PT0-002 Attacks and Exploits Practice Test 3 — 15 Questions

Question 1

During a penetration test, you capture NTLM hashes by poisoning LLMNR requests. Which tool would you use to exploit this and obtain the hashes?

Accepted Answer

Responder. Responder is the primary tool used for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes from network authentication attempts.

Answer

CrackMapExec

Answer

ntlmrelayx

Answer

Metasploit

Question 2

After compromising a Linux host, you want to escalate privileges by exploiting a cron job that runs a script with root privileges. The script references an executable using a relative path. Which attack technique is most appropriate?

Accepted Answer

PATH manipulation. PATH manipulation works by modifying the PATH environment variable so that when the script calls the executable (by name only, no full path), the attacker's malicious version runs with the privileges of the script.

Answer

SUID binary exploitation

Answer

Kernel exploit

Answer

DLL hijacking

Question 3

During an internal penetration test, you need to perform lateral movement to a Windows target. You have a plaintext password for a domain user account. Which tool would be most appropriate to authenticate to the target using WMI?

Accepted Answer

wmiexec. wmiexec (part of Impacket) allows execution of commands on a Windows host via WMI using valid credentials, suitable for lateral movement.

Answer

CrackMapExec

Answer

evil-winrm

Answer

psexec

Question 4

You have obtained a NTLM hash of a domain admin account and want to authenticate to a remote server without cracking the password. Which technique enables you to authenticate using the hash?

Accepted Answer

Pass-the-Hash. Pass-the-hash uses the NTLM hash directly to authenticate without needing the plaintext password. Tools like pth-winexe or CrackMapExec can perform this.

Answer

AS-REP roasting

Answer

Pass-the-Ticket

Answer

Kerberoasting

Question 5

A penetration tester is exploiting a SQL injection vulnerability in a web application. They want to extract data from the database without displaying it on the page. Which SQL injection technique should they use?

Accepted Answer

Blind time-based SQL injection. Blind SQL injection techniques like time-based or boolean-based are used when data is not returned directly in the response. Time-based uses delays to infer information.

Answer

Stacked queries

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 6

During a web application test, you discover a parameter that reflects user input in the response without proper encoding. You craft a payload that executes JavaScript in the victim's browser. This vulnerability is best classified as:

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately reflected back in the response without proper sanitization, allowing script execution.

Answer

Stored XSS

Answer

Server-side request forgery (SSRF)

Answer

DOM-based XSS

Question 7

You are attacking a web application and notice that it makes requests to internal services. You attempt to access the cloud metadata endpoint at http://169.254.169.254/. Which vulnerability are you most likely exploiting?

Accepted Answer

SSRF (Server-Side Request Forgery). SSRF (Server-Side Request Forgery) allows an attacker to make requests from the server to internal resources, including cloud metadata endpoints.

Answer

XXE (XML External Entity)

Answer

Command injection

Answer

CSRF (Cross-Site Request Forgery)

Question 8

After gaining initial access to a Windows host, you want to escalate privileges by exploiting a service that runs as SYSTEM but has an unquoted service path. What is the attack vector?

Accepted Answer

Unquoted service path. Unquoted service path vulnerability allows an attacker to place an executable in a path that the service will execute due to ambiguous path parsing.

Answer

Token impersonation

Answer

AlwaysInstallElevated

Answer

DLL hijacking

Question 9

Which Metasploit command is used to display information about the current meterpreter session, including the target OS and user?

Accepted Answer

sysinfo. The 'sysinfo' meterpreter command displays system information such as OS, architecture, and sometimes user context.

Answer

hashdump

Answer

getuid

Answer

getsystem

Question 10

A penetration tester needs to crack a large number of NTLM hashes. They have a wordlist and want to apply common password mutations. Which hashcat option enables the use of a rule file to mutate words?

Accepted Answer

-r. Hashcat's -r option specifies a rule file that defines transformations (mutation) on dictionary words.

Answer

-a 0

Answer

-a 6

Answer

-m 1000

Question 11

During a penetration test of a web application, you want to test for Cross-Site Request Forgery (CSRF) vulnerabilities. Which TWO conditions are necessary for a CSRF attack to succeed?

Accepted Answer

The request performs a state-changing action (e.g., password change). CSRF requires the application to rely solely on cookies for authentication and lack anti-CSRF tokens, and the requests must trigger state changes.

Answer

The application validates the Referer header

Answer

The application uses SameSite cookies set to Lax or Strict

Answer

The application uses anti-CSRF tokens in forms

Question 12

You have gained a foothold on a Linux server and identified a SUID binary that can be exploited to read arbitrary files. Which THREE techniques could be used to escalate privileges or gather sensitive information?

Accepted Answer

Leveraging the binary's ability to write to arbitrary files (if present). SUID binaries with file read capabilities can be used to read sensitive files, and when combined with other techniques like PATH manipulation or exploiting the binary's functionality, can lead to privilege escalation.

Answer

Performing a DLL hijacking attack

Answer

Exploiting a kernel vulnerability

Question 13

A penetration tester wants to pivot from a compromised Linux host to attack internal network resources that are not directly accessible. Which THREE tools or techniques can be used for pivoting?

Accepted Answer

Metasploit route command. SSH port forwarding (local, remote, dynamic) and tools like chisel and ligolo-ng are commonly used for pivoting in Linux environments.

Answer

psexec

Answer

Windows Remote Desktop (RDP)

Question 14

During a penetration test, a tester captures NTLM hashes by spoofing LLMNR responses on the internal network. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

ntlmrelayx

Answer

Hashcat

Answer

Bettercap

Question 15

A penetration tester wants to perform a pass-the-hash attack on a Windows target. Which tools can be used for this purpose? (Choose the best answer.)

Accepted Answer

pth-winexe. pth-winexe is a common tool for pass-the-hash attacks on Windows.

Answer

sqlmap

Answer

John the Ripper

Answer

Hashcat