PT0-002 Attacks and Exploits Practice Test 8 — 15 Questions

Question 1

A penetration tester gains a low-privilege shell on a Linux server. The command 'sudo -l' reveals that the user can run /usr/bin/less as root without a password. Which tool would the tester likely use to escalate privileges?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GTFOBins. GTFOBins documents that less can be used to escalate privileges via the ! command when run with sudo.

Answer

Metasploit

Answer

Hashcat

Answer

Chisel

Question 2

During a penetration test, a tester uses Metasploit to exploit a Windows service and gets a meterpreter session. The tester wants to dump hashes from the compromised system. Which meterpreter command should be used?

Accepted Answer

hashdump. The hashdump command in meterpreter dumps the SAM database hashes.

Answer

shell

Answer

sysinfo

Answer

getsystem

Question 3

A penetration tester is testing a web application and discovers an endpoint that returns XML data. The tester attempts to read /etc/passwd by injecting an external entity. Which type of attack is this?

Accepted Answer

XXE injection. XML External Entity (XXE) injection allows reading files or performing SSRF via XML processing.

Answer

Command injection

Answer

SSRF

Answer

SQL injection

Question 4

While performing a web application penetration test, a tester observes that the application reflects user input in the page without proper sanitization. To steal session cookies, the tester crafts a payload like . Which XSS type is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the injected script is reflected off the web server immediately.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

SQL injection

Question 5

During a post-exploitation phase, a tester has a foothold on a Linux server and wants to pivot to an internal web server that is not directly accessible. The tester has SSH access to the compromised server. Which command would create a local port forward to access the internal web server on port 80?

Accepted Answer

ssh -L 8080:internal_web:80 user@compromised_server. SSH -L forwards a local port to a remote destination.

Answer

ssh -L 8080:compromised_server:80 user@internal_web

Answer

ssh -D 8080 user@compromised_server

Answer

ssh -R 8080:internal_web:80 user@compromised_server

Question 6

A penetration tester is performing a Kerberoasting attack. After requesting TGS tickets from a domain controller, which tool would be used to crack the tickets offline?

Accepted Answer

Hashcat. Hashcat with mode 13100 is used to crack Kerberos 5 TGS-REP etype 23 hashes.

Answer

John the Ripper

Answer

Metasploit

Answer

Responder

Question 7

A tester finds that a web application is vulnerable to Server-Side Request Forgery (SSRF). The tester wants to access the cloud metadata endpoint to obtain instance credentials. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. The cloud metadata endpoint is typically at 169.254.169.254 for AWS, GCP, and Azure.

Answer

127.0.0.1

Answer

10.0.0.1

Answer

192.168.1.1

Question 8

A penetration tester has obtained a set of NTLM hashes from a Windows domain. The tester wants to perform lateral movement to other systems. Which TWO tools can be used for this purpose? (Select TWO.)

Accepted Answer

pth-winexe. CrackMapExec and pth-winexe both support pass-the-hash for lateral movement.

Answer

Responder

Answer

Nmap

Answer

Hashcat

Question 9

A penetration tester has gained a foothold on a Linux server and wants to escalate privileges to root. Which THREE of the following are potential privilege escalation vectors? (Select THREE.)

Accepted Answer

Kernel exploits. SUID binaries, writable cron scripts, and kernel exploits are common Linux privilege escalation vectors.

Answer

AlwaysInstallElevated

Answer

Unquoted service paths

Question 10

During a penetration test, a tester captures NTLMv2 hashes using Responder. The tester then uses ntlmrelayx to relay the captured hashes to a target server. Which of the following best describes this attack technique?

Accepted Answer

NTLM relay attack. NTLM relay attacks forward captured authentication attempts to other servers, allowing the attacker to authenticate without cracking the hash. This is distinct from pass-the-hash, which requires a hash of the target account for local authentication.

Answer

Kerberoasting attack

Answer

SMB relay attack

Answer

Pass-the-hash attack

Question 11

A penetration tester is performing an internal assessment and wants to intercept network traffic to capture credentials. Which tool is specifically designed for ARP spoofing and can also perform SSL stripping?

Accepted Answer

Bettercap. Bettercap is a powerful tool that can perform ARP spoofing, SSL stripping, and other man-in-the-middle attacks. Responder is used for LLMNR/NBT-NS poisoning, not ARP spoofing.

Answer

Wireshark

Answer

Ettercap

Answer

Responder

Question 12

A penetration tester has gained a low-privilege shell on a Windows server and discovered that the SeImpersonatePrivilege is enabled. Which of the following tools would be most appropriate to escalate privileges to SYSTEM-level access?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows token impersonation. Tools like PrintSpoofer exploit this to gain SYSTEM privileges. Potato attacks (JuicyPotato) also work, but PrintSpoofer is more modern and reliable.

Answer

pth-winexe

Answer

Responder

Answer

CrackMapExec

Question 13

A tester is exploiting a web application and identifies a parameter that reflects user input in the response without sanitization. The tester wants to steal session cookies from other users. Which type of cross-site scripting (XSS) attack should the tester use?

Accepted Answer

Reflected XSS. Reflected XSS occurs when input is immediately reflected in the response. Stored XSS persists on the server. DOM-based XSS occurs client-side. For stealing cookies, reflected XSS can be crafted into a link sent to the victim.

Answer

Stored XSS

Answer

Blind XSS

Answer

DOM-based XSS

Question 14

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows domain controller. Which hash mode should the tester specify for NTLM hashes?

Accepted Answer

-m 1000. Hashcat uses mode -m 1000 for NTLM hashes. Mode 0 is for MD5, mode 13100 is for Kerberoast, and mode 22000 is for WPA2.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 15

During a web application test, a tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester attempts to modify the 'alg' header to 'none' and sends the token. The server accepts the forged token. Which vulnerability is being exploited?

Accepted Answer

alg:none attack. The 'alg:none' attack exploits JWT libraries that accept tokens without verifying signatures. This allows an attacker to forge tokens. Weak secret brute-force would crack the signing key; kid injection manipulates the key ID.

Answer

kid injection

Answer

Algorithm confusion

Answer

Weak signing secret