PT0-002 Attacks and Exploits Practice Test 9 — 15 Questions

Question 1

During a penetration test, a tester captures NTLMv2 hashes using Responder. The tester then uses ntlmrelayx to relay the captured hashes to a target server. Which of the following best describes this attack technique?

Accepted Answer

NTLM relay attack. NTLM relay attacks forward captured authentication attempts to other servers, allowing the attacker to authenticate without cracking the hash. This is distinct from pass-the-hash, which requires a hash of the target account for local authentication.

Answer

Kerberoasting attack

Answer

SMB relay attack

Answer

Pass-the-hash attack

Question 2

A penetration tester is performing an internal assessment and wants to intercept network traffic to capture credentials. Which tool is specifically designed for ARP spoofing and can also perform SSL stripping?

Accepted Answer

Bettercap. Bettercap is a powerful tool that can perform ARP spoofing, SSL stripping, and other man-in-the-middle attacks. Responder is used for LLMNR/NBT-NS poisoning, not ARP spoofing.

Answer

Wireshark

Answer

Ettercap

Answer

Responder

Question 3

A penetration tester has gained a low-privilege shell on a Windows server and discovered that the SeImpersonatePrivilege is enabled. Which of the following tools would be most appropriate to escalate privileges to SYSTEM-level access?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows token impersonation. Tools like PrintSpoofer exploit this to gain SYSTEM privileges. Potato attacks (JuicyPotato) also work, but PrintSpoofer is more modern and reliable.

Answer

pth-winexe

Answer

Responder

Answer

CrackMapExec

Question 4

A tester is exploiting a web application and identifies a parameter that reflects user input in the response without sanitization. The tester wants to steal session cookies from other users. Which type of cross-site scripting (XSS) attack should the tester use?

Accepted Answer

Reflected XSS. Reflected XSS occurs when input is immediately reflected in the response. Stored XSS persists on the server. DOM-based XSS occurs client-side. For stealing cookies, reflected XSS can be crafted into a link sent to the victim.

Answer

Stored XSS

Answer

Blind XSS

Answer

DOM-based XSS

Question 5

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows domain controller. Which hash mode should the tester specify for NTLM hashes?

Accepted Answer

-m 1000. Hashcat uses mode -m 1000 for NTLM hashes. Mode 0 is for MD5, mode 13100 is for Kerberoast, and mode 22000 is for WPA2.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 6

During a web application test, a tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester attempts to modify the 'alg' header to 'none' and sends the token. The server accepts the forged token. Which vulnerability is being exploited?

Accepted Answer

alg:none attack. The 'alg:none' attack exploits JWT libraries that accept tokens without verifying signatures. This allows an attacker to forge tokens. Weak secret brute-force would crack the signing key; kid injection manipulates the key ID.

Answer

kid injection

Answer

Algorithm confusion

Answer

Weak signing secret

Question 7

A penetration tester is performing an internal test and wants to move laterally from a compromised workstation to a domain controller. The tester has obtained NTLM hash for a domain admin. Which of the following tools would allow the tester to authenticate using the hash without cracking it?

Accepted Answer

pth-winexe. Pass-the-hash tools like pth-winexe or CrackMapExec allow authentication using the hash directly. PsExec requires explicit credentials or service installation, not pass-the-hash natively.

Answer

PsExec

Answer

Evil-WinRM

Answer

Responder

Question 8

A tester finds a Linux binary with the SUID bit set. The binary is owned by root and executes a shell command. The tester runs the binary and gets a root shell. Which command would the tester likely have used to discover this SUID binary?

Accepted Answer

find / -type f -perm /4000. The command 'find / -perm /4000' finds files with SUID bit set. The /4000 syntax searches for exactly SUID. Using -u=s is incorrect.

Answer

find / -perm -u=s

Answer

which suid

Answer

ls -laR / | grep SUID

Question 9

A tester is performing an SQL injection attack on a login form. The tester inputs a single quote (') and receives a database error. The application returns different responses for true and false conditions. Which type of SQL injection is most likely occurring?

Accepted Answer

Blind SQL injection. Blind SQL injection occurs when no error messages are shown, but the application behaves differently based on true/false conditions. Error-based injection shows database errors. UNION-based requires visible output. Time-based uses delays.

Answer

Time-based SQL injection

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 10

A tester is targeting a web application that makes server-side requests to internal resources based on user input. The tester attempts to access the AWS metadata endpoint at http://169.254.169.254/latest/meta-data/. The request returns sensitive cloud credentials. Which vulnerability is being exploited?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) allows the attacker to make the server send requests to internal resources. The metadata endpoint is a classic SSRF target. XXE can also access files but typically via entity injection, not direct URL.

Answer

IDOR

Answer

XXE

Answer

CSRF

Question 11

During a penetration test, a tester gains access to a Linux system and runs 'sudo -l', which reveals that the user can run /usr/bin/python with root privileges without a password. Which resource should the tester consult to find a method to escalate privileges using this configuration?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions. It provides techniques for privilege escalation using binaries like python. GTFOBins is specifically for Unix privilege escalation.

Answer

PayloadsAllTheThings

Answer

HackTricks

Answer

Exploit-DB

Question 12

A tester wants to perform a Kerberoasting attack against an Active Directory domain. The tester has a domain account with no special privileges. Which of the following is required to successfully request TGS tickets for offline cracking?

Accepted Answer

A valid domain user account. Kerberoasting requires a valid domain account to request TGS tickets for service accounts. No special privileges are needed beyond being authenticated. AS-REP roasting targets users without pre-authentication, not service accounts.

Answer

The service account's password hash

Answer

Administrator privileges on a domain controller

Answer

Local administrator access on a client machine

Question 13

A penetration tester has obtained a meterpreter session on a Windows target. The tester wants to escalate privileges to SYSTEM and then dump password hashes. Which two meterpreter commands should the tester use in sequence? (Choose TWO.)

Accepted Answer

getsystem. First, use getsystem to attempt privilege escalation to SYSTEM (via token stealing or other techniques). Then, use hashdump to dump the SAM database hashes. getuid shows current user, sysinfo shows system info.

Answer

getuid

Answer

shell

Answer

sysinfo

Question 14

A tester is performing a post-exploitation phase on a compromised Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for Linux persistence? (Choose THREE.)

Accepted Answer

Adding an SSH public key to ~/.ssh/authorized_keys. Common Linux persistence methods include adding cron jobs (crontab), creating a systemd service that starts on boot, and adding SSH authorized keys for backdoor access. Scheduled tasks are Windows-specific; Registry Run keys are also Windows-only.

Answer

Adding a registry Run key

Answer

Creating a scheduled task using schtasks

Question 15

A penetration tester is exploiting a web application and discovers an endpoint that allows an attacker to read arbitrary files on the server by manipulating XML input. The application uses an XML parser that does not disable external entities. Which TWO attacks can the tester perform using this vulnerability? (Choose TWO.)

Accepted Answer

SSRF via XXE. XXE (XML External Entity) allows file reads and can also lead to SSRF if the entity points to an internal URL. Command injection typically requires different input. SQL injection needs SQL syntax. XSS is client-side.

Answer

Command injection

Answer

SQL injection

Answer

XSS