PT0-002 Attacks and Exploits Practice Test 5 — 15 Questions

Question 1

A tester is exploiting a vulnerable web application and wants to perform a UNION-based SQL injection to extract data. Which condition is necessary for a successful UNION attack?

Accepted Answer

The number of columns in both queries must match. UNION-based injection requires the same number of columns between the original query and the injected SELECT.

Answer

The database must be MySQL

Answer

The application must use GET parameters

Answer

The application must display error messages

Question 2

A penetration tester is performing a Kerberoasting attack. Which TWO steps are required for a successful Kerberoasting attack?

Accepted Answer

Request TGS tickets for service accounts. Kerberoasting involves requesting TGS tickets for service accounts and then cracking the tickets offline.

Answer

Enumerate domain admins

Answer

Perform a relay attack

Answer

Capture NTLMv2 hashes using Responder

Question 3

A penetration tester is testing a web application and wants to exploit an XXE vulnerability to read sensitive files. Which TWO payloads could be used?

Accepted Answer

]>. XXE can be used to read files via file:// or to perform SSRF to internal resources via http://, including cloud metadata.

Answer

Answer

'; DROP TABLE users; --

Answer

../../etc/passwd

Question 4

A penetration tester is performing lateral movement in a Windows domain after compromising a workstation. Which THREE techniques can be used to move to another machine?

Accepted Answer

Evil-WinRM. PsExec, WMIExec, and Evil-WinRM are common tools for lateral movement in Windows environments.

Answer

ARP spoofing

Answer

SSH with captured credentials

Question 5

During an internal penetration test, a tester wants to capture NTLMv2 hashes by poisoning LLMNR and NBT-NS traffic. Which tool should the tester use?

Accepted Answer

Responder. Responder is specifically designed to respond to LLMNR and NBT-NS queries and capture NetNTLM hashes.

Answer

ntlmrelayx

Answer

Bettercap

Answer

Hashcat

Question 6

A tester wants to crack NTLM hashes captured from a Windows domain. Which hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode 1000 corresponds to NTLM hashes.

Answer

-m 13100

Answer

-m 0

Answer

-m 22000

Question 7

During a Linux privilege escalation attempt, a tester finds a binary with the SUID bit set that is not on the GTFOBins list. The binary executes /bin/bash with the effective UID of root. What is the most likely way to exploit this?

Accepted Answer

Run the binary with the -p flag. When an SUID binary executes /bin/bash, bash will drop the effective UID unless the -p (privileged) flag is used. Running the binary with '-p' preserves the effective UID, granting a root shell. Simply running the binary may result in a shell with the original user's privileges.

Answer

Use GTFOBins to find a suitable exploit

Answer

Perform a buffer overflow on the binary

Answer

Modify the PATH to include a fake binary

Question 8

During a Windows privilege escalation attempt, the tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool is commonly used to exploit this privilege to gain SYSTEM?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to impersonate SYSTEM and spawn a shell.

Answer

SharpUp

Answer

Mimikatz

Answer

PowerUp

Question 9

A penetration tester has gained access to a Linux server and wants to move laterally to a Windows server. The tester captured a hash of a domain user. Which tool can be used to authenticate to the Windows server using the hash?

Accepted Answer

evil-winrm. evil-winrm supports pass-the-hash authentication over WinRM, allowing lateral movement.

Answer

Ligolo-ng

Answer

SSH

Answer

Chisel

Question 10

A tester is performing a Kerberoasting attack. After requesting TGS tickets, which hashcat mode should be used to crack them?

Accepted Answer

-m 13100. Kerberoast tickets are TGS-REP hashes, mode 13100.

Answer

-m 1000

Answer

-m 18200

Answer

-m 5500

Question 11

A penetration tester is conducting an internal network assessment. The tester wants to perform a man-in-the-middle attack to capture credentials. Which TWO tools can be used for ARP spoofing?

Accepted Answer

Ettercap. Bettercap and Ettercap are both capable of ARP spoofing.

Answer

Responder

Answer

Nmap

Answer

Hashcat

Question 12

During a post-exploitation phase, a tester needs to establish persistence on a Windows target. Which THREE methods are commonly used for persistence on Windows?

Accepted Answer

Registry Run keys. Scheduled tasks, registry Run keys, and WMI subscriptions are common persistence mechanisms. Pass-the-hash is lateral movement, and cron jobs are Linux-specific.

Answer

Pass-the-hash

Answer

Cron jobs

Question 13

A penetration tester is exploiting a web application and discovers an XML External Entity (XXE) vulnerability. Which TWO attacks can be performed using XXE?

Accepted Answer

Server-Side Request Forgery (SSRF). XXE can be used to read local files via external entities and also to perform SSRF by making the server request internal resources.

Answer

Remote code execution

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 14

A penetration tester is conducting a network attack and wants to intercept traffic between two hosts on the same local network by spoofing ARP responses. Which tool is specifically designed for this purpose?

Accepted Answer

Bettercap. Bettercap is a powerful tool that includes ARP spoofing capabilities for man-in-the-middle attacks on local networks.

Answer

Responder

Answer

Hashcat

Answer

John the Ripper

Question 15

During a penetration test, you capture NTLM hashes by poisoning LLMNR requests. Which tool would you use to exploit this and obtain the hashes?

Accepted Answer

Responder. Responder is the primary tool used for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes from network authentication attempts.

Answer

CrackMapExec

Answer

ntlmrelayx

Answer

Metasploit