PT0-002 Attacks and Exploits Practice Test 4 — 15 Questions

Question 1

A penetration tester has captured a single WPA2-PSK handshake from a target wireless network and now wants to recover the pre-shared key. The tester has a wordlist and a compatible GPU available. Which tool and mode should the tester use to perform the offline attack against the captured handshake?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aircrack-ng with the -w wordlist option against the captured .cap file. Recovering a WPA2-PSK from a captured handshake is an offline dictionary attack: for each candidate passphrase the tool derives the PMK, computes the PTK, and compares the MIC against the captured EAPOL frames. aircrack-ng natively ingests the .cap file with the -w wordlist flag and performs exactly this comparison, so it directly satisfies the objective without any format conversion.

Answer

aireplay-ng with the --deauth option against the target access point

Answer

airodump-ng with the --bssid filter and --write option

Answer

hashcat with mode 22000 against the captured handshake file

Question 2

A penetration tester has obtained a low-privilege shell on a Windows 10 workstation and wants to escalate privileges by exploiting a vulnerable driver. The tester plans to use a Bring Your Own Vulnerable Driver (BYOVD) attack. Which TWO of the following steps are required to successfully execute this attack? (Choose two.)

Accepted Answer

Load a signed but vulnerable driver that exposes a kernel-level primitive. A successful BYOVD attack requires loading a signed vulnerable driver to gain kernel-level execution and ensuring the current user has the SeLoadDriverPrivilege to load that driver. Without both, the attack cannot proceed, making those the essential steps.

Answer

Use a reflective DLL injection to load the driver into user space

Answer

Disable Windows Defender Application Control (WDAC) via Group Policy

Answer

Exploit a known vulnerability in the Windows kernel itself, such as CVE-2021-1732

Question 3

A penetration tester has obtained a low-privilege shell on a Windows 10 workstation and observes that the user is a local administrator. The tester wants to escalate to SYSTEM by abusing the automatic elevation of a built-in Windows binary that is digitally signed by Microsoft and runs with high integrity. Which of the following techniques BEST accomplishes this?

Accepted Answer

UAC bypass using the auto-elevating binary sdclt.exe with a crafted registry key. The sdclt.exe UAC bypass exploits a built-in, Microsoft-signed binary that auto-elevates. By hijacking the App Paths registry key for control.exe, the tester causes sdclt.exe to launch an arbitrary payload with high integrity, effectively escalating from a local administrator to a high-integrity process often running as SYSTEM. This technique is reliable on Windows 10 and does not require a reboot or service restart.

Answer

Token impersonation using the SeImpersonatePrivilege and a named pipe

Answer

DLL search order hijacking of a service executable running as SYSTEM

Answer

Kerberoasting to obtain a service account hash and crack it offline

Question 4

A penetration tester is performing a web application assessment and discovers that the application uses a JSON Web Token (JWT) for session management. The tester captures a token and notices that the signature is not being verified properly. The tester wants to exploit this to forge a token with elevated privileges. Which TWO of the following techniques could the tester use to bypass the signature verification? (Choose two.)

Accepted Answer

Change the algorithm to 'none' and remove the signature. The 'none' algorithm attack and the RS256 to HS256 key confusion attack are both well-known JWT signature bypass techniques. The first exploits libraries that accept unsigned tokens, while the second exploits confusion between asymmetric and symmetric verification. Both allow forging arbitrary claims without knowing the secret key. The other options either require additional vulnerabilities or are not signature bypass methods.

Answer

Replay the token after modifying the 'kid' header to point to a known file

Answer

Use a brute-force attack to crack the HMAC secret if the algorithm is HS256

Answer

Inject a null byte into the signature to cause a parsing error that skips verification

Question 5

A penetration tester is conducting an internal network assessment and wants to capture NTLMv2 hashes from Windows hosts without sending any authentication traffic. Which tool and attack technique should the tester use?

Accepted Answer

Responder with LLMNR/NBT-NS/mDNS poisoning. Responder poisons LLMNR/NBT-NS/mDNS to trick hosts into sending NTLM hashes to the attacker, capturing them without the attacker needing to authenticate.

Answer

Metasploit's hashdump module

Answer

Hashcat with a wordlist attack

Answer

Bettercap with ARP spoofing

Question 6

During a web application test, the tester discovers a parameter that reflects user input in the response without sanitization. Which type of vulnerability is most likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately reflected in the response without proper encoding or sanitization.

Answer

DOM-based XSS

Answer

Stored XSS

Answer

SQL injection

Question 7

A tester wants to exploit a Windows service running with SYSTEM privileges that has an unquoted service path containing spaces. Which technique should be used to escalate privileges?

Accepted Answer

Unquoted service path exploitation. An unquoted service path allows placing an executable with the same name as a folder in the path, which Windows will execute with SYSTEM privileges.

Answer

AlwaysInstallElevated

Answer

Token impersonation

Answer

DLL hijacking

Question 8

A penetration tester is performing a password attack on a Windows domain and has captured NTLM hashes. Which tool can be used to perform a pass-the-hash attack to gain remote code execution on a target system?

Accepted Answer

pth-winexe. pth-winexe is a tool specifically designed for pass-the-hash attacks to execute commands on remote Windows systems.

Answer

Hashcat

Answer

Responder

Answer

John the Ripper

Question 9

During a web application test, the tester uses sqlmap and identifies a time-based blind SQL injection. Which technique is sqlmap using to extract data?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection uses conditional delays to infer the truth of queries based on response time.

Answer

Error-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

UNION-based SQL injection

Question 10

A penetration tester needs to escalate privileges on a Linux system and finds that the current user can run a specific command with sudo without a password. Which tool should the tester consult to find known exploitation techniques for that command?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions.

Answer

Exploit-DB

Answer

HackTricks

Answer

Metasploit

Question 11

A penetration tester is attempting to exploit a server-side request forgery (SSRF) vulnerability in a cloud-hosted web application to access the cloud metadata service. Which IP address should the tester target?

Accepted Answer

169.254.169.254. The cloud metadata service for most cloud providers (AWS, GCP, Azure) is accessible via 169.254.169.254.

Answer

192.168.1.1

Answer

127.0.0.1

Answer

10.0.0.1

Question 12

A tester has gained a low-privilege shell on a Windows machine and found that the user has the SeImpersonatePrivilege enabled. Which attack can be used to escalate privileges to SYSTEM?

Accepted Answer

Token impersonation using PrintSpoofer. SeImpersonatePrivilege allows impersonating a client after authentication; tools like PrintSpoofer, RoguePotato exploit this to gain SYSTEM.

Answer

DLL hijacking

Answer

Kerberoasting

Answer

AlwaysInstallElevated

Question 13

A penetration tester wants to crack NTLM hashes obtained from a Windows domain. Which hashcat mode should the tester use?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 13100

Answer

-m 0

Question 14

During a penetration test, the tester discovers a JWT token that uses the 'alg:none' header. Which attack does this vulnerability enable?

Accepted Answer

Signature bypass using alg:none. JWT with 'alg:none' allows an attacker to forge tokens without any signature, bypassing verification.

Answer

Key confusion attack

Answer

Algorithm substitution attack

Answer

Timing attack

Question 15

A penetration tester has compromised a Linux host and wants to use it as a pivot point to access an internal network that is not directly reachable from the attacker's machine. Which tool can create a SOCKS proxy for routing traffic through the compromised host?

Accepted Answer

chisel. Chisel is a fast TCP/UDP tunnel over HTTP that can create a SOCKS proxy for pivoting.

Answer

Responder

Answer

nmap

Answer

netcat