PT0-002 Attacks and Exploits Practice Test 12 — 15 Questions

Question 1

You have compromised a low-privileged Windows user and want to move laterally to a domain controller. Which THREE techniques could be used for lateral movement if you have valid credentials? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WMIExec. WMIExec (A) is correct because it leverages valid credentials to execute commands remotely over DCOM/WMI (typically via TCP 135 and dynamic RPC ports), enabling lateral movement to a domain controller without needing an interactive logon. Pass-the-Hash with CrackMapExec (C) is correct because it uses captured NTLM hashes with valid credentials to authenticate via SMB (and other protocols), allowing remote command execution and lateral movement across the domain. PsExec (E) is correct because it authenticates with valid credentials over SMB, copies a service binary to ADMIN$, and creates a remote service to execute commands on the target domain controller. Token impersonation with PrintSpoofer (B) is not a lateral movement technique with valid credentials; it is a local privilege escalation method that abuses the SeImpersonate privilege to gain SYSTEM on the already-compromised host. AS-REP roasting (D) is not lateral movement; it is a credential access technique that requests AS-REP messages for accounts without Kerberos pre-authentication to crack their passwords offline.

Answer

Token impersonation with PrintSpoofer

Answer

AS-REP roasting

Question 2

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR responses. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

John the Ripper

Answer

Bettercap

Answer

Hashcat

Question 3

A penetration tester wants to perform a pass-the-hash attack against a Windows target. Which tools can be used to authenticate using an NTLM hash without knowing the plaintext password? (Choose the best option.)

Accepted Answer

CrackMapExec. CrackMapExec is a popular tool for pass-the-hash attacks across many Windows services.

Answer

Nmap

Answer

Responder

Answer

Wireshark

Question 4

During a web application test, a tester discovers a parameter that appears to be vulnerable to SQL injection. They want to extract data from a database using a technique that does not rely on visible output. Which type of SQL injection is most appropriate?

Accepted Answer

Blind time-based SQL injection. Blind SQL injection, specifically time-based, is used when no error or data is returned, allowing inference via time delays.

Answer

UNION-based SQL injection

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Question 5

A penetration tester identifies a Linux binary with the SUID bit set. Which command can find all SUID binaries on a Linux system?

Accepted Answer

find / -perm /4000. The find command with -perm /4000 lists files with SUID set.

Answer

ps aux

Answer

ls -la

Answer

chmod u+s

Question 6

While exploiting a Windows machine, a tester gains a shell with limited privileges. They attempt to escalate privileges using a tool that exploits the SeImpersonatePrivilege. Which tool is specifically designed for this purpose on modern Windows versions?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege on Windows 10/Server 2016+ to gain SYSTEM.

Answer

Mimikatz

Answer

JuicyPotato

Answer

PowerUp

Question 7

A penetration tester needs to perform Kerberoasting against an Active Directory domain. Which step is required after requesting TGS tickets?

Accepted Answer

Crack the TGS hashes offline. After requesting TGS tickets for service accounts, the tester must crack the hashes offline using a tool like Hashcat.

Answer

Perform SMB relay

Answer

Request TGT ticket

Answer

Extract NTLM hashes from LSASS

Question 8

During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. 169.254.169.254 is the link-local IPv4 address used by AWS EC2 Instance Metadata Service (IMDS), and it is also used by Azure, GCP, and OpenStack for their metadata services. An SSRF vulnerability that can reach this address can retrieve IAM credentials from the instance role, making it a critical finding in cloud-hosted web app tests.

Answer

10.0.0.1

Answer

127.0.0.1

Answer

192.168.1.1

Question 9

A tester is using Hashcat to crack NTLM hashes. They want to try all possible passwords consisting of exactly 8 lowercase letters. Which attack mode and mask should they use?

Accepted Answer

-a 3 -m 1000 ?l?l?l?l?l?l?l?l. Brute-force mode (-a 3) with mask ?l?l?l?l?l?l?l?l tries all 8-letter lowercase combinations.

Answer

-a 6 -m 1000 ?l?l?l?l?l?l?l?l

Answer

-a 3 -m 0 ?l?l?l?l?l?l?l?l

Answer

-a 0 -m 1000 dictionary.txt

Question 10

A penetration tester is performing a web application assessment. Which of the following are common techniques to identify and exploit IDOR vulnerabilities? (Select TWO.)

Accepted Answer

Enumerate sequential IDs in URLs. IDOR involves manipulating object references; enumeration of IDs and modifying parameter values are common techniques.

Answer

Perform a man-in-the-middle attack

Answer

Use SQL injection to bypass authentication

Answer

Inject malicious scripts into input fields

Question 11

During a Linux privilege escalation attempt, a tester checks for misconfigurations that could allow running commands as root. Which of the following are potential vectors? (Select THREE.)

Accepted Answer

Sudo misconfigurations. SUID/SGID binaries, sudo misconfigurations, and writable cron scripts are common escalation vectors.

Answer

Unquoted service paths

Answer

DLL hijacking

Question 12

During a penetration test, a tester uses Responder to capture NTLM hashes from a Windows network. Which of the following protocols is MOST commonly targeted by Responder for poisoning?

Accepted Answer

LLMNR. Responder poisons LLMNR, NBT-NS, and mDNS to capture NTLM hashes. The other options are not primary targets.

Answer

DNS

Answer

ICMP

Answer

HTTP

Question 13

A penetration tester gains a low-privilege shell on a Linux server. Using 'sudo -l', the tester finds that they can run '/usr/bin/vi' as root without a password. Which technique would the tester MOST likely use to escalate privileges?

Accepted Answer

Use vi to execute a shell as root. GTFOBins lists vi as having a sudo escape, allowing privilege escalation by spawning a root shell. Other options are not directly applicable.

Answer

Exploit a kernel vulnerability

Answer

Modify a cron script

Answer

Perform PATH hijacking

Question 14

During a web application test, a tester discovers a JWT token with the following header: {'alg':'HS256','typ':'JWT'}. The token payload contains 'admin':false. The tester attempts to change the algorithm to 'none' and removes the signature. Which vulnerability is being exploited?

Accepted Answer

JWT algorithm confusion (alg:none). JWT alg:none attack exploits servers that accept unsigned tokens. Other options are different attack types.

Answer

JWT brute-force

Answer

JWT kid injection

Answer

JWT injection

Question 15

A penetration tester uses Hashcat to crack NTLM hashes captured during a pass-the-hash attack. Which Hashcat mode should the tester use for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is for NTLM hashes. Other modes correspond to different hash types.

Answer

-m 0

Answer

-m 13100

Answer

-m 22000