PT0-002 Attacks and Exploits Practice Test 6 — 15 Questions

Question 1

After compromising a Linux host, you want to escalate privileges by exploiting a cron job that runs a script with root privileges. The script references an executable using a relative path. Which attack technique is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PATH manipulation. PATH manipulation works by modifying the PATH environment variable so that when the script calls the executable (by name only, no full path), the attacker's malicious version runs with the privileges of the script.

Answer

SUID binary exploitation

Answer

Kernel exploit

Answer

DLL hijacking

Question 2

In a web application test, you find a parameter that directly references internal object IDs (e.g., user_id=123) and changing the ID allows access to another user's data. This vulnerability is known as:

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references without proper access control checks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 3

During an internal penetration test, you need to perform lateral movement to a Windows target. You have a plaintext password for a domain user account. Which tool would be most appropriate to authenticate to the target using WMI?

Accepted Answer

wmiexec. wmiexec (part of Impacket) allows execution of commands on a Windows host via WMI using valid credentials, suitable for lateral movement.

Answer

CrackMapExec

Answer

evil-winrm

Answer

psexec

Question 4

You have obtained a NTLM hash of a domain admin account and want to authenticate to a remote server without cracking the password. Which technique enables you to authenticate using the hash?

Accepted Answer

Pass-the-Hash. Pass-the-hash uses the NTLM hash directly to authenticate without needing the plaintext password. Tools like pth-winexe or CrackMapExec can perform this.

Answer

AS-REP roasting

Answer

Pass-the-Ticket

Answer

Kerberoasting

Question 5

A penetration tester is exploiting a SQL injection vulnerability in a web application. They want to extract data from the database without displaying it on the page. Which SQL injection technique should they use?

Accepted Answer

Blind time-based SQL injection. Blind SQL injection techniques like time-based or boolean-based are used when data is not returned directly in the response. Time-based uses delays to infer information.

Answer

Stacked queries

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 6

During a web application test, you discover a parameter that reflects user input in the response without proper encoding. You craft a payload that executes JavaScript in the victim's browser. This vulnerability is best classified as:

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately reflected back in the response without proper sanitization, allowing script execution.

Answer

Stored XSS

Answer

Server-side request forgery (SSRF)

Answer

DOM-based XSS

Question 7

You are attacking a web application and notice that it makes requests to internal services. You attempt to access the cloud metadata endpoint at http://169.254.169.254/. Which vulnerability are you most likely exploiting?

Accepted Answer

SSRF (Server-Side Request Forgery). SSRF (Server-Side Request Forgery) allows an attacker to make requests from the server to internal resources, including cloud metadata endpoints.

Answer

XXE (XML External Entity)

Answer

Command injection

Answer

CSRF (Cross-Site Request Forgery)

Question 8

After gaining initial access to a Windows host, you want to escalate privileges by exploiting a service that runs as SYSTEM but has an unquoted service path. What is the attack vector?

Accepted Answer

Unquoted service path. Unquoted service path vulnerability allows an attacker to place an executable in a path that the service will execute due to ambiguous path parsing.

Answer

Token impersonation

Answer

AlwaysInstallElevated

Answer

DLL hijacking

Question 9

Which Metasploit command is used to display information about the current meterpreter session, including the target OS and user?

Accepted Answer

sysinfo. The 'sysinfo' meterpreter command displays system information such as OS, architecture, and sometimes user context.

Answer

hashdump

Answer

getuid

Answer

getsystem

Question 10

A penetration tester needs to crack a large number of NTLM hashes. They have a wordlist and want to apply common password mutations. Which hashcat option enables the use of a rule file to mutate words?

Accepted Answer

-r. Hashcat's -r option specifies a rule file that defines transformations (mutation) on dictionary words.

Answer

-a 0

Answer

-a 6

Answer

-m 1000

Question 11

During a penetration test, a tester captures NTLM hashes by spoofing LLMNR responses on the internal network. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

ntlmrelayx

Answer

Hashcat

Answer

Bettercap

Question 12

A penetration tester wants to perform a pass-the-hash attack on a Windows target. Which tools can be used for this purpose? (Choose the best answer.)

Accepted Answer

pth-winexe. pth-winexe is a common tool for pass-the-hash attacks on Windows.

Answer

sqlmap

Answer

John the Ripper

Answer

Hashcat

Question 13

During a web application test, the tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester modifies the JWT header to set the algorithm to 'none' and removes the signature. The server accepts the token. What type of attack is this?

Accepted Answer

JWT algorithm confusion (alg:none). Setting the JWT algorithm to 'none' exploits a misconfiguration where the server does not enforce signature verification, leading to JWT algorithm confusion.

Answer

JWT injection

Answer

JWT session stealing

Answer

JWT secret brute-force

Question 14

A penetration tester needs to escalate privileges on a Linux system and finds that the user can run a script with sudo that has a vulnerable argument. Which resource should the tester consult to find exploitation techniques for common sudo misconfigurations?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be exploited to bypass local security restrictions, including sudo misconfigurations.

Answer

Exploit-DB

Answer

Metasploit

Answer

CVE Details

Question 15

During a penetration test, a tester wants to crack NTLM hashes captured from a Windows domain. Which hashcat mode should the tester use for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is specifically designated for NTLM hashes, which are the format stored in Windows SAM and NTDS.dit files and transmitted during NTLM authentication. When a tester captures NTLM challenge-response traffic or extracts hashes from a domain controller, -m 1000 tells hashcat to parse the 32-hex-character NTLM hash correctly. This is the standard mode used in tools like Responder + hashcat workflows during internal Active Directory penetration tests.

Answer

-m 13100

Answer

-m 22000

Answer

-m 0