens, will accept the forged token as valid, allowing the tester to impersonate any user without knowing the secret key.

Answer

Replace the 'kid' value with a path to a known file on the server (e.g., /dev/null) that contains predictable content.

Answer

Use a side-channel attack to extract the secret key.

Answer

Perform a timing attack to recover the secret key character by character.

Question 12

During a penetration test, a tester identifies a buffer overflow vulnerability in a Linux binary. The system has ASLR and NX (Non-Executable) enabled. The tester finds a ROP gadget at a fixed address in a library that is loaded at a constant address across reboots. Which exploitation method is the most appropriate to achieve code execution?

Accepted Answer

Return-Oriented Programming (ROP) chain. Return-Oriented Programming (ROP) is specifically designed to bypass both ASLR and NX when a fixed-address ROP gadget is available. Since the library is loaded at a constant address across reboots, the tester can chain gadgets from that library to execute arbitrary code without needing to inject executable shellcode.

Answer

Return-to-libc attack

Answer

Heap spraying

Answer

SEH overwrite exploit

Question 13

A penetration tester is analyzing a Bash script that automates a password spraying attack. The script contains the following loop: 'for user in $(cat users.txt); do for pass in $(cat passwords.txt); do curl -s -o /dev/null -w "%{http_code}" --data "user=$user&pass=$pass" http://target/login; done; done'. The script runs but the output is a continuous stream of HTTP status codes that are hard to interpret. Which improvement would most effectively help the tester identify a successful login?

Accepted Answer

Add a conditional statement that checks if the HTTP status code is 302 (redirect) or 200, and if so, prints the successful credentials.. The script currently outputs a raw stream of HTTP status codes with no context. Adding a conditional to check for 302 (redirect, often indicating a successful login) or 200 (OK) and printing the corresponding credentials allows the tester to immediately identify which user/password pair succeeded, turning an unreadable output into actionable intelligence.

Answer

Add a delay with 'sleep 1' between requests to avoid rate limiting.

Answer

Pipe the output to 'grep -v 200' to exclude any responses that are not 200 OK.

Answer

Use 'curl -v' to see the full response headers.

Question 14

A penetration tester is evaluating a cloud environment (AWS) and finds an S3 bucket with public write access. Which attack is most likely to succeed if the tester wants to plant malicious files that will be served to users?

Accepted Answer

Upload a malicious JavaScript file to the bucket. An S3 bucket with public write access allows anyone to upload objects without authentication. A penetration tester can upload a malicious JavaScript file (e.g., for cross-site scripting or drive-by download) that, when accessed by users via the bucket's public URL, executes in their browsers. This directly exploits the misconfiguration to serve malicious content to end users.

Answer

Exhaust the bucket's storage quota

Answer

Encrypt all objects in the bucket for ransom

Answer

Modify the bucket policy to grant further permissions

Question 15

During an internal test, a penetration tester discovers a web application that is vulnerable to Server-Side Template Injection (SSTI). The application uses a template engine that does not sandbox user input. Which of the following payloads would be MOST effective to achieve remote code execution on the server?

Accepted Answer

{{config.__class__.__init__.__globals__['os'].popen('id').read()}}. It exploits Python's object model to access the `os` module via `__class__.__init__.__globals__`, bypassing the template engine's lack of sandboxing. This allows the attacker to execute arbitrary system commands like `id` on the server, achieving remote code execution (RCE). The payload is specific to Jinja2 or similar Python-based template engines that expose built-in objects.

Answer

Answer

Answer

${7*7}

Question 16

A penetration tester is targeting a Windows domain controller. After compromising a standard user account, the tester wants to escalate to domain admin. Which attack is most effective if the tester can capture plaintext passwords from memory?

Accepted Answer

Pass-the-hash attack. Capturing plaintext passwords from memory (e.g., via Mimikatz sekurlsa::logonpasswords) allows the tester to directly use the domain admin's plaintext credentials in a pass-the-hash attack. This attack reuses the NTLM hash (or plaintext) to authenticate to other systems without needing to crack or forge tickets, making it the most direct escalation path from a standard user to domain admin when plaintext passwords are available.

Answer

Create a golden ticket

Answer

Create a silver ticket

Answer

DCSync attack

Question 17

A penetration tester is performing a vulnerability scan on a web server that uses HTTPS. The tester wants to identify the server's SSL/TLS configuration weaknesses without overwhelming the server. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --script ssl-enum-ciphers -p 443 target. The `ssl-enum-ciphers` NSE script enumerates all supported SSL/TLS ciphers and protocols on the target, providing a detailed assessment of cryptographic weaknesses (e.g., weak ciphers, outdated TLS versions). The `-sV` flag enables version detection, and `-p 443` targets the HTTPS port, while the script itself is designed to be lightweight and not overwhelm the server, making it ideal for a non-intrusive vulnerability scan.

Answer

nmap -sT -A -T4 -p 443 target

Answer

nmap -sU -p 443 target

Answer

nmap -sC -p 443 target

Question 18

A penetration tester is analyzing a PowerShell script used during an internal test. The script contains the following code block: ```powershell $cred = Get-Credential $session = New-PSSession -ComputerName 'Server01' -Credential $cred Invoke-Command -Session $session -ScriptBlock { Get-ChildItem C:\Secrets.txt } Remove-PSSession $session ``` What is the primary purpose of this script?

Accepted Answer

To achieve lateral movement and access a file on a remote server. The script uses Get-Credential to obtain user credentials, creates a remote PowerShell session (PSSession) to Server01 via New-PSSession, and then executes Get-ChildItem C:\Secrets.txt on that remote server using Invoke-Command. This is the classic pattern for lateral movement: authenticating to a remote host and accessing a file stored there, not performing any local privilege escalation or password brute-forcing.

Answer

To perform a local privilege escalation using stored credentials

Answer

To brute-force the password of the user account via 'Get-Credential'

Answer

To execute a script from the remote server using the ScriptBlock

Question 19

During an internal penetration test, a tester gains a shell as the 'www-data' user on a Linux server. The server runs a PHP web application that connects to a PostgreSQL database using credentials stored in a config file. The tester discovers that the PostgreSQL server trusts all local connections (no password required) and that the web application's database user has the 'CREATEFUNC' privilege. Which technique is most effective for escalating privileges to database administrator (superuser) and executing system commands as the database service account?

Accepted Answer

Create a PostgreSQL function using a trusted language like Python or Perl that executes arbitrary system commands, then run it.. The 'CREATEFUNC' privilege allows the web application database user to create user-defined functions in PostgreSQL. By creating a function in a trusted language (e.g., Python, Perl, or C) that executes arbitrary system commands, the tester can run those commands with the privileges of the database service account (e.g., 'postgres'), effectively escalating to superuser-level control and executing system commands without needing a password.

Answer

Use the stored credentials to log in as the web application user and run SELECT * FROM pg_shadow; to extract password hashes of other users.

Answer

Exploit a kernel vulnerability to gain root access and then dump the database files.

Answer

Use the 'sudo' command to switch to the postgres user if the www-data user has sudo privileges.

Question 20

During a vulnerability scan of a web application, the penetration tester notices that the scanner reports a critical SQL injection vulnerability in the login parameter. However, manual testing confirms that the input is properly sanitized and the vulnerability is a false positive. Which of the following actions should the tester take to ensure accurate vulnerability identification and avoid wasting time on false positives in future scans?

Accepted Answer

Correlate the scanner output with manual verification and document the discrepancy. The penetration tester should correlate automated scanner output with manual verification to confirm findings, then document the discrepancy for future reference. This ensures accurate vulnerability identification by leveraging human analysis to filter false positives, which is a standard practice in PT0-002 methodology for information gathering and vulnerability scanning.

Answer

Increase the scan intensity to ensure the vulnerability is accurately detected

Answer

Modify the scanner's configuration to exclude false positive patterns

Answer

Ignore the finding and proceed with manual testing only