PT0-002 Attacks and Exploits — 40 Questions

Question 1

A penetration tester has successfully compromised a Windows machine and wants to perform lateral movement to another machine using captured NTLM hashes. Which tool would allow the tester to pass the hash and execute commands remotely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CrackMapExec. CrackMapExec is a popular tool for pass-the-hash and executing commands via SMB or other protocols.

Answer

John the Ripper

Answer

Metasploit

Answer

pth-winexe

Question 2

During a penetration test, a tester identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). The tester attempts to access the AWS metadata endpoint to retrieve temporary credentials. Which IP address is commonly used for the cloud metadata endpoint?

Accepted Answer

169.254.169.254. The AWS metadata endpoint is available at 169.254.169.254 for all cloud providers.

Answer

127.0.0.1

Answer

192.168.1.254

Answer

10.0.0.1

Question 3

A penetration tester is exploiting a SQL injection vulnerability in a login page. The tester wants to extract data from another table without returning data in the original query. Which SQL injection technique should the tester use?

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection is the correct technique because it allows data extraction without returning data in the original query output. The tester injects conditional time delays (e.g., IF condition WAIT FOR DELAY) to infer information bit by bit based on response timing. UNION-based SQL injection combines query results into the original output, violating the requirement. Error-based SQL injection returns data in error messages, which is a form of output. Out-of-band SQL injection uses a separate channel, but the stem implies no output at all, making time-based the best fit.

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Question 4

A penetration tester is assessing a web application that uses JSON Web Tokens (JWT) for authentication. The tester discovers that the server does not validate the signature algorithm properly. Which attack should the tester attempt to forge a valid token?

Accepted Answer

Use 'alg:none'. If the server accepts 'none' algorithm, the token can be forged without a signature.

Answer

Brute-force the secret key

Answer

KID injection

Answer

Algorithm confusion attack

Question 5

Which Metasploit command is used to interact with an established session on a compromised host?

Accepted Answer

sessions. The sessions command lists and interacts with active sessions.

Answer

use

Answer

exploit

Answer

run

Question 6

A tester is performing a Cross-Site Request Forgery (CSRF) attack on a web application that uses SameSite cookies. Which SameSite attribute value is most likely to prevent the attack?

Accepted Answer

SameSite=Strict. SameSite=Lax prevents CSRF for state-changing requests from cross-site, while Strict is even more restrictive. None allows third-party cookies.

Answer

SameSite=None

Answer

SameSite=Secure

Answer

SameSite=Lax

Question 7

During a penetration test of a web application, you want to test for Cross-Site Request Forgery (CSRF) vulnerabilities. Which TWO conditions are necessary for a CSRF attack to succeed?

Accepted Answer

The request performs a state-changing action (e.g., password change). CSRF requires the application to rely solely on cookies for authentication and lack anti-CSRF tokens, and the requests must trigger state changes.

Answer

The application validates the Referer header

Answer

The application uses SameSite cookies set to Lax or Strict

Answer

The application uses anti-CSRF tokens in forms

Question 8

You have gained a foothold on a Linux server and identified a SUID binary that can be exploited to read arbitrary files. Which THREE techniques could be used to escalate privileges or gather sensitive information?

Accepted Answer

Leveraging the binary's ability to write to arbitrary files (if present). SUID binaries with file read capabilities can be used to read sensitive files, and when combined with other techniques like PATH manipulation or exploiting the binary's functionality, can lead to privilege escalation.

Answer

Performing a DLL hijacking attack

Answer

Exploiting a kernel vulnerability

Question 9

A penetration tester wants to pivot from a compromised Linux host to attack internal network resources that are not directly accessible. Which THREE tools or techniques can be used for pivoting?

Accepted Answer

Metasploit route command. SSH port forwarding (local, remote, dynamic) and tools like chisel and ligolo-ng are commonly used for pivoting in Linux environments.

Answer

psexec

Answer

Windows Remote Desktop (RDP)

Question 10

A penetration tester obtains a meterpreter session on a Windows target. Which command would the tester use to check the current user's privileges and potentially escalate privileges if SeImpersonatePrivilege is enabled?

Accepted Answer

getsystem. The 'getsystem' command in meterpreter attempts to escalate privileges using various techniques, including token impersonation if SeImpersonatePrivilege is available.

Answer

sysinfo

Answer

getuid

Answer

hashdump

Question 11

A tester finds a Linux binary with the SUID bit set that is owned by root and can be executed by any user. The binary is known to have a vulnerability that allows arbitrary code execution. Which command does the tester use to find all SUID binaries on the system?

Accepted Answer

find / -perm /4000. The 'find / -perm /4000' command locates files with the SUID bit set (4000 permission).

Answer

ls -la /bin/su

Answer

find / -perm /2000

Answer

find / -type f -perm 0777

Question 12

A penetration tester has compromised a Linux server and wants to establish persistence. Which TWO of the following methods are commonly used for persistence on Linux?

Accepted Answer

Adding an SSH public key to authorized_keys. Cron jobs and SSH authorized_keys are standard persistence techniques on Linux.

Answer

Registry Run keys

Answer

WMI subscriptions

Answer

Creating a new service

Question 13

A penetration tester is assessing an Active Directory environment and wants to perform Kerberoasting to obtain service account passwords. Which TWO conditions are required for a successful Kerberoasting attack?

Accepted Answer

The attacker must be able to request TGS tickets from the domain controller. A domain account with a Service Principal Name (SPN) and the ability to request a TGS ticket are required for Kerberoasting.

Answer

The service account password must be weak

Answer

The domain must be using NTLM authentication

Answer

The attacker must have domain admin privileges

Question 14

During a penetration test, the tester captured an NTLM hash using Responder and wants to pass the hash to gain access to a remote Windows system. Which tool would be most appropriate to perform a pass-the-hash attack?

Accepted Answer

pth-winexe. pth-winexe allows authenticating to Windows systems using an NTLM hash without the plaintext password.

Answer

John the Ripper

Answer

CrackMapExec

Answer

Hashcat

Question 15

A penetration tester is performing a SQL injection test on a web application. The tester sends the payload ' OR '1'='1 and receives the same response as with a normal request. However, when sending ' OR '1'='2, the response differs. Which type of SQL injection is most likely present?

Accepted Answer

Blind SQL injection (boolean-based). A difference in responses between a true condition and a false condition indicates blind SQL injection, specifically boolean-based blind.

Answer

Time-based blind SQL injection

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Question 16

During a penetration test, the tester discovers a Linux binary with the SUID bit set owned by root. The binary is a custom script that executes 'cp' to copy files. The tester can control the source file path via an environment variable. Which privilege escalation technique should the tester attempt?

Accepted Answer

PATH manipulation. PATH manipulation involves modifying the PATH environment variable to execute a malicious 'cp' binary instead of the legitimate one.

Answer

Writable script in cron

Answer

Kernel exploit

Answer

SUID binary exploitation using GTFOBins

Question 17

A penetration tester is performing a web application test and identifies an endpoint that is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions can the tester perform using this vulnerability? (Choose TWO.)

Accepted Answer

Access internal services running on localhost. SSRF can be used to access internal services and cloud metadata endpoints.

Answer

Perform SQL injection on the database

Answer

Upload files to the server

Answer

Read local files using file:// protocol

Question 18

During a Windows privilege escalation attempt, a penetration tester discovers that the always elevated installation policy is enabled. Which of the following actions can the tester take to exploit this misconfiguration? (Choose TWO.)

Accepted Answer

Use msiexec to silently install a crafted MSI. AlwaysInstallElevated allows any user to install .msi files with SYSTEM privileges. The tester can create a malicious MSI or use an existing one to execute commands.

Answer

Perform DLL hijacking on a system service

Answer

Exploit a kernel vulnerability

Answer

Modify the registry key to disable the policy

Question 19

While testing a Linux system, the tester finds a binary with the SUID bit set owned by root. The binary executes a command based on user input without verifying the path. Which privilege escalation technique does this exemplify?

Accepted Answer

SUID binary exploitation. PATH manipulation exploits insecure binary execution by modifying the PATH variable to execute malicious code.

Answer

Kernel exploit

Answer

Capability abuse

Answer

Cron job abuse

Question 20

A tester identifies a SQL injection vulnerability in a login form. The application responds with different error messages for valid and invalid queries. Which type of SQL injection is most likely present, and what tool could automate exploitation?

Accepted Answer

Blind SQLi; sqlmap. Blind boolean-based SQL injection infers data based on true/false responses; sqlmap automates exploitation.

Answer

UNION-based SQLi; sqlmap

Answer

Time-based blind SQLi; nmap

Answer

Error-based SQLi; Burp Suite