PT0-002 Attacks and Exploits Practice Test 7 — 15 Questions

Question 1

A tester is exploiting a Linux system and finds a binary with the SUID bit set owned by root. The binary executes other commands. Which technique would allow privilege escalation to root?

Accepted Answer

PATH manipulation. If a SUID binary executes commands (e.g., via system() or exec()), it may be exploited to run arbitrary commands as root, especially if the path is not absolute.

Answer

DLL hijacking

Answer

Kernel exploit

Answer

Token impersonation

Question 2

A tester runs the following Metasploit commands:
```
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.0.0.5
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > run
```
What is the purpose of this configuration?

Accepted Answer

To receive a reverse shell from a target that already executed the payload. The multi/handler is a generic handler used to receive reverse connections from payloads that were delivered separately (e.g., via phishing). It waits for the target to connect back.

Answer

To exploit a remote service directly

Answer

To perform a bind shell attack

Answer

To stage a payload for later execution

Question 3

A tester wants to enumerate SMB shares and execute commands remotely on a Windows target using captured credentials. Which tool is most appropriate?

Accepted Answer

CrackMapExec. CrackMapExec is a versatile tool for SMB enumeration, command execution, and lateral movement with credentials.

Answer

Hashcat

Answer

Responder

Answer

Bettercap

Question 4

During a web application test, a tester discovers that the application uses JWTs for session management. The tester captures a JWT and notices the 'alg' header is set to 'none'. Which attack is the tester likely to perform?

Accepted Answer

Algorithm confusion (alg:none). If the server accepts 'none' algorithm, an attacker can forge arbitrary tokens by setting alg=none and removing the signature.

Answer

Weak secret brute-force

Answer

Kid injection

Answer

Key confusion

Question 5

A tester is performing a privilege escalation on a Windows system and finds that the user has SeImpersonatePrivilege enabled. Which tool could be used to escalate to SYSTEM?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege can be exploited using tools like PrintSpoofer or Potato attacks to impersonate SYSTEM tokens.

Answer

PsExec

Answer

evil-winrm

Answer

pth-winexe

Question 6

A tester is attempting to crack WPA2 handshakes captured from a wireless network. Which hashcat mode should be used?

Accepted Answer

-m 22000. Hashcat mode 22000 is used for WPA-PBKDF2-PMKID+EAPOL (WPA/WPA2) handshakes.

Answer

-m 13100

Answer

-m 1000

Answer

-m 0

Question 7

A tester is exploiting a SQL injection vulnerability in a login form. The application returns different responses for valid and invalid queries. However, the tester cannot see the database output. Which type of SQL injection is most likely?

Accepted Answer

Blind SQL injection. Blind SQL injection occurs when query results are not directly reflected, but the application behavior changes based on truth values.

Answer

Out-of-band SQL injection

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 8

During a penetration test, a tester gains initial access to a Linux server and wants to pivot to an internal network that is not directly accessible. Which of the following tools is specifically designed for creating SOCKS proxies for pivoting?

Accepted Answer

chisel. Chisel is a tool that creates tunnels and SOCKS proxies over HTTP, ideal for pivoting through restrictive networks.

Answer

netcat

Answer

nmap

Answer

hydra

Question 9

A tester is performing a web application test and finds an endpoint that accepts XML input. The tester sends a payload that includes an external entity referencing a local file. Which vulnerability is being tested?

Accepted Answer

XXE. XXE (XML External Entity) injection allows reading local files or performing SSRF via XML parsers.

Answer

IDOR

Answer

SSRF

Answer

Command injection

Question 10

A penetration tester is performing a full-scope engagement and needs to identify potential privilege escalation vectors on a Windows system. Which TWO of the following are valid Windows privilege escalation techniques?

Accepted Answer

Unquoted service path exploitation. Unquoted service paths and AlwaysInstallElevated are both valid Windows privilege escalation techniques. Kerberoasting and pass-the-hash are for credential access, not local escalation; SUID/SGID is Linux.

Answer

Pass-the-hash

Answer

Kerberoasting

Answer

SUID/SGID binary exploitation

Question 11

During a web application penetration test, a tester wants to identify vulnerabilities that allow unauthorized access to internal resources. Which TWO of the following are commonly exploited to access internal services?

Accepted Answer

Server-side request forgery (SSRF). SSRF can be used to access internal services by making the server request internal IPs. XXE can also be used for SSRF by using external entities to make HTTP requests. XSS is client-side, SQLi is database, command injection is OS commands.

Answer

Cross-site scripting (XSS)

Answer

SQL injection (SQLi)

Answer

Command injection

Question 12

A penetration tester successfully compromises a web server and wants to establish persistence on the system. Which THREE of the following are effective persistence mechanisms on a Linux system?

Accepted Answer

Creating a cron job that executes a reverse shell. Cron jobs, SSH authorized_keys, and systemd services are common persistence methods on Linux. Scheduled tasks and registry Run keys are Windows-specific.

Answer

Adding a registry Run key

Answer

Creating a scheduled task via schtasks

Question 13

During a penetration test, a tester runs the Responder tool on the internal network and captures an NTLMv2 hash. Which type of network attack is being performed?

Accepted Answer

LLMNR/NBT-NS poisoning. Responder poisons LLMNR, NBT-NS, and mDNS queries to capture NTLM hashes from systems trying to resolve names.

Answer

ARP spoofing

Answer

Relay attack

Answer

SSL stripping

Question 14

A penetration tester wants to crack NTLM hashes obtained from a Windows system. Which Hashcat mode should be used?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 15

During a web application test, a tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester intercepts a JWT and changes the algorithm header to 'none' with an empty signature. Which attack is being attempted?

Accepted Answer

JWT alg:none attack. Setting algorithm to 'none' is a JWT algorithm confusion attack where the server accepts unsigned tokens.

Answer

SQL injection

Answer

SSRF

Answer

IDOR