EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) (CPENT) — Questions 1–75

SPI flash pins expose the raw firmware chip directly; attaching a programmer or logic analyser to the CLK, MOSI, MISO and CS lines allows testers to read or dump memory contents without booting the device, satisfying the scenario's requirement for extracting firmware or debug data from the PCB.

The LocalAdmin collection method queries each computer's local Administrators group via SAM-R, harvesting local admin mappings without needing Domain Admin rights. This directly satisfies the stem's constraint of gathering local admin rights non-privileged, since SAM-R reads rely on standard remote access rather than elevated directory permissions.

Mosquitto's Debian package installs its main configuration at /etc/mosquitto/mosquitto.conf, so inspecting that file reveals whether `allow_anonymous true` is set. This satisfies the analyst's need to verify anonymous access on the broker, since the daemon reads this path by default unless overridden with the -c flag.

The `cmdkey /list` utility enumerates all entries stored in Windows Credential Manager, displaying target names and types without revealing passwords. It directly satisfies the scenario's requirement to list saved credentials on the compromised host, running natively from the command line without additional tooling.

`klist` queries the local Kerberos credential cache and lists tickets currently held in the logon session, including the initial TGT and any service tickets. This directly satisfies the stem's requirement to view cached Kerberos tickets natively, without external tooling or elevated privileges.

The `iec104` display filter isolates IEC 60870-5-104 application-layer frames, matching the telecontrol traffic the hacker needs to inspect for unauthenticated control commands. Unlike generic TCP port filters, it decodes the APCI/ASDU structure, exposing command type identifiers and cause-of-transmission fields directly, so injected control commands can be identified without manual payload parsing.

Responder poisons LLMNR, NBT-NS and mDNS queries, answering the broadcast so the victim authenticates to the attacker and surrenders its NTLMv2 hash. This directly satisfies the stem's requirement to spoof the response and capture credentials.

Cron jobs in /etc/crontab or user crontabs execute automatically at scheduled intervals and survive reboots, satisfying the persistence requirement. They blend into legitimate administrative scheduling, so standard audits rarely flag them, unlike obvious rogue services or modified init scripts. This makes cron a low-noise, reboot-resilient mechanism.

Hping3 crafts custom IPv4 packets and supports the LSRR and SSRR source routing options, letting the attacker test whether routers honour them. This directly satisfies the stem's need to determine if traffic can be redirected via IPv4 source routing.

WMI executes commands and methods on remote Windows hosts over DCOM or WinRM using valid credentials, letting an attacker run processes on a server from a compromised workstation. This makes it a standard lateral movement technique within Active Directory environments.

The -L flag creates local port forwarding, binding port 8080 on the attacking machine and tunnelling traffic through the jump box to 10.0.0.5 port 80. This satisfies the constraint that the internal server is reachable only from the jump box.

IEC 61850 GOOSE frames are encapsulated directly in Ethernet with EtherType 0x88B8, distinguishing them from MMS (0x88BA) and SV (0x88BA/0x88B9 variants). This Layer 2 value lets the tester filter and identify GOOSE traffic on the substation network.

The ip route get command queries the kernel routing table for the path to a specific destination. It returns the outgoing interface and the source IP that would be used, and often the gateway. This directly answers which interface and next hop are used for 10.10.10.1, making it the most precise tool for the scenario.

The -sS flag performs a TCP SYN scan, sending SYN packets and never completing the handshake, so no full connection is logged. It satisfies the stealth requirement by omitting service version detection, which -sV would add and thereby generate noisy, easily detected probes.

AD CS certificate mapping lets an attacker with CA access issue a certificate tied to a domain account, enabling persistent PKINIT authentication. This survives password resets and evades traditional account-based detection, satisfying the requirement for stealthy persistence beyond standard user accounts or scheduled tasks.

The HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a common location for programs to run at system startup for all users. Since the tester has local administrator rights, they can modify this key to add a malicious executable that will execute each time any user logs on. This provides persistence across reboots and user logons.

Wireshark passively captures frames on the segment and decodes protocols such as HTTP Basic, FTP and Telnet, extracting plaintext credentials from the intercepted traffic. Its protocol dissectors parse authentication fields automatically, satisfying the requirement to capture and parse credentials obtained via the ARP-spoofed man-in-the-middle position.

Dnscat2 encapsulates arbitrary TCP traffic within DNS query and response records, so it traverses the egress filter that permits only port 53. It provides an encrypted command-and-control channel over the DNS protocol, satisfying the constraint of tunnelling TCP through DNS.

This payload is appropriate for a Linux target, which is typical for a web server running a CGI script. It establishes a reverse TCP connection back to the attacker and provides a Meterpreter session, allowing full control. The architecture (x86) is common, but you should verify the target architecture before use.

Firmadyne relies on a PostgreSQL database storing image metadata plus helper scripts that extract the firmware file system, providing the artefacts needed before emulation. This satisfies the stem's requirement for critical emulation and analysis steps.

Function-level keys authorise invocation of only the specific function they belong to, not the whole Function App or subscription. A leaked key therefore permits unauthenticated calls to that single HTTP-triggered endpoint, matching the stem's scope.

Without Kubernetes RBAC, AKS grants every authenticated request full cluster-admin authority, since no authorisation layer evaluates subjects against roles. Combined with Microsoft Entra ID integration being absent, no identity-based binding restricts actions, so any compromised pod or user reaching the API server executes arbitrary cluster-level commands.

Modifying an existing systemd service file is stealthier because it does not create a new file that might be noticed. Adding an ExecStartPre directive to a legitimate service allows the reverse shell to execute before the main service starts, blending in with normal system behavior. This approach is less likely to be detected by routine audits that focus on new or unusual files.

The enip-info Nmap script queries EtherNet/IP devices over TCP/44818, retrieving device identity and explicit messaging object data via CIP. That directly satisfies the requirement to enumerate explicit messaging objects and identity information on the industrial control network.

Ghidra's decompiler and static analysis engine disassembles extracted binaries and flags insecure calls such as strcpy, letting analysts trace buffer overflow paths without executing the firmware. It handles multiple architectures, matching the embedded Linux gateway binaries recovered by Binwalk.

LDAP signing, when disabled or set to 'Not Required', lets attackers relay NTLM authentication to the domain controller over unsigned LDAP, enabling rogue directory operations. Checking this setting on domain controllers directly identifies a primary NTLM relay exposure during an Active Directory audit.

The service account key file contains a private key that can be used to authenticate as the service account. By running gcloud auth activate-service-account --key-file=KEY_FILE, the tester can assume the identity of the service account. With the editor role, they can then access and modify most resources in the project, achieving full compromise.

SMB and NetBIOS enumeration exposes share names, user accounts, group memberships and host details via null sessions, requiring no authentication when legacy settings permit. This directly satisfies the scenario's need for protocols leaking sensitive domain or system information unauthenticated during Windows domain enumeration.

A Silver Ticket is forged with the target service account's NTLM hash, which encrypts the service ticket's PAC and signature. The KRBTGT hash is only needed for Golden Tickets, so the service account hash satisfies the stem's substitution.

Pass-the-Hash exploits NTLM's design, where the password hash itself authenticates without needing the plaintext. CrackMapExec submits the captured NTLM hash directly to SMB or other services, granting access to remote workstations, which matches the described post-exploitation behaviour.

mitmproxy terminates TLS using a custom CA certificate installed on the client, then re-encrypts traffic to the backend, letting the analyst read MQTT payloads. Disabled certificate validation means the client accepts the forged certificate without complaint.

Iodine encapsulates IPv4 traffic inside DNS queries and responses, tunnelling arbitrary TCP sessions through the permitted UDP port 53 path to an authoritative external server. This exploits the firewall's DNS exception, satisfying the constraint that only outbound DNS is allowed.

/etc/passwd lists local accounts with UID, GID, home directory and shell, letting the tester enumerate valid users for password spraying or privilege-escalation targeting. It satisfies the stem's credential-discovery goal, though password hashes now reside in the shadowed /etc/shadow, so it reveals usernames rather than secrets directly.

Nikto's database includes targeted checks for CGI scripts and OS command injection through GET parameters, directly matching the camera's embedded web server weakness. Unlike general-purpose scanners, its signature set focuses on web server misconfigurations and legacy CGI abuse, satisfying the stem's requirement for specific CGI and command-injection detection modules.

User consent settings permitting any user to grant permissions to third-party multi-tenant apps enable illicit consent grant attacks, where a malicious app obtains delegated access to mail, files and contacts without admin approval. This misconfiguration is a recognised Microsoft Entra ID attack vector.

Without LDAP signing enforced, the server accepts unsigned LDAP binds, so an attacker who captures or coerces NTLM authentication can relay those credentials to the domain controller over LDAP and perform directory operations as the victim. Signing would reject the relayed session.

DNP3's application layer carries function codes such as Read, Write, Select and Operate, which drive master-to-outstation control operations. These codes define the request semantics an analyst inspects when reviewing DNP3 traffic for unauthorised control commands.

smtp-user-enum connects to the mail server and issues SMTP VRFY, EXPN and RCPT TO commands, parsing responses to identify valid accounts. This matches the requirement to test susceptibility to email harvesting via those standard SMTP commands.

John the Ripper parses the extracted '/etc/shadow' hash offline and runs dictionary attacks against the root entry, directly addressing the stem's requirement to crack weak hashes from a mounted rootfs without touching the live gateway.

Publishing to actuator topics directly validates the unauthenticated broker's real-world impact: because MQTT lacks per-topic authorisation, anonymous clients can inject commands into control channels. This confirms the stem's constraint — anonymous publishing — by demonstrating whether physical machinery actually executes unauthorised instructions, proving genuine operational risk rather than theoretical exposure.

The mounted token authenticates to the API server as its service account, so sending it as a Bearer credential grants exactly that account's RBAC permissions. This satisfies the stem's constraint that automountServiceAccountToken exposes a usable credential inside the compromised pod.

getST.py exploits the S4U2Self and S4U2Proxy extensions to request a service ticket impersonating a privileged user, satisfying the Constrained Delegation scenario. It requires the delegated account's credentials or hash plus the SPN of the target service, returning a usable TGS for that service.

Listing `/etc/sudoers.d/` reveals drop-in sudoers files, which frequently hold custom or misconfigured privilege rules that the main `/etc/sudoers` file merely includes. Enumerating this directory exposes per-user or per-group grants, satisfying the stem's requirement to identify misconfigured sudo privileges on the Linux host.

Mimikatz is widely signatured, so Windows Defender detects its known binaries and memory patterns, generating alerts forwarded to the SOC. The primary operational risk is therefore detection and analyst response, not credential theft failure or system instability.

Bettercap supports selective ARP spoofing with configurable intervals, letting the attacker poison only targeted hosts and refresh mappings at low frequency rather than flooding repetitive replies. This satisfies the stem's constraint of evading alerts triggered by high-volume ARP traffic, while maintaining the man-in-the-middle position on the switched network.

Impacket's secretsdump.py authenticates as a privileged account and invokes the DRSUAPI DsGetNCChanges RPC call, impersonating a domain controller's replication request. This extracts password hashes remotely over the network, satisfying the constraint of harvesting credentials without executing any code on the domain controller itself.

Potato exploits abuse SeImpersonatePrivilege by coercing a privileged account into authenticating over a named pipe or COM server, then capturing that token via ImpersonateNamedPipeClient. PrintSpoofer and RoguePotato target the specific Windows token-impersonation mechanism this privilege grants, satisfying the stem's enabled SeImpersonatePrivilege constraint directly.

U-Boot's tftp and bootm commands fetch an attacker-supplied kernel over the network and execute it from RAM, bypassing any signed firmware in flash. This directly exploits the insecure bootloader and serial console access described, granting arbitrary code execution at the highest privilege level before the OS loads.

PetitPotam abuses MS-EFSRPC to trigger the DC's machine account authentication. Relaying that NTLM authentication to AD CS, which lacks NTLM relay protections by default, lets the attacker obtain a certificate for the DC machine account and then impersonate the domain controller via Kerberos.

The `-L` flag binds port 3306 locally, then tunnels traffic through the SSH connection to the pivot host, which forwards it onward to 10.0.0.50:3306. This satisfies the stem's requirement to reach an internal database behind a firewall, since only the pivot host needs routable access to the database server.

Modbus/TCP reserves TCP 502 as its registered port, and PLCs answer function-code requests there by default. Scanning 502 with tools such as Nmap's modbus-display script enumerates slave IDs and device identity, satisfying the native-protocol discovery requirement.

Setting the method's authorization type to None removes API Gateway's AWS_IAM signature check for that route, so requests reach the backend without SigV4 credentials. Any unauthenticated client can therefore invoke the method directly, bypassing the intended IAM authorisation.

Setting `init=/bin/sh` replaces the kernel's default init process with a shell, so the boot sequence drops straight into a root shell without starting the login daemon that prompts for a password. This directly satisfies the stem's requirement to bypass the root password authentication prompt on the unlocked meter.

Industrial IDS parsing Modbus, DNP3 and S7 detects malicious commands at the process level, where IT signature tools fail on proprietary protocols. This satisfies the stem's constraint of hardening SCADA against remote attacks by providing passive, protocol-aware monitoring that flags reconnaissance and manipulation attempts without disrupting fragile OT devices.

Function Code 16 writes multiple holding registers in a single Modbus transaction, allowing an attacker to alter controller configuration parameters. This directly satisfies the requirement to test unauthorised firmware or configuration write capability on the legacy DCS controller.

Netdiscover sends ARP requests directly, so it maps live hosts on the local Ethernet segment without TCP or UDP port traffic. ARP operates at layer 2, meaning no routable scan packets reach the subnet, satisfying the requirement to avoid noisy port scanning while quickly enumerating active Windows systems.

Mimikatz's sekurlsa::pth command performs pass-the-hash by starting a new process with the specified NTLM hash injected into its logon session. This allows the tester to access remote resources as the user without knowing the plaintext password. It is a standard technique for lateral movement in Windows environments when only the hash is available.

Utilities within mtd-utils such as jeffs2dump allow parsing and extracting JFFS2 compressed flash image formats.

A Golden Ticket is a forged TGT signed with the KRBTGT account's NTLM hash. With domain admin credentials, the operator can extract the KRBTGT hash and forge tickets that grant access to any resource. This backdoor remains valid even if the domain admin password is changed, as long as the KRBTGT hash is not reset. It provides long-term persistence.

Mimikatz parses memory dumps offline, extracting NTLM hashes and Kerberos tickets directly from LSASS structures without requiring live execution. This satisfies the stem's constraint of analysing an already-captured dump, since Mimikatz supports offline `sekurlsa` parsing against a saved file rather than only live memory.

The -sI flag specifies a zombie host for an idle scan, spoofing the source address so packets appear to originate from the zombie rather than the attacker. This satisfies the requirement to avoid noisy connections that host-based IDS would flag, since the attacker never sends packets directly to the target.

The cloud-platform scope grants OAuth access tokens covering every GCP API, so the default service account can call any service; IAM bindings are the only remaining restriction, meaning over-privileged tokens widen the blast radius if the instance is compromised.

This is correct because dedicated BACnet discovery tools like BACnet Scan or VTS (Visual Test Shell) actively send BACnet Who-Is and Read-Property requests to enumerate devices, their object types, and properties. They provide a comprehensive view of the BACnet network, which is exactly what the tester needs. These tools are designed for BACnet enumeration and can list objects such as Analog Input, Binary Output, and their present values.

ntdsutil is a built-in command-line tool that can create a snapshot of the Active Directory database (ntds.dit) and then mount it. Once mounted, the tester can copy the ntds.dit file and the SYSTEM registry hive to extract password hashes offline. It requires domain administrator privileges and is a native Windows utility.

DNS tunnelling encodes data within DNS query and response records, which traverse the firewall because outbound DNS is permitted. Tools such as dnscat2 or iodine provide that channel, satisfying the stem's constraint of exfiltrating the archive through a firewall allowing only outbound DNS traffic.

Hostapd-mana impersonates a WPA2-Enterprise access point and runs a rogue RADIUS server that relays the PEAP-MSCHAPv2 exchange, capturing the client's MSCHAPv2 challenge-response for offline cracking. This directly satisfies the requirement to harvest enterprise credentials from misassociating clients.

Enter-PSSession establishes an interactive PowerShell session over WinRM, allowing command execution on the remote host. It uses the WS-Management protocol and works when WinRM is enabled and the tester has valid credentials, making it a standard lateral movement technique.

Gobuster performs brute-force enumeration of web directories and files using wordlists, directly satisfying the need to uncover hidden administrative backup directories and configuration files on the embedded PLC's HTTP interface. Its directory mode sends rapid requests and reports valid paths by response status.

Comsvcs.dll's MiniDump export, invoked via rundll32, writes the lsass.exe process memory to a file using a signed Microsoft binary, avoiding third-party tooling and the alerts it attracts. This satisfies the need to harvest credentials legitimately.

Querying the IMDS endpoint at 169.254.169.254 with the required 'Metadata: true' header lets the SSRF retrieve an OAuth2 token minted for the function's managed identity. Because that identity holds Contributor over the subscription, the token grants control-plane access, satisfying the privilege-escalation objective without needing credentials.

KillerBee is a Python framework providing 802.15.4 packet capture, injection and Zigbee exploitation primitives, directly satisfying the stem's requirement for a tool specifically targeting Zigbee wireless security assessment rather than generic Wi-Fi or Bluetooth testing.

Without enforced ACLs, any authenticated client can publish or subscribe to arbitrary topics, including control channels for locks or medical commands. Verifying ACL enforcement confirms whether the broker restricts topic-level permissions, satisfying the check for unauthorised publish and subscribe access.

The exposed clock, data, ground and power pins form a serial debug bus such as SPI or I2C. Bus Pirate speaks those protocols directly, letting the tester read the internal flash chip and dump firmware for hardcoded key analysis, which the scenario requires.

Garbled UART output almost always indicates a baud rate mismatch between the terminal and the device. Trying standard speeds like 115200, 57600, 38400, or 9600 until readable text appears is the correct diagnostic step. This is non-destructive and quickly establishes a working console for further IoT firmware and bootloader analysis.

Hydra performs parallelised online dictionary attacks against network login services, including Telnet on port 23, accepting separate username and password lists. Its speed and protocol modules satisfy the stem's requirement for a fast credential-guessing tool.