EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) (CPENT) — Questions 76–150

Writing msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer object grants a controlled account resource-based constrained delegation, letting it impersonate any user to that host's service. Combined with GenericAll's write access, the operator obtains a service ticket as a privileged user, then executes code via SMB or WinRM on the target.

With GenericAll on a computer object, the operator can modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute to set up Resource-Based Constrained Delegation. This allows the operator to impersonate any user to that computer, achieving administrative access. This is a direct abuse of the permission granted.

RC4 is the weakest encryption type for Kerberos tickets and is easier to crack because it uses the NT hash of the service account as the key. Requesting RC4 tickets increases the likelihood of successful offline cracking, especially if the service account password is weak. This is why attackers often downgrade to RC4 when possible.

Netcat opens a raw TCP connection to port 21 and prints the server's greeting banner immediately, revealing the FTP software and version without sending USER or PASS credentials. This satisfies the requirement to enumerate without an interactive login session.

The --data-length option appends random junk bytes to Nmap's generated packets, altering payload signatures so the IPS's signature-based detection no longer matches standard probe patterns. This satisfies the requirement to evade detection while still performing the scan.

If the Cisco ASA firmware is outdated and vulnerable, exploiting a known vulnerability could allow you to bypass ACLs, gain shell access, or tunnel traffic. This directly addresses the scenario's hint about older firmware. Unlike evasion techniques, exploiting a vulnerability can provide a direct path to the internal web server by compromising the firewall itself.

The -D decoy option inserts forged source IP addresses into scan packets, so packet inspection filters cannot reliably attribute traffic to the real scanner. This header alteration directly satisfies the stem's requirement for evading inspection filters by modifying packet headers.

The `-upn` flag injects an arbitrary subjectAltName during enrolment, exploiting the ENROLLEE_SUPPLIES_SUBJECT flag on a Client Authentication template. Certipy's `req` command submits the CSR to the CA, returning a certificate bearing administrator's UPN, which is then usable for Kerberos PKINIT authentication as that high-privileged account.

SPAN mirrors copies of frames from the target switch port to an analysis port, leaving the original traffic path untouched. This satisfies the stem's passive, non-disruptive constraint, unlike active interception via ARP spoofing or an inline tap that would alter the legacy application's communications.

ClusterRole verbs get, list and watch on secrets, bound cluster-wide, let any holder read secrets in every namespace. Stealing the default service account token via an app flaw gives the external attacker that API access, satisfying the cluster-wide dump objective.

LSASS (Local Security Authority Subsystem Service) caches credential material, including NTLM hashes and Kerberos tickets, for users who have logged on interactively or via RDP. If a domain administrator has logged into the workstation, their credentials may reside in LSASS memory. Tools like Mimikatz or ProcDump can extract these, making it the most likely location for the domain admin hash.

Packet fragmentation splits TCP headers across multiple IP fragments, so signature-based IDS sensors inspecting individual packets cannot match the full probe pattern. This directly satisfies the scenario's requirement to obscure scan payloads during an Nmap port scan, since reassembly is needed before detection logic can identify the scan.

Hardcoded or static pairing PINs such as '0000' let an attacker capture the pairing exchange and brute-force the six-digit key offline, then impersonate the sensor or hub. This weak-credential flaw directly undermines BLE pairing confidentiality in IoT medical devices.

Key Vault secrets often store credentials such as service principal secrets or connection strings. If the managed identity can read secrets, the tester can extract a secret that contains credentials for a more privileged identity. Using those credentials, the tester can authenticate and escalate privileges within the Azure environment.

WinRM provides native remote command execution over HTTP/S via the WS-Management protocol, letting an operator run PowerShell or cmd sessions on target hosts without deploying agents. It satisfies the stem's constraint of using built-in Windows administrative protocols for lateral movement, since WinRM ships enabled on modern Windows Server systems.

Modbus/TCP has no built-in authentication, and Write Single Coil (0x05) lets an attacker change a coil state directly. Targeting an unused coil address demonstrates the lack of authentication and the write capability while avoiding disruption to the production line's active control logic. This is a controlled proof of concept appropriate for a CPENT engagement where operational safety must be preserved.

NTLM authentication proves knowledge of the hash itself, not the plaintext, so possessing the target account's NTLM hash lets the attacker inject it into an authentication exchange and impersonate the user. Without that hash, no valid NTLM response can be computed, so the requirement is fundamental.

Dig issues an AXFR query directly against a nameserver and reports whether the zone transfer succeeds, making it the purpose-built tool for identifying servers permitting unauthorised transfers. This satisfies the requirement to test zone transfer vulnerabilities.

ticketConverter.py is a script from the Impacket suite that converts between .kirbi and .ccache formats. It is the standard tool for this purpose in AD penetration testing, allowing an operator to take a TGT extracted from Windows (often in .kirbi format) and convert it for use with Impacket tools like psexec.py or wmiexec.py that expect a .ccache credential cache.

The combination of ec2:RunInstances and iam:PassRole lets the user launch an instance with an existing privileged role attached, then retrieve its temporary credentials from the instance metadata service. iam:CreateRole is unnecessary here, but PassRole is the pivot that satisfies the escalation constraint.

Running wafw00f sends crafted requests and analyses response headers, status codes and payload reflections to fingerprint the specific WAF vendor, satisfying the requirement to identify whether a WAF sits in front of the web server. Its signature database distinguishes products such as Cloudflare, Akamai and Imperva from unprotected responses.

Embedding long-lived cloud provider API keys in publicly accessible repositories exposes credentials to anyone, enabling unauthorised access and resource abuse. This directly violates the stem's requirement to identify a critical logging and monitoring security deficiency, since leaked keys bypass audit controls entirely.

enum4linux queries Windows and Samba hosts through MS-RPC interfaces transported over SMB, using calls such as SAMR and LSA to enumerate shares, users, and domain details. This RPC-over-SMB mechanism retrieves granular information without brute-forcing credentials, avoiding account lockout.

Running sudo -l lists the invoking user's permitted sudo commands and their restrictions. Any allowed command that can spawn a shell or edit privileged files becomes an escalation path, directly exposing misconfigured sudoers entries on the gateway.

ProcDump captures a full process memory snapshot of lsass.exe without terminating it, satisfying the requirement to dump credentials safely while the service keeps running. Invoked as `procdump -ma lsass.exe`, it writes a minidump that Mimikatz or Pypykatz can later parse offline for cached hashes and plaintext passwords.

A privileged scheduled task running a script writable by standard users lets any low-privileged account replace the script's contents, which then execute as administrator at the next trigger. The weakness is the writable executable referenced by the task, not the task's own configuration.

Nmap's industrial NSE scripts probe protocol-specific fields: modbus-discover enumerates Modbus devices, s7-info fingerprints Siemens S7 PLCs, and enip-info queries EtherNet/IP identity objects. These fingerprint ICS devices by parsing native protocol responses rather than generic TCP banners.

Pass-the-Hash exploits NTLM's challenge-response authentication, where the hash itself serves as the credential, so no plaintext is needed. Impacket's psexec.py injects that hash via SMB to create a service on the remote host, spawning a shell. This directly satisfies the stem's constraint: lateral movement using only the captured local administrator NTLM hash.

U-Boot's `setenv bootargs` rewrites the kernel command line passed at boot, and appending `init=/bin/sh` replaces the default init process with a shell running as root. This directly satisfies the stem's requirement to override kernel boot arguments via the serial console and spawn a root shell.

KRB5CCNAME tells Kerberos client libraries which credential cache file to use. Exporting it to point at the stolen .ccache lets Impacket tools such as psexec.py authenticate with the TGT for lateral movement, satisfying the stem's requirement.

ESC1 requires a template flag permitting the requester to specify subjectAltName plus enrolment rights for low-privileged users, combined with a client authentication EKU. That combination lets any enrolled user request a certificate impersonating a domain administrator.

AddMember edges represent the specific access right to add principals to a group, which directly satisfies the stem's requirement for modifying group membership. BloodHound draws this edge when a user holds WriteMembers or GenericWrite over the target group, enabling privilege escalation through group population.

Appending a public key to ~/.ssh/authorized_keys grants the attacker passwordless SSH access under the compromised account, surviving reboots and password changes. This satisfies the persistence requirement by establishing durable remote access without needing to re-exploit the initial vulnerability, and it often evades detection since legitimate administrators use the same mechanism.

ICMP Port Unreachable is generated by the target's IP stack when no application is bound to that UDP port. Receiving it confirms the host is reachable but nothing is listening on 123, distinguishing a closed port from a filtered one, where a firewall would silently drop the probe.

SCP tunnels file transfer through SSH, encrypting the archive in transit by default without extra configuration. This satisfies the stem's requirement for encrypted exfiltration using a standard tool, since SSH provides confidentiality and integrity out of the box on the compromised Linux host.

Modbus/TCP lacks authentication, so an attacker reaching the broker can issue write function codes to coils and holding registers, altering actuator states and setpoints directly. This satisfies the stem's condition of improper segmentation and firewall rules.

Living off the Land means abusing binaries and tooling already present on the host, avoiding dropped malware. PowerShell is native to Windows, and executing a script in memory via download-and-execute leaves no file on disk, matching the LotL definition.

Rubeus with the `asreproast` action queries LDAP for user objects whose userAccountControl attribute has the DONT_REQ_PREAUTH bit (0x400000) set, then requests AS-REPs for them. It runs under the invoking unprivileged domain user's own token, satisfying the stem's no-elevated-rights constraint.

An Azure AD application with a client secret can be used to authenticate as a service principal. If an attacker compromises a global admin, they can create or modify an application and add a long-lived secret. This secret remains valid even after the user's password is changed, providing persistent access to resources the application is granted.

Neo-reGeorg tunnels TCP traffic inside HTTP/HTTPS requests, so it traverses the permitted port 443 egress path that SSH forwarding cannot use. It encrypts the tunnel payload and supports full-duplex SOCKS-style proxying, satisfying the stem's constraint of restricted SSH forwarding with only outbound HTTPS allowed.

Binwalk signatures compressed file systems, bootloaders, kernels and other embedded structures directly within the raw firmware image, listing offsets without extraction. That satisfies the quick identification constraint, unlike hexdump or strings, which reveal no structured layout.

Airodump-ng passively captures 802.11 management frames, including beacons and probe requests, revealing access points and associated clients across the 2.4 GHz band. This satisfies the auditor's need to monitor and dump management frames during the wireless survey.

A rogue DHCP server answers client requests before the legitimate server, handing out attacker-controlled gateway and DNS settings. This satisfies the stem's interception objective, letting the tester position themselves as man-in-the-middle for all subsequent client traffic.

The Xmas scan sets FIN, PSH and URG simultaneously, a flag combination RFC 793 requires closed ports to answer with RST while open ports silently discard. This satisfies the stem's constraint of evading SPI firewalls that drop invalid flag combinations.

Kerberoasting begins by enumerating accounts with registered Service Principal Names, since each SPN-bearing account has a service ticket encrypted with its password hash that can be requested and cracked offline. This targets the SPN linkage that makes the attack possible.

Azure VMs expose the Instance Metadata Service at 169.254.169.254. The managed identity token endpoint is /metadata/identity/oauth2/token, which returns an OAuth2 token for the specified resource. By requesting a token for the Key Vault resource, the tester can authenticate to Key Vault using that token.

A malicious LKM loads into kernel space, surviving reboots once configured to load at boot, and hooks system calls or patches kernel memory to hide processes, files and connections. This matches the requirement for reboot-surviving, stealthy kernel-level persistence on Linux.

QEMU_LD_PREFIX points QEMU-user at the emulated root filesystem, so the dynamic linker resolves shared libraries from that directory tree instead of the host. Exporting it satisfies the constraint of supplying missing library dependencies, preventing the segmentation fault during MIPS binary execution.

UART transmits asynchronously over two data lines: one for transmit, one for receive, with no shared clock. Ground and 3.3V on the outer pins supply reference and power, while the fluctuating middle pins carry serial data during boot, matching UART's idle-high signalling.

BACnet Who-Is is a broadcast datagram sent to UDP port 47808; every device on the subnet replies with an I-Am containing its device instance and address. This discovers devices without prior IP knowledge, unlike unicast or directed queries.

ARP ping discovery operates at layer 2, broadcasting ARP requests to resolve IP addresses to MAC addresses on the local subnet. It never touches TCP or UDP, satisfying the requirement for fast, quiet host discovery without port traffic.

RIP advertises routes in cleartext with no authentication by default and caps valid hop counts at 16, so an attacker can inject spoofed updates to poison the routing table. That matches the insecure implementation described in the audit.

A Silver Ticket is forged with the service account's NTLM hash and encrypted directly with that key, so the KDC is never contacted. This satisfies the scenario's advantage: no TGT request reaches the Domain Controller, avoiding that associated detection.

DCSync abuses the Directory Replication Service Remote Protocol, impersonating a Domain Controller to request password hashes via replication. This extracts credentials over the network without touching LSASS on the Domain Controller, satisfying the constraint of avoiding direct memory dumping.

AWS PrivateLink creates unidirectional elastic network interfaces in each VPC, letting service consumers reach providers over private IP addresses within the AWS backbone. This satisfies the stem's requirement for private connectivity across separate VPCs without internet exposure, unlike VPC peering, which demands non-overlapping CIDRs and transitive routing.

The smb-vuln-ms17-010 NSE script performs a non-destructive check by sending crafted SMBv1 requests and inspecting the response, confirming EternalBlue exposure without triggering the crash that exploitation would cause. This satisfies the requirement to test safely.

ticketer.py forges Kerberos tickets offline from a supplied key or hash, including Golden Tickets built from the KRBTGT hash, then writes the ticket to a ccache file for injection. It requires no live domain controller interaction.

-sn performs host discovery only, sending ICMP Echo Requests (plus TCP SYN, ACK and ARP probes by default) and skipping port scanning entirely. This identifies live hosts with fewer connection attempts, reducing alerts from traditional port scanners while completing the sweep.

Nbtscan sends NetBIOS name service queries (UDP 137) across an IP range, returning registered names, workgroup/domain membership and logged-in usernames from legacy Windows hosts. This directly satisfies the stem's requirement for a NetBIOS name query scan, unlike SMB-focused enumeration tools that cannot retrieve NetBIOS name table entries.

Nmap's -O flag enables OS fingerprinting by comparing the target's TCP/IP stack responses, such as initial window size and TTL, against its signature database. This directly satisfies the requirement to identify the operating system from stack behaviour.

The smb-os-discovery script queries SMB to extract the operating system, computer name and domain, directly satisfying the requirement to gather OS details. Its queries are non-intrusive, making it safe for identifying live Windows hosts running SMB services.

Tunnelling data inside DNS queries exploits the sole permitted egress channel: port 53. Because the firewall allows only DNS to internal resolvers, encoding stolen data in TXT record requests to an attacker-controlled authoritative domain lets those resolvers recursively forward queries outward, returning responses through the same permitted path.

Shadow Credentials abuse requires the ability to write the msDS-KeyCredentialLink attribute on the target account. WriteProperty scoped to that attribute, GenericAll, or GenericWrite all grant this, letting the attacker inject a rogue key credential and later authenticate via PKINIT as the victim.

The `iam:PutUserPolicy` action with a `*` resource lets the user write an inline policy directly onto their own IAM identity. Because inline policies are evaluated immediately and can grant any action, the tester can inject `AdministratorAccess`-equivalent permissions, escalating from limited rights to full account control without needing existing admin privileges.

The create verb on pods/exec authorises spawning exec subresources, letting the holder run arbitrary commands inside any pod in the cluster, which enables credential theft, service account token abuse and potential node or cluster compromise.

dnscat2 is a tool designed for DNS tunneling, allowing data exfiltration over DNS queries and responses. It encodes data in subdomains or TXT records, and since DNS traffic is allowed, it can bypass egress filtering. Using a custom domain gives the attacker control over the authoritative DNS server, enabling reliable data transfer. This method is stealthy because DNS is often less monitored.

Granting allUsers the Storage Object Viewer role binds the bucket to the public internet, letting anyone read its objects without authentication. Removing that IAM binding, along with any allAuthenticatedUsers entry, restores private access; this directly addresses the anonymous exposure described in the stem.

Traceroute sends packets with successively larger TTL values; each router that decrements the TTL to zero returns an ICMP time-exceeded message containing its address. Collecting these replies reveals the path and the router interfaces that respond, directly showing whether the perimeter leaks internal topology. It is the standard technique for the requirement described.

Because the SUID binary resolves commands via relative paths, it inherits your PATH. Prepending a directory containing a malicious script named after the invoked command causes the root-privileged binary to execute your code, yielding escalation without needing to modify the binary itself.

Exposing RDP to Any or Internet invites brute-force and exploitation attempts. Restricting the NSG source to trusted administrative networks, or routing management through Azure Bastion, removes public exposure while preserving administrative access to the virtual machine.

uname -r prints the running kernel's release string, exposing the exact version needed to match against Dirty COW's affected ranges. This satisfies the requirement to confirm the precise kernel build before selecting a privilege escalation exploit.

Adding a controlled account to Domain Admins or Enterprise Admins grants it persistent, highly privileged domain-wide access through AD group membership, which survives reboots and credential changes. This abuses native directory authorisation rather than host-level mechanisms, matching the AD-based persistence requirement.

Disabling the 'Allow Blob public access' property at the storage account level blocks all anonymous read requests, overriding any container-level public access settings. This directly satisfies the auditor's finding by removing anonymous access to containers and blobs, ensuring authentication is required for every request.

Winrs uses the WS-Management protocol over HTTP on port 5985, which the stem confirms is open, so it bypasses the blocked SMB ports that PsExec requires. It establishes an interactive remote shell on the domain controller without needing to upload a service binary, satisfying the firewall constraint directly.

Delegation lets a service impersonate users to downstream resources. Unconstrained delegation caches TGTs in memory, harvestable via credential theft, while constrained delegation can be abused through protocol transition to reach services the attacker otherwise could not, enabling lateral movement across the domain.