PT0-002 Attacks and Exploits Practice Test 2 — 15 Questions

Question 1

During a penetration test, the tester discovers a Linux binary with the SUID bit set owned by root. The binary is a custom script that executes 'cp' to copy files. The tester can control the source file path via an environment variable. Which privilege escalation technique should the tester attempt?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PATH manipulation. PATH manipulation involves modifying the PATH environment variable to execute a malicious 'cp' binary instead of the legitimate one.

Answer

Writable script in cron

Answer

Kernel exploit

Answer

SUID binary exploitation using GTFOBins

Question 2

A penetration tester is performing a web application test and identifies an endpoint that is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions can the tester perform using this vulnerability? (Choose TWO.)

Accepted Answer

Access internal services running on localhost. SSRF can be used to access internal services and cloud metadata endpoints.

Answer

Perform SQL injection on the database

Answer

Upload files to the server

Answer

Read local files using file:// protocol

Question 3

During a Windows privilege escalation attempt, a penetration tester discovers that the always elevated installation policy is enabled. Which of the following actions can the tester take to exploit this misconfiguration? (Choose TWO.)

Accepted Answer

Use msiexec to silently install a crafted MSI. AlwaysInstallElevated allows any user to install .msi files with SYSTEM privileges. The tester can create a malicious MSI or use an existing one to execute commands.

Answer

Perform DLL hijacking on a system service

Answer

Exploit a kernel vulnerability

Answer

Modify the registry key to disable the policy

Question 4

While testing a Linux system, the tester finds a binary with the SUID bit set owned by root. The binary executes a command based on user input without verifying the path. Which privilege escalation technique does this exemplify?

Accepted Answer

SUID binary exploitation. PATH manipulation exploits insecure binary execution by modifying the PATH variable to execute malicious code.

Answer

Kernel exploit

Answer

Capability abuse

Answer

Cron job abuse

Question 5

A tester identifies a SQL injection vulnerability in a login form. The application responds with different error messages for valid and invalid queries. Which type of SQL injection is most likely present, and what tool could automate exploitation?

Accepted Answer

Blind SQLi; sqlmap. Blind boolean-based SQL injection infers data based on true/false responses; sqlmap automates exploitation.

Answer

UNION-based SQLi; sqlmap

Answer

Time-based blind SQLi; nmap

Answer

Error-based SQLi; Burp Suite

Question 6

A penetration tester gains a shell on a Linux server and needs to pivot to an internal network. The tester's attack machine can reach the compromised server but not the internal network. Which tool can create a SOCKS proxy on the compromised server?

Accepted Answer

Chisel. Chisel can create a SOCKS proxy over SSH or TCP tunneling.

Answer

SSH -L

Answer

Meterpreter

Answer

Netcat

Question 7

A web application uses JSON Web Tokens (JWT) for authentication. The tester intercepts a token and decodes it to find the header contains "alg":"none". What vulnerability does this indicate, and how can it be exploited?

Accepted Answer

None algorithm; craft a token with empty signature. The "alg":"none" vulnerability allows arbitrary token creation without verification.

Answer

Kid injection; inject a malicious key ID

Answer

Weak secret; brute-force the secret

Answer

Algorithm confusion; change alg to HS256

Question 8

During a Windows privilege escalation attempt, the tester finds that the AlwaysInstallElevated registry key is set to 1. Which TWO actions can the tester perform to escalate privileges?

Accepted Answer

Use PowerUp to generate a malicious MSI. AlwaysInstallElevated allows any user to install MSI files with SYSTEM privileges.

Answer

Modify the PATH environment variable

Answer

Request a TGS ticket for Kerberoasting

Answer

Create a new service with sc.exe

Question 9

During a post-exploitation phase, a tester has a foothold on a Linux server and wants to pivot to an internal web server that is not directly accessible. The tester has SSH access to the compromised server. Which command would create a local port forward to access the internal web server on port 80?

Accepted Answer

ssh -L 8080:internal_web:80 user@compromised_server. SSH -L forwards a local port to a remote destination.

Answer

ssh -L 8080:compromised_server:80 user@internal_web

Answer

ssh -D 8080 user@compromised_server

Answer

ssh -R 8080:internal_web:80 user@compromised_server

Question 10

A penetration tester is performing a Kerberoasting attack. After requesting TGS tickets from a domain controller, which tool would be used to crack the tickets offline?

Accepted Answer

Hashcat. Hashcat with mode 13100 is used to crack Kerberos 5 TGS-REP etype 23 hashes.

Answer

John the Ripper

Answer

Metasploit

Answer

Responder

Question 11

A penetration tester has gained a foothold on a Linux server and wants to escalate privileges to root. Which THREE of the following are potential privilege escalation vectors? (Select THREE.)

Accepted Answer

Kernel exploits. SUID binaries, writable cron scripts, and kernel exploits are common Linux privilege escalation vectors.

Answer

AlwaysInstallElevated

Answer

Unquoted service paths

Question 12

A penetration tester is performing an internal assessment and wants to intercept network traffic to capture credentials. Which tool is specifically designed for ARP spoofing and can also perform SSL stripping?

Accepted Answer

Bettercap. Bettercap is a powerful tool that can perform ARP spoofing, SSL stripping, and other man-in-the-middle attacks. Responder is used for LLMNR/NBT-NS poisoning, not ARP spoofing.

Answer

Wireshark

Answer

Ettercap

Answer

Responder

Question 13

A penetration tester is performing an internal test and wants to move laterally from a compromised workstation to a domain controller. The tester has obtained NTLM hash for a domain admin. Which of the following tools would allow the tester to authenticate using the hash without cracking it?

Accepted Answer

pth-winexe. Pass-the-hash tools like pth-winexe or CrackMapExec allow authentication using the hash directly. PsExec requires explicit credentials or service installation, not pass-the-hash natively.

Answer

PsExec

Answer

Evil-WinRM

Answer

Responder

Question 14

A tester finds a Linux binary with the SUID bit set. The binary is owned by root and executes a shell command. The tester runs the binary and gets a root shell. Which command would the tester likely have used to discover this SUID binary?

Accepted Answer

find / -type f -perm /4000. The command 'find / -perm /4000' finds files with SUID bit set. The /4000 syntax searches for exactly SUID. Using -u=s is incorrect.

Answer

find / -perm -u=s

Answer

which suid

Answer

ls -laR / | grep SUID

Question 15

A tester is performing an SQL injection attack on a login form. The tester inputs a single quote (') and receives a database error. The application returns different responses for true and false conditions. Which type of SQL injection is most likely occurring?

Accepted Answer

Blind SQL injection. Blind SQL injection occurs when no error messages are shown, but the application behaves differently based on true/false conditions. Error-based injection shows database errors. UNION-based requires visible output. Time-based uses delays.

Answer

Time-based SQL injection

Answer

UNION-based SQL injection

Answer

Error-based SQL injection