PT0-002 Attacks and Exploits Practice Test 6 — 15 Questions

Question 1

A penetration tester needs to crack NTLM hashes obtained from a Windows domain. The hashes are in the format used by Windows. Which hashcat mode should the tester use?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 2

While testing a Linux system, the tester finds a binary with the SUID bit set owned by root. The binary executes a command based on user input without verifying the path. Which privilege escalation technique does this exemplify?

Accepted Answer

SUID binary exploitation. PATH manipulation exploits insecure binary execution by modifying the PATH variable to execute malicious code.

Answer

Kernel exploit

Answer

Capability abuse

Answer

Cron job abuse

Question 3

A penetration tester wants to perform a pass-the-hash attack against a Windows system using a captured NTLM hash. Which tool can be used to authenticate and execute commands remotely?

Accepted Answer

pth-winexe. pth-winexe allows pass-the-hash authentication to Windows systems.

Answer

evil-winrm

Answer

Responder

Answer

Hashcat

Question 4

A tester identifies a SQL injection vulnerability in a login form. The application responds with different error messages for valid and invalid queries. Which type of SQL injection is most likely present, and what tool could automate exploitation?

Accepted Answer

Blind SQLi; sqlmap. Blind boolean-based SQL injection infers data based on true/false responses; sqlmap automates exploitation.

Answer

UNION-based SQLi; sqlmap

Answer

Time-based blind SQLi; nmap

Answer

Error-based SQLi; Burp Suite

Question 5

During an internal penetration test, the tester wants to relay captured NTLM authentication to a server to gain access. Which tool from the Impacket suite is specifically designed for NTLM relay attacks?

Accepted Answer

ntlmrelayx. ntlmrelayx is the Impacket tool for relaying NTLM authentication.

Answer

CrackMapExec

Answer

Metasploit

Answer

Responder

Question 6

A penetration tester gains a shell on a Linux server and needs to pivot to an internal network. The tester's attack machine can reach the compromised server but not the internal network. Which tool can create a SOCKS proxy on the compromised server?

Accepted Answer

Chisel. Chisel can create a SOCKS proxy over SSH or TCP tunneling.

Answer

SSH -L

Answer

Meterpreter

Answer

Netcat

Question 7

A tester wants to crack a password hash using a wordlist combined with rules to generate variations. Which hashcat attack mode should be used?

Accepted Answer

-a 0 with -r. Mode 0 with rule files applies rules to a wordlist.

Answer

-a 3

Answer

-a 6

Answer

-a 1

Question 8

A web application uses JSON Web Tokens (JWT) for authentication. The tester intercepts a token and decodes it to find the header contains "alg":"none". What vulnerability does this indicate, and how can it be exploited?

Accepted Answer

None algorithm; craft a token with empty signature. The "alg":"none" vulnerability allows arbitrary token creation without verification.

Answer

Kid injection; inject a malicious key ID

Answer

Weak secret; brute-force the secret

Answer

Algorithm confusion; change alg to HS256

Question 9

After compromising a Windows workstation, the tester wants to extract password hashes from the local SAM database. Which Metasploit meterpreter command should be used?

Accepted Answer

hashdump. hashdump dumps the SAM database hashes.

Answer

getsystem

Answer

getuid

Answer

shell

Question 10

A penetration tester is conducting a web application test and discovers a server-side request forgery (SSRF) vulnerability. The application accepts a URL parameter and fetches the resource. Which TWO of the following are common SSRF exploitation techniques?

Accepted Answer

Accessing the AWS metadata endpoint at 169.254.169.254. SSRF can access internal services like cloud metadata endpoints and perform internal port scans.

Answer

Crafting a JavaScript payload for XSS

Answer

Injecting SQL queries into the URL

Answer

Forcing the server to send a POST request

Question 11

During a Windows privilege escalation attempt, the tester finds that the AlwaysInstallElevated registry key is set to 1. Which TWO actions can the tester perform to escalate privileges?

Accepted Answer

Use PowerUp to generate a malicious MSI. AlwaysInstallElevated allows any user to install MSI files with SYSTEM privileges.

Answer

Modify the PATH environment variable

Answer

Request a TGS ticket for Kerberoasting

Answer

Create a new service with sc.exe

Question 12

A penetration tester has gained initial access to a Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for persistence on Linux systems?

Accepted Answer

Installing an SSH authorized_key for the attacker. Cron jobs, SSH authorized_keys, and systemd services are common persistence mechanisms.

Answer

Using schtasks to create a scheduled task

Answer

Modifying the Windows Registry Run key

Question 13

A penetration tester runs the following command: `hashcat -m 1000 -a 0 hashes.txt rockyou.txt`. What type of attack is being performed?

Accepted Answer

Dictionary attack. The command uses mode 1000 (NTLM) and attack mode 0 (dictionary) with rockyou.txt wordlist. This is a dictionary attack.

Answer

Brute-force attack

Answer

Hybrid attack

Answer

Rule-based attack

Question 14

During a penetration test, a tester captures NTLM hashes using Responder. Which of the following techniques would allow the tester to authenticate to a remote server without cracking the password?

Accepted Answer

Pass-the-hash. Pass-the-hash uses captured NTLM hashes to authenticate directly, bypassing the need to crack the password.

Answer

LLMNR poisoning

Answer

Kerberoasting

Answer

Rainbow table attack

Question 15

A penetration tester is performing a web application test and discovers that the application reflects user input in the response without proper sanitization. However, the tester notices that the input is handled client-side via JavaScript. Which type of XSS is this?

Accepted Answer

DOM-based XSS. DOM-based XSS occurs when the vulnerability exists in client-side JavaScript rather than server-side reflection.

Answer

Stored XSS

Answer

Reflected XSS

Answer

Blind XSS