PT0-002 Attacks and Exploits Practice Test 3 — 15 Questions

Question 1

You are performing a password attack on a Linux system. You have obtained the /etc/shadow file. Which password cracking tool would be most efficient for a rule-based attack using a wordlist?

Accepted Answer

Hashcat -a 0 -r rule.rule. Hashcat with rule files is highly efficient for rule-based attacks; John can also do it but Hashcat is GPU-accelerated and commonly preferred.

Answer

John the Ripper --rules

Answer

Hydra -l root -P wordlist

Answer

CrackMapExec --hash

Question 2

You are enumerating a Linux system for privilege escalation vectors. Which TWO conditions below could be exploited to escalate privileges? (Select TWO.)

Accepted Answer

SUID binary owned by root. Writable cron scripts and SUID binaries are common Linux privesc vectors.

Answer

Unquoted service path

Answer

User has SeImpersonatePrivilege

Answer

AlwaysInstallElevated registry key set to 1

Question 3

During a web application penetration test, you find that the application is vulnerable to CSRF. Which TWO factors could prevent exploitation even if a CSRF vulnerability exists? (Select TWO.)

Accepted Answer

SameSite cookie attribute set to Lax. SameSite Lax strict prevents cross-site requests; custom headers can be used to validate origin.

Answer

Application uses JSON content type

Answer

Presence of a CSRF token that is validated server-side

Answer

Application uses HTTPS

Question 4

A tester is performing a JWT attack and modifies the header to set the algorithm to 'none'. Which vulnerability are they exploiting?

Accepted Answer

Algorithm confusion. Setting alg to 'none' bypasses signature verification, a known JWT vulnerability.

Answer

Token theft

Answer

Weak secret brute-force

Answer

Kid injection

Question 5

After gaining initial access to a target, a tester wants to pivot to an internal network that is not directly accessible. Which technique can be used to forward traffic from the tester's machine through the compromised host to reach internal services?

Accepted Answer

SSH local port forwarding (-L). SSH local port forwarding (-L) allows the tester to access internal services via the compromised host.

Answer

SSH dynamic port forwarding (-D)

Answer

Netcat

Answer

SSH remote port forwarding (-R)

Question 6

A tester exploits an XXE vulnerability to read local files. Which of the following is a typical XXE payload to read /etc/passwd?

Accepted Answer

<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]>. XXE uses an external entity with file:// to read local files.

Answer

' OR 1=1--

Answer

<?php system('cat /etc/passwd'); ?>

Answer

Question 7

After compromising a host, a tester wants to maintain persistence on a Windows system by executing a payload each time a user logs in. Which registry key is commonly used for this?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run execute programs at user logon.

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Question 8

A penetration tester has gained a foothold in a Windows domain and wants to perform lateral movement. Which of the following tools or techniques can be used? (Select THREE.)

Accepted Answer

Evil-WinRM. PsExec, WinRM, and Evil-WinRM are common lateral movement tools in Windows environments.

Answer

Chisel

Answer

SSH

Question 9

A penetration tester has compromised a Windows machine and wants to perform lateral movement to another machine on the same network. The tester has obtained NTLM hashes, but not plaintext passwords. Which TWO tools can be used for pass-the-hash attacks?

Accepted Answer

CrackMapExec. pth-winexe and CrackMapExec support pass-the-hash by using NTLM hashes directly. PsExec and WinRM require plaintext credentials unless modified.

Answer

SSH

Answer

WinRM

Answer

PsExec

Question 10

During a Linux privilege escalation assessment, the tester finds that a binary with SUID root can execute arbitrary commands. Which TWO of the following methods are MOST likely to exploit this?

Accepted Answer

Use the binary to read /etc/shadow directly. GTFOBins provides SUID exploitation techniques; many SUID binaries allow command execution. The other options are not directly related to SUID exploitation.

Answer

Modify the binary's PATH environment variable

Answer

Exploit a kernel vulnerability

Answer

Replace the binary with a malicious one

Question 11

A penetration tester is using Metasploit to exploit a remote Windows service. After a successful exploit, the tester gets a meterpreter session. Which TWO commands can the tester use to gather system information and credentials?

Accepted Answer

hashdump. getuid and hashdump are meterpreter commands for user info and credential dumping. sysinfo also works but getuid is more specific to user. The question asks for TWO, so getuid and hashdump are correct.

Answer

shell

Answer

upload

Answer

sysinfo

Question 12

During a penetration test, the tester discovers a web application vulnerable to CSRF. The application uses SameSite cookies set to 'Lax'. Which THREE methods might the tester use to exploit the CSRF vulnerability?

Accepted Answer

Use XSS to execute a POST request. SameSite Lax still allows top-level GET requests; state-changing GET requests, XSS, and bypassing via subdomain can work. Changing cookie to Strict is not possible by attacker, and requiring POST only is not a bypass.

Answer

Change the cookie's SameSite attribute via JavaScript

Answer

Force the form to submit via POST only

Question 13

A penetration tester is using Hashcat to crack password hashes. Which TWO attack modes are commonly used?

Accepted Answer

Brute-force attack (-a 3). Dictionary attack (-a 0) and brute-force (-a 3) are standard modes. Hybrid (-a 6) is also common, but only TWO are asked. The question asks for two, so dictionary and brute-force are correct.

Answer

Rule-based attack (-a 0 with rules)

Answer

Mask attack (-a 6)

Answer

Rainbow table attack

Question 14

During an internal penetration test, a tester captures 802.11 management frames and observes that a WPA2-Enterprise network advertises several EAP methods. The tester wants to capture a client's MSCHAPv2 challenge/response without deploying a rogue AP or forcing a disconnect. Which technique should the tester use?

Accepted Answer

Capture the EAP exchange by setting the wireless adapter to monitor mode on the target channel. The EAP exchange in WPA2-Enterprise happens before encryption is established, so a monitor-mode capture on the AP's channel can record the MSCHAPv2 challenge and response passively. Because the tester cannot deploy a rogue AP or force a disconnect, capturing the EAP exchange directly is the only viable method that meets all constraints.

Answer

Configure a fake RADIUS server with hostapd-wpe to collect the MSCHAPv2 challenge/response

Answer

Use aireplay-ng to inject deauthentication frames and then capture the 4-way handshake for offline cracking

Answer

Perform an EAP relay attack using a tool such as eaphammer with --eap-relay

Question 15

A penetration tester gains access to a Linux host and discovers that the /etc/shadow file is world-readable due to a misconfiguration. The tester extracts several SHA-512 crypt hashes. Which tool or technique should the tester use to attempt to recover the plaintext passwords?

Accepted Answer

John the Ripper with the --format=sha512crypt option. Linux /etc/shadow hashes using SHA-512 crypt are best attacked offline with John the Ripper, which supports the sha512crypt format directly. Hashcat can also be used with mode 1800, but among the provided choices, John the Ripper with the correct format flag is the appropriate tool for recovering the plaintext passwords.

Answer

Hashcat with hash mode 1000

Answer

Responder with the --wredir option to capture hashes over the network

Answer

Rainbow tables generated for LM hashes