PT0-002 Attacks and Exploits Practice Test 5 — 15 Questions

Question 1

A penetration tester is performing a network attack and wants to intercept traffic between two hosts on the same local network. Which technique should the tester use to redirect traffic through their machine?

Accepted Answer

ARP spoofing. ARP spoofing allows an attacker to associate their MAC address with the IP address of another host, intercepting traffic intended for that host.

Answer

DNS poisoning

Answer

LLMNR poisoning

Answer

SSL stripping

Question 2

During a penetration test, the tester captured an NTLM hash using Responder and wants to pass the hash to gain access to a remote Windows system. Which tool would be most appropriate to perform a pass-the-hash attack?

Accepted Answer

pth-winexe. pth-winexe allows authenticating to Windows systems using an NTLM hash without the plaintext password.

Answer

John the Ripper

Answer

CrackMapExec

Answer

Hashcat

Question 3

A penetration tester is performing a SQL injection test on a web application. The tester sends the payload ' OR '1'='1 and receives the same response as with a normal request. However, when sending ' OR '1'='2, the response differs. Which type of SQL injection is most likely present?

Accepted Answer

Blind SQL injection (boolean-based). A difference in responses between a true condition and a false condition indicates blind SQL injection, specifically boolean-based blind.

Answer

Time-based blind SQL injection

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Question 4

During a web application penetration test, the tester discovers a JWT token in the Authorization header. The token uses the 'none' algorithm. What attack should the tester attempt?

Accepted Answer

JWT algorithm confusion attack (alg:none). If the server accepts the 'none' algorithm, the tester can forge tokens by setting the algorithm to 'none' and removing the signature.

Answer

JWT timing attack

Answer

JWT kid injection

Answer

JWT brute-force of the secret

Question 5

A tester has exploited a Linux system and gained a low-privilege shell. The tester runs 'sudo -l' and sees that the current user can run /usr/bin/find as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

GTFOBins technique for find. The find command can be used to execute other commands via its -exec parameter, allowing privilege escalation.

Answer

SUID binary exploitation

Answer

PATH manipulation

Answer

Kernel exploit

Question 6

A penetration tester is performing an NTLM relay attack against a Windows network. The tester uses ntlmrelayx to relay captured NTLM authentication attempts to a target server. What must be true for this attack to succeed?

Accepted Answer

SMB signing must be disabled or not enforced. SMB signing must be disabled or not enforced on the target server, otherwise the relayed authentication will be rejected.

Answer

LLMNR must be enabled

Answer

The relayed hash must be crackable

Answer

The target server must have SMB signing enabled

Question 7

After gaining a foothold on a Windows server, a tester wants to laterally move to another machine. The tester has obtained NTLM hashes and wants to execute commands remotely. Which tool is specifically designed for remote command execution using hashes via WMI?

Accepted Answer

wmiexec. wmiexec.py (from Impacket) allows executing commands via WMI using NTLM hashes.

Answer

evil-winrm

Answer

psexec

Answer

CrackMapExec

Question 8

During a penetration test, the tester discovers a Linux binary with the SUID bit set owned by root. The binary is a custom script that executes 'cp' to copy files. The tester can control the source file path via an environment variable. Which privilege escalation technique should the tester attempt?

Accepted Answer

PATH manipulation. PATH manipulation involves modifying the PATH environment variable to execute a malicious 'cp' binary instead of the legitimate one.

Answer

Writable script in cron

Answer

Kernel exploit

Answer

SUID binary exploitation using GTFOBins

Question 9

A penetration tester wants to crack NTLM hashes captured during an internal test. Which hashcat mode should the tester use for NTLM hashes?

Accepted Answer

1000. Hashcat mode 1000 is specifically for NTLM hashes.

Answer

0

Answer

22000

Answer

13100

Question 10

A tester is performing a web application test and discovers a parameter that seems to reflect input in the response. The tester attempts a reflected XSS payload but the application filters script tags. Which XSS variant should the tester try next?

Accepted Answer

Reflected XSS with event handlers. If script tags are filtered, HTML event handlers like onerror can still execute JavaScript.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 11

During a penetration test, the tester gains a Meterpreter session on a Windows target and wants to escalate privileges to SYSTEM. The current user has the SeImpersonatePrivilege token. Which tool should the tester use to exploit this privilege?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits the SeImpersonatePrivilege to impersonate SYSTEM tokens.

Answer

Windows-Exploit-Suggester

Answer

whoami /priv

Answer

Mimikatz

Question 12

A tester is performing a Kerberoasting attack. After requesting TGS tickets for accounts with SPNs, what is the next step to obtain plaintext credentials?

Accepted Answer

Crack the TGS tickets using Hashcat or John the Ripper. Kerberoasting involves cracking the TGS tickets offline to recover the service account password.

Answer

Pass-the-ticket to access services

Answer

Relay the TGS tickets to another server

Answer

Use the TGS tickets for silver ticket attacks

Question 13

A penetration tester is performing a web application test and identifies an endpoint that is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions can the tester perform using this vulnerability? (Choose TWO.)

Accepted Answer

Access internal services running on localhost. SSRF can be used to access internal services and cloud metadata endpoints.

Answer

Perform SQL injection on the database

Answer

Upload files to the server

Answer

Read local files using file:// protocol

Question 14

During a Windows privilege escalation attempt, a penetration tester discovers that the always elevated installation policy is enabled. Which of the following actions can the tester take to exploit this misconfiguration? (Choose TWO.)

Accepted Answer

Use msiexec to silently install a crafted MSI. AlwaysInstallElevated allows any user to install .msi files with SYSTEM privileges. The tester can create a malicious MSI or use an existing one to execute commands.

Answer

Perform DLL hijacking on a system service

Answer

Exploit a kernel vulnerability

Answer

Modify the registry key to disable the policy

Question 15

A penetration tester is conducting a web application test and discovers an XML External Entity (XXE) vulnerability. Which of the following attacks can the tester perform using XXE? (Choose THREE.)

Accepted Answer

Read sensitive files from the server. XXE can be used to read files, perform SSRF, and cause denial of service via entity expansion.

Answer

SQL injection through entity values

Answer

Remote code execution