PT0-002 Attacks and Exploits Practice Test 9 — 15 Questions

Question 1

A penetration tester is performing an internal test and wants to move laterally from a compromised workstation to a domain controller. The tester has obtained NTLM hash for a domain admin. Which of the following tools would allow the tester to authenticate using the hash without cracking it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pth-winexe. Pass-the-hash tools like pth-winexe or CrackMapExec allow authentication using the hash directly. PsExec requires explicit credentials or service installation, not pass-the-hash natively.

Answer

PsExec

Answer

Evil-WinRM

Answer

Responder

Question 2

A tester finds a Linux binary with the SUID bit set. The binary is owned by root and executes a shell command. The tester runs the binary and gets a root shell. Which command would the tester likely have used to discover this SUID binary?

Accepted Answer

find / -type f -perm /4000. The command 'find / -perm /4000' finds files with SUID bit set. The /4000 syntax searches for exactly SUID. Using -u=s is incorrect.

Answer

find / -perm -u=s

Answer

which suid

Answer

ls -laR / | grep SUID

Question 3

A tester is targeting a web application that makes server-side requests to internal resources based on user input. The tester attempts to access the AWS metadata endpoint at http://169.254.169.254/latest/meta-data/. The request returns sensitive cloud credentials. Which vulnerability is being exploited?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) allows the attacker to make the server send requests to internal resources. The metadata endpoint is a classic SSRF target. XXE can also access files but typically via entity injection, not direct URL.

Answer

IDOR

Answer

XXE

Answer

CSRF

Question 4

During a penetration test, a tester gains access to a Linux system and runs 'sudo -l', which reveals that the user can run /usr/bin/python with root privileges without a password. Which resource should the tester consult to find a method to escalate privileges using this configuration?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions. It provides techniques for privilege escalation using binaries like python. GTFOBins is specifically for Unix privilege escalation.

Answer

PayloadsAllTheThings

Answer

HackTricks

Answer

Exploit-DB

Question 5

A tester wants to perform a Kerberoasting attack against an Active Directory domain. The tester has a domain account with no special privileges. Which of the following is required to successfully request TGS tickets for offline cracking?

Accepted Answer

A valid domain user account. Kerberoasting requires a valid domain account to request TGS tickets for service accounts. No special privileges are needed beyond being authenticated. AS-REP roasting targets users without pre-authentication, not service accounts.

Answer

The service account's password hash

Answer

Administrator privileges on a domain controller

Answer

Local administrator access on a client machine

Question 6

A penetration tester has obtained a meterpreter session on a Windows target. The tester wants to escalate privileges to SYSTEM and then dump password hashes. Which two meterpreter commands should the tester use in sequence? (Choose TWO.)

Accepted Answer

getsystem. First, use getsystem to attempt privilege escalation to SYSTEM (via token stealing or other techniques). Then, use hashdump to dump the SAM database hashes. getuid shows current user, sysinfo shows system info.

Answer

getuid

Answer

shell

Answer

sysinfo

Question 7

A tester is performing a post-exploitation phase on a compromised Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for Linux persistence? (Choose THREE.)

Accepted Answer

Adding an SSH public key to ~/.ssh/authorized_keys. Common Linux persistence methods include adding cron jobs (crontab), creating a systemd service that starts on boot, and adding SSH authorized keys for backdoor access. Scheduled tasks are Windows-specific; Registry Run keys are also Windows-only.

Answer

Adding a registry Run key

Answer

Creating a scheduled task using schtasks

Question 8

A penetration tester is exploiting a web application and discovers an endpoint that allows an attacker to read arbitrary files on the server by manipulating XML input. The application uses an XML parser that does not disable external entities. Which TWO attacks can the tester perform using this vulnerability? (Choose TWO.)

Accepted Answer

SSRF via XXE. XXE (XML External Entity) allows file reads and can also lead to SSRF if the entity points to an internal URL. Command injection typically requires different input. SQL injection needs SQL syntax. XSS is client-side.

Answer

Command injection

Answer

SQL injection

Answer

XSS

Question 9

During a penetration test, you run the following command on a Linux target: `find / -type f -perm /4000 2>/dev/null`. What are you attempting to identify?

Accepted Answer

SUID binaries. The find command with -perm /4000 searches for files with SUID bit set, which can be exploited for privilege escalation.

Answer

World-writable files

Answer

Files with extended attributes

Answer

SGID binaries

Question 10

You have captured an NTLMv2 hash from a LLMNR poisoning attack using Responder. Which tool and mode would you use to attempt to crack the hash using a dictionary attack?

Accepted Answer

Hashcat -m 5600 -a 0. Hashcat mode 5600 is for NTLMv2 hashes; -a 0 is dictionary attack.

Answer

John the Ripper --format=LM --wordlist

Answer

Hashcat -m 1000 -a 0

Answer

John the Ripper --format=NT --wordlist

Question 11

During a web application test, you discover an endpoint that accepts a URL parameter and fetches the content. You try `http://169.254.169.254/latest/meta-data/` and receive a response. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF). The IP 169.254.169.254 is the cloud metadata endpoint; accessing it indicates SSRF.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Local File Inclusion (LFI)

Answer

XML External Entity (XXE)

Question 12

In a Windows domain, you have compromised a user account with SeImpersonatePrivilege enabled. Which tool or technique would best leverage this privilege to escalate to SYSTEM?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows token impersonation; PrintSpoofer exploits it to get SYSTEM.

Answer

AlwaysInstallElevated

Answer

Pass-the-Hash with pth-winexe

Answer

Kerberoasting

Question 13

Which SQL injection technique involves injecting a query that causes a delay in response, allowing the attacker to infer information based on response time?

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection uses delays (e.g., WAITFOR DELAY) to infer true/false conditions.

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Answer

Boolean-blind SQL injection

Question 14

After exploiting a Linux server, you need to pivot to a restricted network subnet. You have SSH access to the compromised server. Which command would create a SOCKS proxy on the server to route traffic through it?

Accepted Answer

ssh -D 1080 user@server. SSH -D creates a SOCKS tunnel for dynamic port forwarding, allowing pivoting.

Answer

ssh -L 1080:server:80 user@server

Answer

ssh -R 1080:server:80 user@server

Answer

ssh -J user@server:1080

Question 15

You are testing a web application and notice that it uses JSON Web Tokens (JWT) for authentication. You change the algorithm to 'none' and remove the signature, and the token is accepted. Which JWT vulnerability did you exploit?

Accepted Answer

Algorithm none attack. Alg:none attack exploits weak validation that accepts unsigned tokens.

Answer

KID injection

Answer

Weak secret brute-force

Answer

Token replay