PT0-002 Attacks and Exploits Practice Test 12 — 15 Questions

Question 1

A penetration tester is using Hashcat to crack password hashes. Which TWO attack modes are commonly used?

Accepted Answer

Brute-force attack (-a 3). Dictionary attack (-a 0) and brute-force (-a 3) are standard modes. Hybrid (-a 6) is also common, but only TWO are asked. The question asks for two, so dictionary and brute-force are correct.

Answer

Rule-based attack (-a 0 with rules)

Answer

Mask attack (-a 6)

Answer

Rainbow table attack

Question 2

During a Windows privilege escalation attempt, the tester finds that the current user has SeImpersonatePrivilege enabled. Which THREE tools or techniques can be used to exploit this privilege?

Accepted Answer

JuicyPotato. PrintSpoofer, RoguePotato, and JuicyPotato exploit SeImpersonatePrivilege to gain SYSTEM. Mimikatz is for credential dumping, and PowerUp is a PowerShell script for privilege escalation but not specific to this privilege.

Answer

Mimikatz

Answer

PowerUp

Question 3

During a penetration test, the tester gains access to a domain-joined Windows machine and wants to perform Kerberoasting. Which THREE conditions are necessary for a successful Kerberoasting attack?

Accepted Answer

Ability to request TGS-REP tickets. The user must have domain credentials, there must be service accounts with SPNs, and the attacker must be able to request TGS tickets. Plaintext passwords are not required, and local admin is not needed.

Answer

Local administrator privileges on the target

Answer

Plaintext password of the service account

Question 4

A penetration tester is using Metasploit to pivot from a compromised host to an internal network. Which THREE Metasploit features can facilitate pivoting?

Accepted Answer

Metasploit route command. The 'route' command adds routes through a session, and Metasploit's socks proxy (auxiliary/server/socks4a) can be used. Autoroute is a post module. Exploit/multi/handler is for reverse shells, not directly for pivoting. Port forwarding via SSH is external to Metasploit.

Answer

Exploit/multi/handler

Answer

SSH local port forwarding

Question 5

A penetration tester has gained initial access to an internal Windows server and wants to escalate privileges to SYSTEM. The tester identified that the current user has the SeImpersonatePrivilege enabled. Which TWO of the following tools or techniques would be most appropriate to exploit this privilege for privilege escalation?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows impersonating a user after obtaining a token. Potato attacks (e.g., RottenPotato, JuicyPotato) and PrintSpoofer exploit this to escalate to SYSTEM, making options A and B correct. PsExec and Pass-the-Hash are lateral movement tools, not privilege escalation. Kerberoasting obtains service account hashes but does not directly exploit SeImpersonatePrivilege.

Answer

PsExec

Answer

Pass-the-Hash

Answer

Kerberoasting

Question 6

During a Windows privilege escalation attempt, the tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool is commonly used to exploit this privilege to gain SYSTEM?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to impersonate SYSTEM and spawn a shell.

Answer

SharpUp

Answer

Mimikatz

Answer

PowerUp

Question 7

In a web application test, you find a parameter that directly references internal object IDs (e.g., user_id=123) and changing the ID allows access to another user's data. This vulnerability is known as:

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references without proper access control checks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 8

During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?

Accepted Answer

Chisel. SSH dynamic port forwarding (-D), chisel, and ligolo-ng are all tools for creating SOCKS proxies or tunnels for pivoting.

Answer

Netcat

Answer

Nmap

Question 9

A penetration tester wants to perform a pass-the-hash attack against a Windows system. Which tool can be used to authenticate using the NTLM hash instead of a password?

Accepted Answer

CrackMapExec. CrackMapExec supports pass-the-hash authentication with NTLM hashes.

Answer

Responder

Answer

Hashcat

Answer

John the Ripper

Question 10

During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to escalate to SYSTEM.

Answer

PowerUp

Answer

CrackMapExec

Answer

Mimikatz

Question 11

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

Accepted Answer

Blind time-based SQL injection. UNION-based and blind time-based are common SQL injection techniques for data extraction.

Answer

Command injection

Answer

XXE injection

Answer

Reflected XSS

Question 12

A tester is performing an SQL injection attack on a login form. The tester inputs a single quote (') and receives a database error. The application returns different responses for true and false conditions. Which type of SQL injection is most likely occurring?

Accepted Answer

Blind SQL injection. Blind SQL injection occurs when no error messages are shown, but the application behaves differently based on true/false conditions. Error-based injection shows database errors. UNION-based requires visible output. Time-based uses delays.

Answer

Time-based SQL injection

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 13

During a web application test, you find a feature that allows users to export data as PDF. The PDF generation uses user input without sanitization. You inject an XML external entity that reads /etc/passwd and the content appears in the PDF. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE). XXE (XML External Entity) allows reading files via XML entities when the parser is vulnerable.

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 14

During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. AWS metadata is accessible at 169.254.169.254, a link-local address.

Answer

10.0.0.1

Answer

127.0.0.1

Answer

192.168.1.1

Question 15

A penetration tester uses Hashcat to crack NTLM hashes captured during a pass-the-hash attack. Which Hashcat mode should the tester use for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is for NTLM hashes. Other modes correspond to different hash types.

Answer

-m 0

Answer

-m 13100

Answer

-m 22000