PT0-002 Attacks and Exploits Practice Test 10 — 15 Questions

Question 1

During a penetration test, you successfully execute a Meterpreter session on a Windows target. You want to dump password hashes from the SAM database. Which Meterpreter command should you use?

Accepted Answer

hashdump. hashdump is the Meterpreter command to dump SAM hashes.

Answer

getsystem

Answer

getuid

Answer

sysinfo

Question 2

In Metasploit, after searching for an exploit, you select it with 'use exploit/...' and set required options. What is the final command to execute the exploit against the target?

Accepted Answer

run. The 'run' or 'exploit' command launches the exploit.

Answer

execute

Answer

launch

Answer

start

Question 3

You are performing a password attack on a Linux system. You have obtained the /etc/shadow file. Which password cracking tool would be most efficient for a rule-based attack using a wordlist?

Accepted Answer

Hashcat -a 0 -r rule.rule. Hashcat with rule files is highly efficient for rule-based attacks; John can also do it but Hashcat is GPU-accelerated and commonly preferred.

Answer

John the Ripper --rules

Answer

Hydra -l root -P wordlist

Answer

CrackMapExec --hash

Question 4

You are performing a penetration test and capture a Kerberos TGS ticket for a service account. What kind of attack can you perform offline to crack the service account password?

Accepted Answer

Kerberoasting. Kerberoasting involves requesting TGS tickets and cracking them offline to recover service account passwords.

Answer

AS-REP roasting

Answer

LLMNR poisoning

Answer

Pass-the-Ticket

Question 5

You are enumerating a Linux system for privilege escalation vectors. Which TWO conditions below could be exploited to escalate privileges? (Select TWO.)

Accepted Answer

SUID binary owned by root. Writable cron scripts and SUID binaries are common Linux privesc vectors.

Answer

Unquoted service path

Answer

User has SeImpersonatePrivilege

Answer

AlwaysInstallElevated registry key set to 1

Question 6

During a web application penetration test, you find that the application is vulnerable to CSRF. Which TWO factors could prevent exploitation even if a CSRF vulnerability exists? (Select TWO.)

Accepted Answer

SameSite cookie attribute set to Lax. SameSite Lax strict prevents cross-site requests; custom headers can be used to validate origin.

Answer

Application uses JSON content type

Answer

Presence of a CSRF token that is validated server-side

Answer

Application uses HTTPS

Question 7

You have compromised a low-privileged Windows user and want to move laterally to a domain controller. Which THREE techniques could be used for lateral movement if you have valid credentials? (Select THREE.)

Accepted Answer

WMIExec. WMIExec, PsExec, and Pass-the-Hash with CrackMapExec are all valid lateral movement techniques using valid credentials. WMIExec leverages Windows Management Instrumentation, PsExec uses the Windows admin shares, and Pass-the-Hash attacks allow authentication using NTLM hashes without knowing the plaintext password, often executed with tools like CrackMapExec.

Answer

Token impersonation with PrintSpoofer

Answer

AS-REP roasting

Question 8

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR responses. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

John the Ripper

Answer

Bettercap

Answer

Hashcat

Question 9

A penetration tester wants to perform a pass-the-hash attack against a Windows target. Which tools can be used to authenticate using an NTLM hash without knowing the plaintext password? (Choose the best option.)

Accepted Answer

CrackMapExec. CrackMapExec is a popular tool for pass-the-hash attacks across many Windows services.

Answer

Nmap

Answer

Responder

Answer

Wireshark

Question 10

During a web application test, a tester discovers a parameter that appears to be vulnerable to SQL injection. They want to extract data from a database using a technique that does not rely on visible output. Which type of SQL injection is most appropriate?

Accepted Answer

Blind time-based SQL injection. Blind SQL injection, specifically time-based, is used when no error or data is returned, allowing inference via time delays.

Answer

UNION-based SQL injection

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Question 11

A penetration tester identifies a Linux binary with the SUID bit set. Which command can find all SUID binaries on a Linux system?

Accepted Answer

find / -perm /4000. The find command with -perm /4000 lists files with SUID set.

Answer

ps aux

Answer

ls -la

Answer

chmod u+s

Question 12

While exploiting a Windows machine, a tester gains a shell with limited privileges. They attempt to escalate privileges using a tool that exploits the SeImpersonatePrivilege. Which tool is specifically designed for this purpose on modern Windows versions?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege on Windows 10/Server 2016+ to gain SYSTEM.

Answer

Mimikatz

Answer

JuicyPotato

Answer

PowerUp

Question 13

A tester is performing a JWT attack and modifies the header to set the algorithm to 'none'. Which vulnerability are they exploiting?

Accepted Answer

Algorithm confusion. Setting alg to 'none' bypasses signature verification, a known JWT vulnerability.

Answer

Token theft

Answer

Weak secret brute-force

Answer

Kid injection

Question 14

After gaining initial access to a target, a tester wants to pivot to an internal network that is not directly accessible. Which technique can be used to forward traffic from the tester's machine through the compromised host to reach internal services?

Accepted Answer

SSH local port forwarding (-L). SSH local port forwarding (-L) allows the tester to access internal services via the compromised host.

Answer

SSH dynamic port forwarding (-D)

Answer

Netcat

Answer

SSH remote port forwarding (-R)

Question 15

A penetration tester needs to perform Kerberoasting against an Active Directory domain. Which step is required after requesting TGS tickets?

Accepted Answer

Crack the TGS hashes offline. After requesting TGS tickets for service accounts, the tester must crack the hashes offline using a tool like Hashcat.

Answer

Perform SMB relay

Answer

Request TGT ticket

Answer

Extract NTLM hashes from LSASS