easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has compromised a Linux…
A penetration tester has compromised a Linux server and gained a low-privilege shell. The tester discovers that the /etc/shadow file is readable by the tester's user. Which attack is most directly enabled by this finding?
⚠ Common exam trap
A common mix-up: candidates confuse the ability to read a password hash file with a pass-the-hash attack, but pass-the-hash is a Windows-specific technique that requires NTLM hashes and a network authentication context, not a local file read on Linux.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password cracking offline
The /etc/shadow file contains the hashed passwords for all users on the system. If a low-privilege user can read this file, they can copy the password hashes and attempt to crack them offline using tools like John the Ripper or Hashcat. This directly enables an offline password cracking attack, as the tester can brute-force or use dictionary attacks against the hashes without needing to interact with the live system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pass-the-hash
Why it's wrong here
Pass-the-hash is a lateral movement technique that extracts NTLM password hashes from Windows memory (LSASS) or the SAM hive and replays them in the NTLM challenge-response authentication handshake without ever knowing the plaintext password. The /etc/shadow file contains Unix crypt hashes (e.g., SHA-512 or yescrypt) plus a salt, which are verified through the crypt() function rather than a network challenge-response protocol. Simply replaying a shadow hash over SSH or su would fail because Linux does not implement NTLM-style hash pass-through. An attacker would still need to crack the hash offline to obtain the plaintext password for any interactive login.
- ✓
Password cracking offline
Why this is correct
Reading /etc/shadow is effectively game over for the compromised account's password: the file stores salted, one-way hashes of every local user's password, and an attacker can copy those hash strings directly to a cracking tool. John the Ripper's 'unshadow' utility combines /etc/passwd and /etc/shadow entries, or Hashcat can ingest the raw hash lines, enabling dictionary, rule-based, hybrid, or brute-force attacks at billions of guesses per second on GPU hardware. Even strong passwords fall to hybrid or mask attacks if the password policy is weak, and reused credentials often appear in prior breach data. Because the hashes are fully in hand, this offline cracking approach is the primary and most practical path after obtaining /etc/shadow.
- ✗
LLMNR poisoning
Why it's wrong here
LLMNR poisoning (e.g., using Responder) is a Windows network attack that listens for Link-Local Multicast Name Resolution queries and replies with spoofed responses to trick victim hosts into sending NTLMv2 authentication challenges to the attacker. It operates entirely on the wire, capturing hashes by impersonating file servers, printers, or other network services, and has no relationship to local file contents. The /etc/shadow file stores credential material at rest, not network traffic, and Linux does not use LLMNR for name resolution—it relies on DNS or mDNS. Thus, having read /etc/shadow would give no advantage to an attacker attempting LLMNR poisoning.
- ✗
Kerberoasting
Why it's wrong here
Kerberoasting is an Active Directory attack in which a domain-authenticated user requests Kerberos service tickets (TGS-REP) for accounts that have Service Principal Names (SPNs), then extracts the encrypted ticket and cracks the service account's password offline. This requires Kerberos infrastructure, a Ticket-Granting Ticket, and an SPN to target—none of which exist on a standalone Linux server. The local /etc/shadow hashes are unrelated to Kerberos ticket encryption, and the attack does not involve reading local authentication files. Consequently, Kerberoasting is completely inapplicable after compromising a Linux host where the attacker only has access to the shadow file.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
John the Ripper
John the Ripper is a free and open-source password cracking tool used by security professionals to test password strength and by attackers to guess credentials.
Key term
Hashcat
Hashcat is a powerful password recovery tool that uses various attack methods to crack password hashes, widely used by security professionals and penetration testers.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.