CCNA Attacks and Exploits Questions

Server-Side Request Forgery (SSRF) is a direct impact of XXE because an attacker can define an external entity that points to an internal URL, forcing the server's XML parser to fetch that URL on the attacker's behalf. This lets the attacker scan internal network segments, access cloud instance metadata (e.g., IAM credentials), or interact with internal services that are not exposed externally. The server's outbound request is the core of the XXE attack, making SSRF a primary and correct classification.

ARP spoofing is the quintessential man-in-the-middle technique: the tester crafts forged ARP replies that poison the target's ARP cache, mapping their MAC address to the default gateway's IP. All outbound traffic is then forwarded to the attacker's machine, which can passively capture it (e.g., creds, sessions) or actively manipulate contents before relaying to the true gateway. This enables rogue access, session hijacking, and traffic injection while remaining invisible to the victim. Because passive sniffing on switched networks is normally nullified by MAC tables, ARP poisoning re-opens that interception path.

GraphQL introspection is enabled by default in many implementations, and querying the __schema field returns the entire schema, including types, fields, and arguments. This is the first step to map the API and identify sensitive queries or mutations that can be abused to extract data.

Reflected XSS is correct because the tester's parameter value is immediately included in the server's HTTP response without proper output encoding, creating a non-persistent vulnerability. An attacker can craft a malicious URL that, when clicked, causes the victim's browser to execute the injected script in the context of the application's origin. The immediate echo back in the response exactly matches the definition of reflected XSS, distinguishing it from stored XSS, which involves server-side persistence, and DOM-based XSS, which never involves the server response.

The -D flag enables dynamic port forwarding, establishing a SOCKS4/5 proxy on local port 1080. All traffic sent to this proxy is relayed through the SSH server, which can then reach any host in the server's network. This is the correct way to pivot, as it provides a flexible proxy that supports arbitrary destination addresses.

SMB signing cryptographically protects the integrity of SMB communications. If signing is enforced on the target server, the relayed authentication attempt will fail because the attacker cannot produce a valid signature. Disabling SMB signing on the target is therefore the single most critical prerequisite for a successful NTLM relay to SMB. Without it, the relayed credentials are rejected regardless of other factors.

DOM-based XSS is the correct answer because the vulnerable data flows from a DOM source (such as location.search, document.referrer, or window.name) to a dangerous DOM sink (like innerHTML, document.write, or eval) entirely within the browser's JavaScript execution context. The server response is static and unchanged; the malicious payload never travels through the server-side processing. The attack is triggered purely by how the client-side script handles attacker-controlled input, making it distinguishable from reflected or stored variants.

Pass-the-hash is the correct answer because it directly uses the NTLM hash of a user's password as a credential to authenticate to remote services. In NTLM authentication, the hash itself is the secret, so an attacker who captures or extracts the hash can forge authentication requests without knowing the plaintext password. Tools like Mimikatz inject the hash into memory to obtain access, making this a direct hash-based authentication attack.

A UNION statement in SQL combines the result sets of two or more SELECT queries, and a strict rule is that all queries must have the same number of columns. If the column counts differ, the database engine raises an error and the entire query fails, so the injected SELECT must exactly match the original query's column count. Attackers typically determine the correct number by using ORDER BY clauses or incrementally adding NULL columns until the UNION succeeds. This column-matching requirement is the fundamental constraint that must be satisfied for UNION injection to work.

SSRF via XXE occurs when an XML external entity is used as a URL in its SYSTEM identifier, causing the web server to make an HTTP request on behalf of the attacker. Since the request originates from the server, it can reach internal resources like 127.0.0.1 or RFC 1918 addresses, or access cloud metadata endpoints such as the AWS instance metadata service at 169.254.169.254. This effectively bypasses network segmentation and firewalls, turning a simple XML parsing flaw into a server-side request forgery.

XXE can be weaponized for denial of service through entity expansion attacks, most famously the 'billion laughs' attack, in which nested entity references recursively expand to an exponentially large amount of memory or CPU usage. A single small request can exhaust available memory, crash the XML parser, or hang the application, requiring no authentication. Because these payloads are simple XML documents, they can be repeatedly sent by an unprivileged attacker, making resource exhaustion a primary and direct impact of XXE.

-m 1000 is the correct Hashcat mode for NTLM hashes. NTLM hashes are computed as the MD4 digest of the user's password encoded in UTF-16LE, and the raw hash is a 128-bit value. This mode is commonly used when cracking password hashes dumped from the Windows SAM database or via tools like Mimikatz, as it targets the specific algorithm used for legacy Windows authentication. NTLM has a single MD4 round with no salt, which makes it extremely fast to crack on modern GPU hardware.

hashdump is a Metasploit post-exploitation command that directly extracts LM/NTLM password hashes from the Windows Security Account Manager (SAM) database. It typically requires SYSTEM-level privileges, often obtained after successful privilege escalation. The extracted hashes can be saved to a file for offline cracking or used directly in pass-the-hash attacks. This is the specific, built-in command designed for credential harvesting from a compromised Windows host.

Signature bypass using alg:none exploits a JWT header that sets the algorithm to 'none', which indicates to the parser that the token is unsecured and requires no signature. If the server's library does not explicitly reject 'none' tokens, an attacker can craft a valid-looking token with arbitrary claims simply by setting the header to { 'alg': 'none' } and omitting the signature segment. This effectively bypasses authentication and authorization checks because the token is accepted without any cryptographic proof of origin.

set RHOSTS is the correct command because it assigns the remote system's IP address or hostname that the exploit module will attack. This is a required option for essentially every remote exploit in Metasploit, and it can accept a single address, a CIDR range, or a list. Without RHOSTS, the module cannot initiate a connection to the victim, making all other payload settings meaningless.

In Hashcat, '-a 0' selects the dictionary attack, where each line from the wordlist is hashed and compared against the target hash. The '-r' flag specifies a rule file (e.g., best64.rule), which applies transformations such as case changes, appending/prepending characters, or leet-speak substitutions to each word, expanding the effective keyspace without altering the base wordlist. This combination is exactly what the tester needs to crack a hash while leveraging wordlist-derived passwords with rule-based mangling.

wmiexec is correct because it is an Impacket tool that leverages WMI (Windows Management Instrumentation) to remotely execute commands on a Windows target. It authenticates via NTLM hashes (pass-the-hash) and triggers a process through the Win32_Process.Create method, all over DCOM on port 135, making it the ideal choice for WMI-based lateral movement.

pth-winexe is a dedicated pass-the-hash utility that executes commands on remote Windows systems using NTLM hashes. It authenticates over SMB by injecting the hash directly into the authentication handshake, bypassing the need for a plaintext password. This makes it the most direct and specialized tool for lateral movement after hash acquisition.

If the low-privilege user is in the sudoers file with permissions to run vi as root, vi's interactive ex-mode command ':!/bin/bash' will launch a shell with root privileges. This works because vi passes the rest of the ex command line to the system shell, and since vi is running as root, the spawned bash inherits that elevated UID. This is a classic sudo misconfiguration and the intended escalation vector in this scenario.

PrintSpoofer is the correct tool for Windows 10/Server 2016 and later when the compromised account holds SeImpersonatePrivilege. It works by tricking the Print Spooler service into impersonating the user via its named pipe, then using that impersonated token to launch a SYSTEM process (e.g., cmd.exe). Unlike JuicyPotato's DCOM-based NTLM relay, PrintSpoofer doesn't rely on outdated COM handshakes, making it far more reliable on modern builds. Its name is misleading—it's not exploiting a vulnerability in the spooler, but abusing an advertised impersonation feature to elevate privileges.

PrintSpoofer is a local privilege escalation tool that abuses the SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege commonly granted to Windows service accounts. It leverages the Print Spooler service's named pipe to capture a SYSTEM token and then impersonates it, spawning a process as NT AUTHORITY\SYSTEM. This directly escalates the existing low-privilege shell to full system privileges on the same host, making it the correct choice for this scenario.

Ettercap is a dedicated MITM framework that implements ARP poisoning natively, allowing an attacker to redirect LAN traffic by sending forged ARP replies that map the target's IP to the attacker's MAC. It supports both interactive and plugin-based attacks, including session hijacking and packet filtering, making it specifically suited for ARP-based interception.

ARP spoofing is the correct technique for intercepting traffic on a local Ethernet network because ARP is stateless and lacks authentication. An attacker sends forged ARP replies to the target host and the default gateway, mapping the attacker's MAC address to the gateway's IP (and vice versa), which causes the target to send its frames to the attacker rather than directly to the gateway. This creates a man-in-the-middle position at the data-link layer, allowing the attacker to sniff, modify, or drop the traffic, and it is the foundational step for many subsequent attacks like session hijacking or credential theft.

When the ImagePath value of a Windows service is an unquoted string containing spaces, the Service Control Manager (or CreateProcess) interprets each space as a potential path separator and tries successive prefixes as executable candidates. For example, 'C:\Program Files\MyApp\Service.exe' leads Windows to attempt 'C:\Program.exe' and 'C:\Program Files\MyApp\Service.exe' in order. If an attacker can write to a directory earlier in the path, they can place a malicious binary named to match a truncated component, such as 'My.exe' or 'Program.exe', which then executes with the service's privilege level when the service starts. This is the exact privilege escalation mechanism caused by an unquoted service path.

Responder operates by listening for Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) queries, then spoofing responses to redirect authentication attempts to the attacker’s machine, thereby capturing NTLMv2 challenge-response hashes. This directly satisfies the stem’s requirement to poison those specific protocols during an internal test, unlike tools that target different layers or authentication mechanisms.

This is a classic GTFOBins technique: when `sudo` permits a user to run `find` as root, the `-exec` or `-execdir` actions can execute arbitrary commands with elevated privileges. For example, `sudo find . -exec /bin/sh \;` spawns a root shell because `find` runs as root under sudo. GTFOBins enumerates such built-in command-execution mechanisms for common binaries, making this the correct method to escalate from the low-privileged user.

Mode 1000 is the correct Hashcat mode for NTLM hashes, which are computed as MD4(UTF-16LE(password)). This mode directly tells Hashcat to treat the input as an NTLM hash and attempt password recovery using the correct algorithm, making it the only valid choice among the listed options for cracking captured NTLM hashes.

GTFOBins is the correct resource because it is a curated catalog of Unix binaries that can be abused to bypass local security restrictions, escalate privileges, or spawn shells — exactly what you need after running `sudo -l` and seeing a non-standard binary. It provides specific command snippets for each binary, categorized by functions like 'sudo', 'suid', and 'capabilities', so you can quickly match the binary you have access to with a privilege escalation vector. For a Linux penetration test, GTFOBins is the definitive reference for converting a misconfigured sudo entry into a root shell.

The getsystem command invokes Meterpreter's built-in token impersonation and named-pipe duplication attacks to shift the session's security context to NT AUTHORITY\SYSTEM. This is the direct privilege escalation step in a typical post-exploitation sequence, bridging a limited or admin token to full system-level access. It does not return or display hash values; instead, it grants the elevated rights required by later commands such as hashdump.

Installing an SSH authorized_key for the attacker is a Linux persistence technique that involves appending the attacker's public key to the target user's ~/.ssh/authorized_keys file. This permits the attacker to authenticate over SSH without a password, even after system reboots. It is stealthy because it requires no new process or scheduled task, blending in with normal user configuration files, and remains effective indefinitely unless explicitly removed.

The `route` command is the core Metasploit pivot primitive: `route add <subnet> <netmask> <session_id>` tells Metasploit's dispatcher to send any packets destined for that subnet through the specified session, typically a Meterpreter or shell session on a compromised host. This allows all built-in modules (scanners, exploits, auxiliary) to reach otherwise inaccessible internal networks via the session's existing connection. It is a manual, session-dependent routing entry, making it the correct classic answer for Metasploit-based pivoting.

If the binary a service launches resides in a folder writable by the low-privilege user, the tester can replace or overwrite it with malicious code. When the service restarts, Windows executes the attacker-controlled binary in the service's security context, typically SYSTEM, yielding privilege escalation. The writable path is the core enabling condition for binary replacement.

By changing the JWT header's alg parameter to 'none' (or variants like 'None' or 'NONE'), the tester instructs the server that no signing algorithm is used. If the server's token-handling logic does not strictly enforce an allowlisted set of algorithms, it may accept the token with an empty signature, effectively bypassing signature verification. This is the classic JWT 'alg none' attack, which directly manipulates the algorithm field rather than the key or secret.

This attack works by injecting a conditional clause that pauses the database response only when a predicate evaluates true, such as `IF(ASCII(SUBSTR((SELECT database()),1,1))>100, SLEEP(5), 0)`. Since the application never directly prints the query output, the tester infers each character by measuring response-delay differences, extracting data one bit or one character at a time without needing visible rows or error messages. It is the only technique among the choices that succeeds when the application suppresses both output and errors, which matches the scenario described.

SSRF is the correct answer because it directly exploits the server's ability to fetch URLs. An attacker can manipulate server-side requests to target internal addresses (127.0.0.1, 10.0.0.0/8) or cloud metadata endpoints, thus accessing resources that are not exposed to the internet. This makes SSRF the primary technique for reaching internal services from a vulnerable web application.

169.254.169.254 is the well-known link-local address used by major cloud providers (AWS, GCP, Azure, and others) to expose instance metadata, such as credentials, userdata, and network configuration. The address falls within the 169.254.0.0/16 APIPA block, making it non-routable and automatically reachable only from the instance itself. Because many cloud configurations historically permitted unauthenticated HTTP requests to this endpoint, it is the classic target for SSRF attacks, prompting cloud providers to introduce IMDSv2 with mandatory token-based access.

This is correct because Hashcat's -a 0 attack mode is the dictionary attack, where each word from a wordlist is tried as a password candidate. The -m parameter specifies the hash type (e.g., -m 0 for MD5), and the command relies solely on the supplied wordlist rather than generating combinations. Dictionary attacks are often the first choice in penetration testing because they exploit common and weak passwords efficiently.

Bettercap is a modular network attack framework with a built-in ARP spoofer module. By sending forged ARP replies, it can redirect traffic between a target host and the gateway, placing the tester in the middle of the conversation. This enables passive sniffing, session hijacking, and content injection, making it the correct choice for ARP-based MITM attacks.

Blind time-based SQL injection is the correct answer because it exfiltrates data without requiring any visible output, error message, or outbound network interaction. The attacker injects a conditional expression that triggers a database delay function, such as SLEEP(5) in MySQL, WAITFOR DELAY '0:0:5' in SQL Server, or pg_sleep(5) in PostgreSQL, when the condition evaluates true. By comparing the response time of true versus false conditions, the tester can pose boolean questions (e.g., 'Is the first character of the username A?') and iteratively reconstruct data. This works even when the application always returns the same generic page, making it the most reliable blind technique in a bandwidth-constrained test.

LLMNR, or Link-Local Multicast Name Resolution, is a protocol that Windows systems use to resolve hostnames on the local network when DNS queries fail. Responder works by listening for these multicast LLMNR queries and then spoofing a response, claiming to be the host the client is looking for. The client then attempts to authenticate to the attacker's machine, sending an NTLMv2 hash that the tester captures and can later crack or relay. This makes LLMNR the primary and correct protocol that Responder targets for hash capture in a penetration test.

Evil-WinRM is a purpose-built post-exploitation and lateral movement tool that wraps the WinRM protocol (Windows Remote Management), typically operating over ports 5985/5986, to provide an interactive PowerShell session on a remote Windows host. It authenticates with valid credentials (often obtained via hash, LM, or NTLM pass-the-hash) and is optimized for penetration testing, supporting local and SMB upload/download, script execution, and memory injection. This strongly aligns with lateral movement because it allows an attacker to move from a compromised host to another using standard Windows remote management services, making it a correct answer.

Sudo misconfigurations are a critical Linux privilege escalation vector because a user's sudo rights may allow running a command that can be leveraged to obtain a root shell, such as `sudo vim` or `sudo python -c 'import pty; pty.spawn("/bin/bash")'`. Misconfigurations include NOPASSWD entries, unsafe wildcard rules, or binary paths that can be replaced, and they directly expose unintended root-level execution. An attacker enumerates `sudo -l` to find such permissive entries.

XXE injection is correct because the vulnerability arises from the XML parser processing an external entity defined in the DOCTYPE declaration. An attacker can use a crafted XML payload with an entity like <!ENTITY xxe SYSTEM "file:///etc/passwd"> to read sensitive files, perform internal port scans, or trigger network requests. The root cause is the application's insecure handling of XML external entities, which is the defining characteristic of XXE.

Token impersonation using PrintSpoofer is a powerful privilege escalation technique that exploits the Print Spooler service's named pipe to manipulate an impersonation token and execute commands with SYSTEM privileges. The tool leverages the SeImpersonatePrivilege, which is typically granted to service accounts (e.g., IIS, MSSQL) but is not normally enabled for standard low-privilege users; however, when the current process holds this privilege, PrintSpoofer can request a token from the Spooler that represents the SYSTEM account and then impersonate it. This method does not require write access to system directories, domain credentials, or specific Group Policy settings, making it a direct and reliable path to SYSTEM escalation in this scenario, hence the correct answer.

Aircrack-ng is a suite of tools for wireless network auditing, and its aircrack-ng component is specifically designed to crack WEP and WPA/WPA2 PSK keys from captured handshakes. It uses a wordlist or brute-force to compute the pairwise master key (PMK) and verify it against the captured handshake. This makes it the correct tool for offline WPA2 PSK cracking in this scenario.

This is the correct answer because `-perm /4000` instructs `find` to locate any file where the set-user-ID (SUID) permission bit is set, regardless of other permission bits. In octal, 4000 corresponds specifically to the SUID bit, and the leading `/` means 'any of these bits' (here just 4000). When a binary has SUID set, it executes with the file owner's privileges, which makes SUID binaries a high-priority target for privilege escalation during a penetration test.

Kerberoasting requests a service ticket (TGS) for a registered SPN using any authenticated domain user. The ticket's encrypted portion is protected with the service account's long-term key, so the tester can extract it and crack it offline to recover the plaintext password. The stale, never-rotated password described in the scenario is exactly the condition that makes this attack productive.

A valid domain user account is the only prerequisite because Kerberos allows any authenticated domain user to request service tickets for any SPN via the TGS-REQ process. The TGS ticket returned is encrypted with the service account's password hash, so the attacker receives the ciphertext needed for offline cracking. This works with standard user privileges, making the attack low-cost and widely applicable once a single low-level account is compromised.

Time-based blind SQL injection is the correct answer because the tester can extract data by injecting conditional expressions that invoke database delay functions, such as `IF(condition, SLEEP(5), 0)` in MySQL or `WAITFOR DELAY '0:0:5'` in MSSQL, and then measuring the application's response time. Sqlmap automatically generates these payloads and uses a statistical threshold to distinguish between true and false conditions based on elapsed time, making it effective when no error messages or content changes are visible. This aligns perfectly with the scenario where the tester used sqlmap and observed time-based behavior.

'run' is the correct command to initiate a selected Metasploit exploit. It is also an alias for 'exploit', but 'run' is more versatile and works for both exploit and auxiliary modules. After setting required options like RHOSTS, RPORT, and PAYLOAD, the 'run' command executes the module and establishes the attack as configured. This command is essential in interactive use and in resource scripts for automation.

Reflected XSS is correct because the injected script travels in the HTTP request—for example, inside a query string, form parameter, or URL fragment—and the server immediately reflects it in the HTTP response without proper sanitization, causing the browser to execute it. Since the payload is not persisted, the attacker typically crafts a malicious link with the payload embedded and tricks the victim into clicking it, making non-persistent delivery the defining characteristic that matches the observed behavior.

When a SUID binary executes an external command using a relative path, such as calling system('ls') or execvp('ls', ...), it relies on the PATH environment variable set by the invoking user. An attacker can prepend a custom directory to PATH containing a malicious executable with the name of the expected command; since the SUID binary runs with root privileges, the malicious executable executes with root privileges, granting privilege escalation. The exploit succeeds only if the binary does not sanitize the environment (e.g., via secure_getenv) and uses a relative path instead of an absolute path. This is precisely the described scenario, making PATH manipulation the correct answer.

PrintSpoofer exploits SeImpersonatePrivilege by coercing a privileged process to connect to a named pipe it controls, then impersonating the resulting token to gain SYSTEM. It satisfies the stem's Windows local escalation constraint directly, unlike token-stealing tools that require existing high-integrity tokens or kernel exploits.

JuicyPotato is a refined implementation of the Rotten Potato attack that abuses SeImpersonatePrivilege by leveraging COM object activation. It uses a DCOM server to trigger an NTLM authentication using the machine account, then duplicates the resulting token to execute arbitrary commands with SYSTEM integrity. This tool made the attack practical on Windows Server 2016 and later, although some methods were patched in current builds.

Server-Side Request Forgery (SSRF) occurs when a web application fetches a user-supplied URL server-side without adequate validation, allowing the attacker to target internal hosts or cloud metadata services. In this scenario, the discovered endpoint likely accepts a URL and makes an HTTP request on behalf of the server, enabling the attacker to query 169.254.169.254/latest/meta-data/ and exfiltrate instance credentials. This matches the described behavior exactly: the server, not the user's browser, performs the request and returns the response to the attacker.

Accessing the AWS metadata endpoint at 169.254.169.254 is a textbook SSRF technique because this link-local address is reachable only from within the cloud environment and provides IAM security credentials, user-data, and instance configuration when queried. By making the vulnerable server request this IP, an attacker can steal cloud role credentials and pivot into the target's AWS account. This usage directly demonstrates SSRF's core characteristic: the server is tricked into fetching an internal resource on the attacker's behalf.

wmiexec is the correct choice because it directly uses Windows Management Instrumentation (WMI) to execute commands remotely without needing to upload a binary or create a service. It connects to the target's WMI service over DCOM (typically port 135) and invokes the Win32_Process.Create method, which makes it lighter and less likely to trigger service-specific detection rules. This direct API-level approach is what distinguishes it from wrappers and alternatives that rely on other protocols or artifacts.

In an alg:none attack, the tester modifies the JWT header to set the algorithm to 'none' and removes the signature from the token. If the server-side JWT library is misconfigured to accept the 'none' algorithm or fails to enforce an explicit algorithm allowlist, it will treat the token as valid without verifying any cryptographic signature. This effectively bypasses integrity checks and allows the attacker to forge arbitrary claims, making it a true algorithm confusion vulnerability.

The hashdump command is the correct choice because it directly extracts the NTLM password hashes from the SAM database on a Windows target when run in Meterpreter (typically after gaining SYSTEM privileges). It does this by copying the SAM and SYSTEM registry hives, decrypting the hash material with the SYSKEY from the SYSTEM hive, and presenting the hashes in a format ready for offline cracking. This command is specifically designed for dumping local user password hashes, fulfilling the tester's objective immediately. While it may require 'getsystem' first, hashdump itself is the actual dumping action.

PrintSpoofer directly weaponizes SeImpersonatePrivilege: it creates a named pipe and abuses the Windows Print Spooler service to make a SYSTEM-level client connect and impersonate its token. Meterpreter sessions running as a service account with this privilege can use PrintSpoofer to instantly spawn a SYSTEM shell. Unlike suggestion or enumeration tools, it performs the actual privilege escalation, so it is the correct choice for this scenario.

This is a JWT algorithm confusion attack where the attacker modifies the JWT header to set the `alg` field to `none`, removing the signature entirely. If the server's JWT library naively trusts the header and skips signature verification for `alg:none`, the attacker can forge arbitrary tokens and impersonate any user. Modern libraries should enforce an explicit algorithm allowlist, but misconfigured legacy systems remain vulnerable.

Kerberoasting begins with an authenticated user requesting TGS tickets for accounts that have SPNs registered, typically via tools like Rubeus or GetUserSPNs. The returned ticket is encrypted with the target service account's NTLM hash, so capturing these tickets yields a hash that can be cracked offline without any further network interaction. This step is the core of the attack because it obtains the password hash in an extractable format, and it works with only standard domain credentials.

In an algorithm none attack, the attacker modifies the JWT header to set 'alg':'none' and strips the signature segment, causing a vulnerable server to accept the token without cryptographic verification. Many JWT libraries only execute signature verification for asymmetric or HMAC algorithms and skip it entirely when alg is 'none' unless explicitly forbidden. This directly matches the observation of bypassing signature verification, so it is the correct answer.

PrintSpoofer is a local privilege escalation tool that exploits SeImpersonatePrivilege, a Windows privilege often held by service accounts. It leverages the Print Spooler service by creating a named pipe and tricking the spooler into connecting to it, allowing the attacker to impersonate a SYSTEM token. This enables command execution as SYSTEM without requiring remote credentials or network services.

Pass-the-Hash (PtH) allows an attacker to authenticate to remote systems by supplying the NTLM hash directly instead of the plaintext password. Because NTLM challenge-response authentication uses the hash as the shared secret, the hash is sufficient to impersonate the user without cracking it. This technique is commonly exploited against SMB and other NTLM-authenticating services, making it the direct and correct use of an obtained NTLM hash.

sysinfo is the correct Meterpreter command for system reconnaissance, as it displays the target operating system version, computer name, architecture (e.g., x64 or x86), and sometimes the Meterpreter payload type and domain. This information lets a penetration tester choose compatible exploits, payloads, or enumeration modules, and it is the first logical step after gaining a session.

hashdump is a Meterpreter command that reads the Local Security Authority (LSA) secrets and the Security Account Manager (SAM) registry hive from the target system, extracting the NTLM hashes of local user account passwords. It requires SYSTEM privileges to successfully read the SAM database, and it outputs the username, RID, LM hash, and NTLM hash for each account. This is the direct and intended method to dump password hashes from a Windows system, making it the correct answer.

PrintSpoofer is a token impersonation exploit that specifically leverages SeImpersonatePrivilege by creating a malicious named pipe server and then coercing a privileged process—commonly the Print Spooler service—to connect to it. The tool captures the resulting SYSTEM token and uses ImpersonateNamedPipeClient to execute a command with elevated privileges, giving the attacker a SYSTEM shell. It is designed as a modern replacement for JuicyPotato, working reliably on fully patched Windows 10 and Server 2019 builds where older Potato exploits often fail, making it the correct choice.

PrintSpoofer exploits SeImpersonatePrivilege by coercing a privileged process to authenticate against a named pipe it controls, then impersonating the resulting token to obtain SYSTEM. It targets Windows 10 and Server 2019+, where Rotten Potato techniques fail, satisfying the scenario's requirement for a working SeImpersonate escalation path.

When a SUID root binary executes /bin/bash, the kernel sets the effective UID to 0, but Bash normally resets the effective UID to the real UID to prevent privilege abuse. Running the binary with the -p flag forces Bash into privileged mode, preventing that reset and keeping the effective UID at 0. This yields a root shell with the user's real UID unchanged, making it the standard and direct privilege-escalation technique for SUID binaries that invoke a shell. The -p option is therefore the intended method to preserve the elevated privileges.

Mode 22000 is the dedicated Hashcat format for WPA/WPA2, accepting both EAPOL and PMKID data from the four-way handshake. It replaces the older 2500 and 16800 modes and handles the PBKDF2-SHA1 key derivation to test passwords offline. When converting a .cap file with hcxpcapngtool, the resulting .hc22000 file is fed into Hashcat with -m 22000. This is the correct mode for cracking WPA2 handshakes.