PT0-002 Attacks and Exploits Practice Test 11 — 15 Questions

Question 1

A tester exploits an XXE vulnerability to read local files. Which of the following is a typical XXE payload to read /etc/passwd?

Accepted Answer

<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]>. XXE uses an external entity with file:// to read local files.

Answer

' OR 1=1--

Answer

<?php system('cat /etc/passwd'); ?>

Answer

Question 2

After compromising a host, a tester wants to maintain persistence on a Windows system by executing a payload each time a user logs in. Which registry key is commonly used for this?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run execute programs at user logon.

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Question 3

A tester is using Hashcat to crack NTLM hashes. They want to try all possible passwords consisting of exactly 8 lowercase letters. Which attack mode and mask should they use?

Accepted Answer

-a 3 -m 1000 ?l?l?l?l?l?l?l?l. Brute-force mode (-a 3) with mask ?l?l?l?l?l?l?l?l tries all 8-letter lowercase combinations.

Answer

-a 6 -m 1000 ?l?l?l?l?l?l?l?l

Answer

-a 3 -m 0 ?l?l?l?l?l?l?l?l

Answer

-a 0 -m 1000 dictionary.txt

Question 4

A penetration tester is performing a web application assessment. Which of the following are common techniques to identify and exploit IDOR vulnerabilities? (Select TWO.)

Accepted Answer

Enumerate sequential IDs in URLs. IDOR involves manipulating object references; enumeration of IDs and modifying parameter values are common techniques.

Answer

Perform a man-in-the-middle attack

Answer

Use SQL injection to bypass authentication

Answer

Inject malicious scripts into input fields

Question 5

During a Linux privilege escalation attempt, a tester checks for misconfigurations that could allow running commands as root. Which of the following are potential vectors? (Select THREE.)

Accepted Answer

Sudo misconfigurations. SUID/SGID binaries, sudo misconfigurations, and writable cron scripts are common escalation vectors.

Answer

Unquoted service paths

Answer

DLL hijacking

Question 6

A penetration tester has gained a foothold in a Windows domain and wants to perform lateral movement. Which of the following tools or techniques can be used? (Select THREE.)

Accepted Answer

Evil-WinRM. PsExec, WinRM, and Evil-WinRM are common lateral movement tools in Windows environments.

Answer

Chisel

Answer

SSH

Question 7

During a penetration test, a tester uses Responder to capture NTLM hashes from a Windows network. Which of the following protocols is MOST commonly targeted by Responder for poisoning?

Accepted Answer

LLMNR. Responder poisons LLMNR, NBT-NS, and mDNS to capture NTLM hashes. The other options are not primary targets.

Answer

DNS

Answer

ICMP

Answer

HTTP

Question 8

A penetration tester gains a low-privilege shell on a Linux server. Using 'sudo -l', the tester finds that they can run '/usr/bin/vi' as root without a password. Which technique would the tester MOST likely use to escalate privileges?

Accepted Answer

Use vi to execute a shell as root. GTFOBins lists vi as having a sudo escape, allowing privilege escalation by spawning a root shell. Other options are not directly applicable.

Answer

Exploit a kernel vulnerability

Answer

Modify a cron script

Answer

Perform PATH hijacking

Question 9

During a web application test, a tester discovers a JWT token with the following header: {'alg':'HS256','typ':'JWT'}. The token payload contains 'admin':false. The tester attempts to change the algorithm to 'none' and removes the signature. Which vulnerability is being exploited?

Accepted Answer

JWT algorithm confusion (alg:none). JWT alg:none attack exploits servers that accept unsigned tokens. Other options are different attack types.

Answer

JWT brute-force

Answer

JWT kid injection

Answer

JWT injection

Question 10

A penetration tester has compromised a Windows machine and wants to perform lateral movement to another machine on the same network. The tester has obtained NTLM hashes, but not plaintext passwords. Which TWO tools can be used for pass-the-hash attacks?

Accepted Answer

CrackMapExec. pth-winexe and CrackMapExec support pass-the-hash by using NTLM hashes directly. PsExec and WinRM require plaintext credentials unless modified.

Answer

SSH

Answer

WinRM

Answer

PsExec

Question 11

During a Linux privilege escalation assessment, the tester finds that a binary with SUID root can execute arbitrary commands. Which TWO of the following methods are MOST likely to exploit this?

Accepted Answer

Use the binary to read /etc/shadow directly. GTFOBins provides SUID exploitation techniques; many SUID binaries allow command execution. The other options are not directly related to SUID exploitation.

Answer

Modify the binary's PATH environment variable

Answer

Exploit a kernel vulnerability

Answer

Replace the binary with a malicious one

Question 12

A penetration tester is conducting a web application test and finds a parameter that is vulnerable to XXE. Which THREE of the following actions can the tester perform using XXE?

Accepted Answer

Cause a denial of service. XXE can read files, perform SSRF, and cause denial of service. SQL injection is not typically a direct result of XXE.

Answer

Execute SQL injection

Answer

Bypass authentication

Question 13

A penetration tester is using Metasploit to exploit a remote Windows service. After a successful exploit, the tester gets a meterpreter session. Which TWO commands can the tester use to gather system information and credentials?

Accepted Answer

hashdump. getuid and hashdump are meterpreter commands for user info and credential dumping. sysinfo also works but getuid is more specific to user. The question asks for TWO, so getuid and hashdump are correct.

Answer

shell

Answer

upload

Answer

sysinfo

Question 14

A penetration tester is performing post-exploitation on a compromised Linux server and wants to maintain persistence. Which TWO of the following methods are commonly used for Linux persistence?

Accepted Answer

Adding SSH authorized_keys. Cron jobs and SSH authorized_keys are common persistence techniques. Scheduled tasks are Windows-specific, registry is Windows, WMI is Windows.

Answer

Modifying registry Run keys

Answer

Creating scheduled tasks

Answer

Creating WMI subscriptions

Question 15

During a penetration test, the tester discovers a web application vulnerable to CSRF. The application uses SameSite cookies set to 'Lax'. Which THREE methods might the tester use to exploit the CSRF vulnerability?

Accepted Answer

Use XSS to execute a POST request. SameSite Lax still allows top-level GET requests; state-changing GET requests, XSS, and bypassing via subdomain can work. Changing cookie to Strict is not possible by attacker, and requiring POST only is not a bypass.

Answer

Change the cookie's SameSite attribute via JavaScript

Answer

Force the form to submit via POST only