PT0-002 Attacks and Exploits Practice Test 13 — 15 Questions

Question 1

A penetration tester is conducting a web application test and finds a parameter that is vulnerable to XXE. Which THREE of the following actions can the tester perform using XXE?

Accepted Answer

Cause a denial of service. XXE can read files, perform SSRF, and cause denial of service. SQL injection is not typically a direct result of XXE.

Answer

Execute SQL injection

Answer

Bypass authentication

Question 2

A penetration tester is performing post-exploitation on a compromised Linux server and wants to maintain persistence. Which TWO of the following methods are commonly used for Linux persistence?

Accepted Answer

Adding SSH authorized_keys. Cron jobs and SSH authorized_keys are common persistence techniques. Scheduled tasks are Windows-specific, registry is Windows, WMI is Windows.

Answer

Modifying registry Run keys

Answer

Creating scheduled tasks

Answer

Creating WMI subscriptions

Question 3

During a Windows privilege escalation attempt, the tester finds that the current user has SeImpersonatePrivilege enabled. Which THREE tools or techniques can be used to exploit this privilege?

Accepted Answer

JuicyPotato. PrintSpoofer, RoguePotato, and JuicyPotato exploit SeImpersonatePrivilege to gain SYSTEM. Mimikatz is for credential dumping, and PowerUp is a PowerShell script for privilege escalation but not specific to this privilege.

Answer

Mimikatz

Answer

PowerUp

Question 4

A penetration tester is performing a web application test and identifies a potential SQL injection vulnerability. Which TWO methods can the tester use to confirm the vulnerability and extract data?

Accepted Answer

Blind time-based SQL injection. UNION-based and blind time-based are classic SQL injection techniques. XSS and command injection are different attacks. XXE is also different.

Answer

XXE injection

Answer

Command injection

Answer

XSS injection

Question 5

During a penetration test, the tester gains access to a domain-joined Windows machine and wants to perform Kerberoasting. Which THREE conditions are necessary for a successful Kerberoasting attack?

Accepted Answer

Ability to request TGS-REP tickets. The user must have domain credentials, there must be service accounts with SPNs, and the attacker must be able to request TGS tickets. Plaintext passwords are not required, and local admin is not needed.

Answer

Local administrator privileges on the target

Answer

Plaintext password of the service account

Question 6

A penetration tester is using Metasploit to pivot from a compromised host to an internal network. Which THREE Metasploit features can facilitate pivoting?

Accepted Answer

Metasploit route command. The 'route' command adds routes through a session, and Metasploit's socks proxy (auxiliary/server/socks4a) can be used. Autoroute is a post module. Exploit/multi/handler is for reverse shells, not directly for pivoting. Port forwarding via SSH is external to Metasploit.

Answer

Exploit/multi/handler

Answer

SSH local port forwarding

Question 7

A penetration tester has gained initial access to an internal Windows server and wants to escalate privileges to SYSTEM. The tester identified that the current user has the SeImpersonatePrivilege enabled. Which TWO of the following tools or techniques would be most appropriate to exploit this privilege for privilege escalation?

Accepted Answer

PrintSpoofer. Option A, PrintSpoofer, is correct because it abuses the SeImpersonatePrivilege by coercing the Print Spooler service into authenticating to a controlled named pipe, then impersonating the resulting SYSTEM token to gain elevated privileges. Option B, Potato attacks such as JuicyPotato, is correct because these techniques also leverage SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege) by tricking a privileged service into connecting to an attacker-controlled COM server or named pipe, allowing token impersonation to SYSTEM. Option C, PsExec, is not appropriate here because it is a remote execution/lateral movement tool that requires administrative credentials or SMB access, not a local SeImpersonatePrivilege escalation technique. Option D, Pass-the-Hash, is incorrect because it uses captured NTLM hashes for authentication to other systems and does not exploit SeImpersonatePrivilege. Option E, Kerberoasting, is incorrect because it targets service accounts with SPNs to crack their passwords offline and is unrelated to token impersonation privilege escalation.

Answer

PsExec

Answer

Pass-the-Hash

Answer

Kerberoasting

Question 8

During an internal assessment, a penetration tester captures Kerberos traffic and identifies a service account whose SPN is registered but whose password was set years ago and never rotated. The tester wants to request a service ticket offline and crack it to recover the plaintext password. Which technique is the tester performing?

Accepted Answer

Kerberoasting, by requesting a TGS for the SPN and cracking the RC4-HMAC encrypted portion offline. Kerberoasting exploits the fact that any authenticated user may request a service ticket for a registered SPN, and the returned TGS is encrypted with the service account's key. Extracting and cracking that encrypted blob offline yields the plaintext password. The long-lived, unrotated password in the scenario is the classic enabling condition, making this the correct identification.

Answer

AS-REP roasting, by sending an AS-REQ without pre-authentication for a targeted account

Answer

Golden Ticket creation, by forging a TGT with the KRBTGT account hash

Answer

Pass-the-ticket, by injecting a stolen TGS into the current session for lateral movement

Question 9

A penetration tester is assessing a web application that uses a GraphQL endpoint. The tester wants to extract sensitive data by abusing the introspection system. Which of the following actions should the tester perform first?

Accepted Answer

Send a POST request with a query that includes __schema to retrieve the full schema. GraphQL introspection allows clients to query the __schema field to obtain the complete API schema. This is the fastest way to discover all available queries, mutations, and types, which can then be analyzed for sensitive data exposure. The other options are either different attack types or less efficient methods.

Answer

Use a CSRF attack to force an authenticated user to execute a GraphQL mutation

Answer

Brute-force the GraphQL endpoint with common query names to discover hidden fields

Answer

Perform a blind SQL injection on the GraphQL endpoint to dump the database

Question 10

A penetration tester obtains a low-privilege shell on a Linux host during an engagement. While enumerating, the tester finds a cron job that runs a script located in a world-writable directory as root every five minutes. Which action should the tester take to escalate privileges using this finding?

Accepted Answer

Modify the script in the world-writable directory to execute a reverse shell when the cron job runs. The exploitable condition is a scheduled task running as root that executes a file the low-privilege user can write. Overwriting that script causes the cron daemon to run attacker-controlled code with root privileges on the next interval. This directly converts the enumerated misconfiguration into elevated access, which is the intended outcome.

Answer

Search for SUID binaries and abuse one that permits arbitrary file reads

Answer

Run 'sudo -l' to list permitted commands and find a binary that can be abused for escalation

Answer

Read /etc/crontab to confirm the schedule and then wait for the job to run unmodified

Question 11

A penetration tester is conducting an internal network assessment and has captured authentication traffic between a client and a file server. The tester observes that the client is using NTLMv1 authentication and wants to relay the captured response to another server to gain access. Which of the following conditions is MOST critical for a successful NTLM relay attack?

Accepted Answer

SMB signing must be disabled on the target server. For an NTLM relay to SMB to succeed, the target server must not require SMB signing. Signing ensures message integrity, and without the session key the attacker cannot sign relayed messages. If signing is disabled, the attacker can forward the NTLM authentication messages from the client to the target and authenticate as the client. Other factors like hash crackability or account privileges are not prerequisites.

Answer

The client must be a member of the Domain Admins group

Answer

The captured hash must be crackable to plaintext within a reasonable time

Answer

The target server must be running Windows Server 2019 or later

Question 12

A penetration tester is asked to assess whether an organization's employees can be tricked into revealing credentials. The client approves an assessment in which the tester registers a look-alike domain and sends emails directing staff to a fake login page. Which type of assessment is the tester conducting?

Accepted Answer

A phishing simulation targeting credential harvesting. The engagement uses a spoofed domain and a counterfeit login page delivered through email to induce employees to surrender credentials. That combination of social engineering and credential capture defines a phishing simulation. Its purpose is to quantify human risk and test the effectiveness of awareness training and email controls, which aligns exactly with the client's approved objective.

Answer

A wireless assessment targeting rogue access points

Answer

A vulnerability scan of the external attack surface

Answer

A physical intrusion test using tailgating techniques

Question 13

A penetration tester has compromised a Linux web server and wants to maintain persistent access by creating a new user account with a known password. The tester has root privileges. Which of the following commands will create a new user named 'support' with a home directory and a bash shell?

Accepted Answer

useradd -m -s /bin/bash support. The useradd command with -m and -s creates a new user with a home directory and specified shell. This is the standard low-level utility available on most Linux distributions. After creating the account, the tester would set a password using passwd. The other commands either modify existing users, use non-standard syntax, or are for password management only, making them unsuitable for creating a new persistent account.

Answer

passwd support --create --home /home/support --shell /bin/bash

Answer

adduser support --shell /bin/bash --home /home/support

Answer

usermod -aG support -d /home/support -s /bin/bash

Question 14

A penetration tester has gained a foothold on a Windows host and wants to escalate privileges by abusing a misconfigured Windows service. Which TWO conditions would allow the tester to escalate privileges by replacing a service binary? (Choose two.)

Accepted Answer

The service's executable path points to a directory where the tester has write permissions. Binary-replacement escalation requires the tester to influence which executable the service runs. That happens either when the service binary sits in a directory the tester can write to, or when an unquoted path with spaces lets Windows resolve a planted file from a writable earlier directory. Both conditions let attacker code execute in the service's privileged context, while the other options concern unrelated permissions or start settings.

Answer

The service is configured with a delayed automatic start type on a domain-joined host

Answer

The service runs under the NetworkService account with SeShutdownPrivilege enabled

Answer

The service's DACL grants the tester SERVICE_STOP and SERVICE_START but not SERVICE_CHANGE_CONFIG

Question 15

A penetration tester is conducting a wireless assessment and has captured a WPA2 handshake. The tester wants to crack the pre-shared key (PSK) offline. Which of the following tools is specifically designed to perform this task?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for offline cracking of WPA/WPA2 PSK handshakes. It takes a capture file containing the four-way handshake and a wordlist, computes the PMK for each candidate password, and compares it to the captured handshake to find the correct PSK. Kismet is for detection, Wifite is an automation wrapper, and Reaver targets WPS, so aircrack-ng is the correct choice.

Answer

Reaver

Answer

Wifite

Answer

Kismet