Attacks and Exploits practice questions

PsExec

Why wrong: PsExec requires administrative privileges and file sharing, which may not be available with the given group membership.

MS16-075 exploit

Why wrong: MS16-075 is a local privilege escalation exploit (token impersonation), not a lateral movement tool.

BloodHound

Why wrong: BloodHound is a reconnaissance tool for mapping Active Directory relationships, not for direct lateral movement execution.

{{7*7}}

Why wrong: This is a simple math expression used to confirm SSTI vulnerability, but it does not achieve code execution.

<script>alert('xss')</script>

Why wrong: This is a cross-site scripting (XSS) payload, not applicable for SSTI code execution.

${7*7}

Why wrong: This expression works in some template engines (e.g., Java) for simple math, but does not provide RCE.

Return-oriented programming (ROP) to bypass DEP

Why wrong: While ROP can bypass DEP, it is a broader technique. The more specific and straightforward method here is ret2libc, which also bypasses DEP and is simpler given no ASLR.

Heap spraying to inject shellcode

Why wrong: Heap spraying is used to bypass ASLR by filling the heap with shellcode; it does not bypass DEP.

Stack pivoting to redirect execution to a known location

Why wrong: Stack pivoting is useful when you control the stack pointer but does not directly bypass DEP.

Using URL encoding for the single quote (%27)

Why wrong: URL encoding is often decoded by the application before validation, so it may still be blocked.

Using double quotes instead of single quotes

Why wrong: SQL uses single quotes for string literals; double quotes are for identifiers and may not work in the same context.

Using a second-order SQL injection

Why wrong: Second-order injection requires another input to store malicious data, which may also be subject to the same filter.

Cross-Site Request Forgery (CSRF)

Why wrong: CSRF tricks a user into performing actions without their consent, not directly accessing objects by manipulating identifiers.

SQL Injection

Why wrong: SQL injection would involve injecting SQL commands, not simply changing a parameter value in a URL to access other records.

Cross-Site Scripting (XSS)

Why wrong: XSS involves injecting client-side scripts into web pages viewed by other users, not manipulating object references.

Inject shellcode into the buffer and redirect execution to it

Why wrong: DEP prevents execution from memory regions marked as non-executable, so this would fail.

Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode

Why wrong: This could work in theory but requires building a complex ROP chain and is more difficult than simple ret2libc. Since ASLR is off, ret2libc is simpler.

Use a heap spray to place shellcode at a known address and then trigger the overflow

Why wrong: Heap spraying is typically used to bypass ASLR or to ensure shellcode is at a predictable heap address, but it does not bypass DEP. DEP would still block execution of sprayed shellcode.

Injecting shellcode directly onto the stack and overwriting the return address to jump to it

Why wrong: DEP prevents execution on the stack; this technique would cause an access violation.

Using a return-to-libc attack to call system() with a command string

Why wrong: While ret2libc is a valid DEP bypass, it is limited to calling functions; full code execution may require more complex ROP chains.

Enabling the execute bit on the stack via a memory corruption primitive

Why wrong: This is extremely difficult and requires a separate vulnerability to modify memory protection; it is not a standard technique.

Exploit a kernel vulnerability to gain root

Why wrong: While kernel exploits can escalate privileges, they are more complex and less reliable than exploiting an SUID misconfiguration.

Impersonate the root user using sudo

Why wrong: The tester is not in the sudoers file and does not have the root password, so sudo cannot be used.

Preload a shared library using LD_PRELOAD

Why wrong: LD_PRELOAD is not effective for SUID binaries as Linux systems disable it for security reasons.

Brute force the password from the hash

Why wrong: While possible, brute-forcing is time-consuming and not the most efficient method compared to using the hash directly.

NTLM relay

Why wrong: NTLM relay involves intercepting and forwarding authentication attempts to gain access; it is not directly using an already obtained hash.

Kerberoasting

Why wrong: Kerberoasting targets service account TGS tickets, not NTLM hashes, and is used to crack service account passwords offline.

Simple shellcode injection on the stack

Why wrong: Shellcode injection requires the stack to be executable (no DEP), which is not the case here.

ASLR bypass techniques

Why wrong: ASLR is already disabled, so no bypass is needed; this technique does not address DEP.

Heap spraying

Why wrong: Heap spraying is typically used to bypass ASLR by filling memory with predictable shellcode, but it does not bypass DEP.

Brute force

Why wrong: Brute forcing would require guessing the password, which is inefficient and unnecessary when hashes are available.

Rainbow tables

Why wrong: Rainbow tables are used to crack hashes, not to authenticate directly; they require time to reverse the hash.

Keylogging

Why wrong: Keylogging would capture keystrokes on the current machine, but does not help authenticate to a remote server using existing hashes.

Kernel exploit

Why wrong: A kernel exploit could escalate privileges, but it requires a compatible kernel vulnerability and may be unreliable; using the writable cron script is simpler and more reliable.

SUID binary exploitation

Why wrong: Exploiting a misconfigured SUID binary is another method, but it may not be present; the cron script provides a direct, easy path.

Password cracking

Why wrong: Password cracking requires obtaining password hashes first; it is not directly applicable to this scenario.

Golden Ticket attack

Why wrong: A Golden Ticket requires the KRBTGT hash and grants domain admin access to all services, which is more than needed and requires higher privileges.

Pass-the-hash attack

Why wrong: Pass-the-hash is used for NTLM authentication, not for forging Kerberos tickets.

SMB relay attack

Why wrong: SMB relay captures and relays hashes to authenticate, but does not forge Kerberos tickets.

Pass-the-Hash

Why wrong: Pass-the-Hash uses NTLM hashes for authentication, not Kerberos TGTs, and does not provide the same level of persistence.

Silver Ticket

Why wrong: A Silver Ticket forges a service ticket (TGS) for a specific service, but requires the service account's hash, not the krbtgt hash.

DCSync

Why wrong: DCSync replicates credentials from a domain controller but requires domain admin privileges and does not directly use a krbtgt hash.

Domain Admin

Why wrong: Domain Admin privileges are not needed; a standard domain user account can request TGS tickets.

Local Administrator on the domain controller

Why wrong: Local admin on a DC is not required; the attack leverages standard Kerberos functionality available to all users.

Enterprise Admin

Why wrong: Enterprise Admin is a highly privileged role and not necessary for requesting TGS tickets.

Get-Service | Format-List Name,PathName

Why wrong: PowerShell Get-Service does not show the service path by default; it returns service status, not path.

sc query type= all state= all | findstr "SERVICE_NAME"

Why wrong: sc query lists service names only, not paths.

net start

Why wrong: net start lists running services, not paths.

Pass-the-hash

Why wrong: This attack uses captured NTLM hashes to authenticate, not by cracking tickets.

Golden ticket

Why wrong: This forges a TGT using the krbtgt hash, allowing domain-wide access, but does not involve cracking.

Silver ticket

Why wrong: This forges a TGS ticket using a service account hash, but does not involve cracking the hash.

Creating a local user account with UID 0

Why wrong: This can be detected by security tools and may be removed during maintenance.

Modifying the sudoers file to grant the tester sudo access

Why wrong: This relies on the existing user remaining; if the user is removed, access is lost.

Installing a kernel module rootkit

Why wrong: Complex to implement and may cause system instability or detection.

Use the binary to execute a command that changes the root password

Why wrong: While this could grant root access, it is destructive and may not be possible if the binary does not accept such commands directly.

Modify the binary's permissions to allow execution by any user

Why wrong: The binary is already executable; modifying permissions does not grant privilege escalation.

Use sudo to run the binary as root

Why wrong: The tester does not have sudo privileges for that binary; sudo requires explicit configuration.

Heap spraying to predict memory layout and inject shellcode

Why wrong: Heap spraying is often used to bypass ASLR but does not bypass NX; injected shellcode would still be non-executable.

Stack canary bypass using information leak

Why wrong: Stack canaries detect buffer overflows; bypassing them does not address NX or ASLR.

Format string attack to overwrite GOT entries

Why wrong: Format string attacks can overwrite memory but do not directly bypass NX; they may be used in combination, but ROP is the direct solution here.