PT0-002 Attacks and Exploits Practice Test 5 — 15 Questions

Question 1

During a web application penetration test, the tester discovers a JWT token in the Authorization header. The token uses the 'none' algorithm. What attack should the tester attempt?

Accepted Answer

JWT algorithm confusion attack (alg:none). If the server accepts the 'none' algorithm, the tester can forge tokens by setting the algorithm to 'none' and removing the signature.

Answer

JWT timing attack

Answer

JWT kid injection

Answer

JWT brute-force of the secret

Question 2

A tester has exploited a Linux system and gained a low-privilege shell. The tester runs 'sudo -l' and sees that the current user can run /usr/bin/find as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

GTFOBins technique for find. The find command can be used to execute other commands via its -exec parameter, allowing privilege escalation.

Answer

SUID binary exploitation

Answer

PATH manipulation

Answer

Kernel exploit

Question 3

A penetration tester is performing an NTLM relay attack against a Windows network. The tester uses ntlmrelayx to relay captured NTLM authentication attempts to a target server. What must be true for this attack to succeed?

Accepted Answer

SMB signing must be disabled or not enforced. SMB signing must be disabled or not enforced on the target server, otherwise the relayed authentication will be rejected.

Answer

LLMNR must be enabled

Answer

The relayed hash must be crackable

Answer

The target server must have SMB signing enabled

Question 4

After gaining a foothold on a Windows server, a tester wants to laterally move to another machine. The tester has obtained NTLM hashes and wants to execute commands remotely. Which tool is specifically designed for remote command execution using hashes via WMI?

Accepted Answer

wmiexec. wmiexec.py (from Impacket) allows executing commands via WMI using NTLM hashes.

Answer

evil-winrm

Answer

psexec

Answer

CrackMapExec

Question 5

During a penetration test, the tester discovers a Linux binary with the SUID bit set owned by root. The binary is a custom script that executes 'cp' to copy files. The tester can control the source file path via an environment variable. Which privilege escalation technique should the tester attempt?

Accepted Answer

PATH manipulation. PATH manipulation involves modifying the PATH environment variable to execute a malicious 'cp' binary instead of the legitimate one.

Answer

Writable script in cron

Answer

Kernel exploit

Answer

SUID binary exploitation using GTFOBins

Question 6

A penetration tester wants to crack NTLM hashes captured during an internal test. Which hashcat mode should the tester use for NTLM hashes?

Accepted Answer

1000. Hashcat mode 1000 is specifically for NTLM hashes.

Answer

0

Answer

22000

Answer

13100

Question 7

A tester is performing a web application test and discovers a parameter that seems to reflect input in the response. The tester attempts a reflected XSS payload but the application filters script tags. Which XSS variant should the tester try next?

Accepted Answer

Reflected XSS with event handlers. If script tags are filtered, HTML event handlers like onerror can still execute JavaScript.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 8

During a penetration test, the tester gains a Meterpreter session on a Windows target and wants to escalate privileges to SYSTEM. The current user has the SeImpersonatePrivilege token. Which tool should the tester use to exploit this privilege?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits the SeImpersonatePrivilege to impersonate SYSTEM tokens.

Answer

Windows-Exploit-Suggester

Answer

whoami /priv

Answer

Mimikatz

Question 9

A tester is performing a Kerberoasting attack. After requesting TGS tickets for accounts with SPNs, what is the next step to obtain plaintext credentials?

Accepted Answer

Crack the TGS tickets using Hashcat or John the Ripper. Kerberoasting involves cracking the TGS tickets offline to recover the service account password.

Answer

Pass-the-ticket to access services

Answer

Relay the TGS tickets to another server

Answer

Use the TGS tickets for silver ticket attacks

Question 10

A penetration tester is performing a web application test and identifies an endpoint that is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions can the tester perform using this vulnerability? (Choose TWO.)

Accepted Answer

Access internal services running on localhost. SSRF can be used to access internal services and cloud metadata endpoints.

Answer

Perform SQL injection on the database

Answer

Upload files to the server

Answer

Read local files using file:// protocol

Question 11

During a Windows privilege escalation attempt, a penetration tester discovers that the always elevated installation policy is enabled. Which of the following actions can the tester take to exploit this misconfiguration? (Choose TWO.)

Accepted Answer

Use msiexec to silently install a crafted MSI. AlwaysInstallElevated allows any user to install .msi files with SYSTEM privileges. The tester can create a malicious MSI or use an existing one to execute commands.

Answer

Perform DLL hijacking on a system service

Answer

Exploit a kernel vulnerability

Answer

Modify the registry key to disable the policy

Question 12

A penetration tester is conducting a web application test and discovers an XML External Entity (XXE) vulnerability. Which of the following attacks can the tester perform using XXE? (Choose THREE.)

Accepted Answer

Read sensitive files from the server. XXE can be used to read files, perform SSRF, and cause denial of service via entity expansion.

Answer

SQL injection through entity values

Answer

Remote code execution

Question 13

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR and NBT-NS responses on the internal network. Which tool is most commonly used for this type of attack?

Accepted Answer

Responder. Responder is a widely used tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

ntlmrelayx

Answer

Bettercap

Answer

Hashcat

Question 14

A penetration tester has gained a low-privilege shell on a Windows server and discovers the user has the SeImpersonatePrivilege. Which tool could the tester use to escalate privileges to SYSTEM?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to escalate privileges on Windows.

Answer

Mimikatz

Answer

SharpHound

Answer

PowerUp

Question 15

During a web application test, the tester discovers a parameter that reflects user input in the response without proper encoding. The tester crafts a payload that executes JavaScript when another user views the page. Which type of XSS is this, and what is a primary risk?

Accepted Answer

Reflected XSS; risk of session hijacking. Reflected XSS executes in the victim's browser when the malicious link is clicked, allowing session hijacking.

Answer

Stored XSS; risk of data theft from database

Answer

Blind XSS; risk of internal network scanning

Answer

DOM-based XSS; risk of client-side logic bypass