PT0-002 Post-exploitation and Lateral Movement — 20 Questions

Question 1

During a penetration test, you have compromised a Linux server and discovered that it has SSH keys for several other servers in the same subnet. You want to use these keys to pivot to another host without being prompted for a password. Which command should you use to add the private key to your SSH agent and then connect to the target?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ssh-add /path/to/private_key && ssh user@target. To use a discovered SSH private key for lateral movement without password prompts, the key must be loaded into the SSH agent. The ssh-add command accomplishes this, and subsequent SSH connections will use the agent for authentication. Directly specifying the key with -i works only if the key is not passphrase-protected, but the scenario implies using the agent for seamless access. Starting the agent without adding the key is insufficient.

Answer

ssh-keygen -y -f /path/to/private_key > /path/to/public_key && ssh user@target

Answer

ssh -i /path/to/private_key user@target

Answer

eval $(ssh-agent) && ssh user@target

Question 2

After compromising a host in a segmented network, a penetration tester wants to use the compromised host as a pivot to scan an internal subnet that is not directly reachable. Which Metasploit module should the tester use to add a route through the Meterpreter session?

Accepted Answer

route add 10.10.10.0/24 <session_id>. The route add command in Metasploit's console is used to add a route to a target subnet through a Meterpreter session. This enables other modules to scan or exploit hosts in that subnet by directing traffic through the compromised host. Port forwarding (portfwd) is for specific ports, while autoroute is a module that can also add routes but is not the direct command. The route add command is the standard and simplest way to achieve pivoting.

Answer

use post/multi/manage/autoroute

Answer

portfwd add -l 8080 -p 80 -r 10.10.10.10

Answer

autoroute -s 10.10.10.0/24

Question 3

A penetration tester has gained access to a Windows domain controller and wants to extract Kerberos tickets from memory to perform a pass-the-ticket attack. Which tool and command should the tester use to list and export all Kerberos tickets from the current session?

Accepted Answer

mimikatz # sekurlsa::tickets /export. To perform pass-the-ticket, the tester needs to extract Kerberos tickets from memory. Mimikatz's sekurlsa::tickets module lists all tickets in the current session and can export them with /export. The exported .kirbi files can then be injected using kerberos::ptt. Other commands like kerberos::golden forge new tickets, lsadump::dcsync retrieves the KRBTGT hash, and sekurlsa::logonpasswords extracts passwords but not tickets.

Answer

mimikatz # lsadump::dcsync /user:krbtgt

Answer

mimikatz # sekurlsa::logonpasswords

Answer

mimikatz # kerberos::golden /user:Administrator /domain:example.com /sid:S-1-5-21-... /krbtgt:... /ticket:golden.kirbi

Question 4

A penetration tester has compromised a Windows host and wants to perform lateral movement using WMI. The tester has obtained local administrator credentials for the target host but wants to avoid writing files to disk. Which two methods can be used to execute commands remotely via WMI without creating files on the target? (Choose two.)

Accepted Answer

Using wmic /node:target process call create "cmd.exe /c ...". Two WMI-based methods for remote command execution without writing files to disk are using the wmic command-line tool with process call create, and using PowerShell's Invoke-WmiMethod to call Win32_Process Create. Both leverage WMI to spawn processes on the target. PsExec writes a service binary to disk, schtasks creates a scheduled task on disk, and WinRS uses WinRM, not WMI.

Answer

Using winrs -r:target cmd.exe

Answer

Using schtasks /create /s target /tn ... /tr ... /sc once /st ...

Answer

Using psexec.exe \target -accepteula cmd.exe