EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) (CPENT) — Questions 151–225

The `-f` argument fragments packets into 8-byte blocks after the IP header, directly satisfying the requirement to split outgoing TCP packets into tiny fragments that evade signature-based IDS pattern matching. This is the standard Nmap fragmentation switch; alternatives like `--mtu` allow custom sizes but `-f` is the fixed 8-byte option.

TIA Portal stores project data in an .ap17 archive containing XML and binary files. The SystemBlock and hardware configuration XML files hold the PLC's protection level and the password hash used for access levels. Extracting and analyzing these files can reveal the hash for offline cracking, demonstrating credential exposure from the engineering workstation without touching the live PLC.

Security groups are stateful allow-lists; permitting 0.0.0.0/0 inbound on 3389 exposes RDP to the entire internet, enabling brute-force and BlueKeep-style exploitation. The stem asks for risky configurations, and unrestricted source ranges on management ports qualify.

A Null scan sends TCP segments with no flags set, a combination no legitimate stack produces. Stateful firewalls and hardened hosts drop such anomalous packets silently, so closed ports appear open|filtered and results become unreliable, directly violating the stem's constraint that anomalous flag combinations are dropped.

KNXnet/IP carries KNX telegrams over IP, and each telegram includes source, destination group address, and payload. Capturing and decoding these fields reveals which devices write to which group addresses, effectively mapping control relationships for lighting and HVAC. This passive method is appropriate for understanding the system without disrupting building operations.

Writing a startup script or service configuration into the GPO's SYSVOL share lets the compromised account push code execution to every machine or user the GPO applies to, including domain controllers, converting GenericAll over the GPO into domain-wide escalation.

`wevtutil cl <LogName>` clears a specified Windows Event Log directly through the Windows Event Log API, satisfying the requirement to erase activity records during post-exploitation. Unlike PowerShell's `Clear-EventLog`, it works from any command shell and needs no scripting host, so it functions even where PowerShell logging or constrained language mode would expose the tester.

The smb2-security-mode NSE script negotiates an SMB2 session and reads the signing-required field from the response, reporting whether message signing is enabled and required. This directly satisfies the stem's need to enumerate hosts vulnerable to NTLM relay across the subnet.

SeImpersonatePrivilege lets a process impersonate tokens from connections it can coerce. PrintSpoofer abuses the spooler service to trigger a named-pipe connection, capturing its SYSTEM token, satisfying the stem's requirement to reach NT AUTHORITY\SYSTEM from a service account.

Unconstrained Delegation lets a host cache any authenticating user's TGT in memory. An attacker who compromises that computer can extract those tickets and replay them, impersonating privileged users across the domain — far broader than constrained variants, which limit impersonation to specified services.

Tiered administration limits where credential material can be exposed, preventing attackers from acquiring KRBTGT hashes.

Disabling MFA for global administrator accounts removes the second authentication factor protecting the highest-privilege identities, so a compromised password alone grants full tenant control. Emergency maintenance windows do not justify this exposure; privileged access should use temporary credentials or break-glass accounts with compensating controls.

The Enterprise Admins group in the forest root domain holds forest-wide administrative rights, so compromising it grants control over every domain in the forest. Subordinate-domain Domain Admin rights alone do not confer Enterprise Admin privileges.

bacpypes is a Python BACnet stack whose whois.py and iam.py scripts broadcast Who-Is and parse I-Am replies, enumerating devices and object properties on the subnet. This directly satisfies the requirement for a BACnet-specific discovery tool.

Synchronisation rules and connector filters determine which objects and attributes reach Microsoft Entra ID. Reviewing them for misconfigured export rules or filtering gaps reveals whether the high-privilege group or its members can be surfaced despite the intended filter.

Outbound TCP 443 is almost universally permitted to support web browsing, so C2 traffic blends with legitimate TLS sessions. Encapsulating command channels inside HTTPS defeats egress filtering and inspection, directly satisfying the scenario's need for covert tunnelling through corporate firewalls.

-Pn disables Nmap's host discovery phase entirely, treating every supplied target as online and proceeding straight to port scanning. This satisfies the constraint of discovering live hosts while avoiding ping probes on a hardened target that suppresses ICMP replies.

Ptunnel encapsulates TCP connections inside ICMP echo request and reply payloads, so traffic passes egress filters that permit only ICMP. This satisfies the constraint of tunnelling TCP through ICMP to bypass the restricted network's filtering.

tasklist /svc enumerates running processes alongside their hosted services, revealing service accounts and privileged processes. This local enumeration satisfies the stem's requirement to gather host information for privilege escalation, exposing potential weak service configurations or credentials.

S3 ACLs granting public read and write let anyone list, download, and overwrite or delete bucket objects without authentication. This is a critical misconfiguration exposing data confidentiality and integrity, and is a classic cloud storage security failure.

GenericAll or WriteDACL over the Domain object grants full control or the ability to modify the domain's ACLs, letting an attacker grant themselves DCSync rights or escalate directly to Domain Admin, marking it as an immediate high-value path in BloodHound.

An unauthenticated NodePort-exposed dashboard with cluster-admin rights lets any external attacker reach the web interface and create workloads. Deploying a pod with hostPath or privileged settings grants node access, escalating to full cluster compromise as the scenario describes.

The trust policy lacks an ExternalId condition, letting any principal in the external account assume the role and exploit the confused deputy flaw. Adding a Condition block requiring 'sts:ExternalId' binds assumption to a shared secret, satisfying the stem's remediation requirement.

ESC8 abuses NTLM relay against AD CS HTTP enrolment interfaces — the certsrv/ web enrolment pages or the Certificate Enrollment Web Service — letting an attacker request a certificate as the relayed machine or user.

The `s7-info` NSE script queries Siemens S7 PLCs over the S7comm protocol on TCP port 102, extracting module identification, rack and slot configuration, firmware version, and hardware order numbers. This directly satisfies the stem's requirement for detailed device information via the S7 communication protocol against the S7-1200.

With Credential Guard enabled, plaintext passwords and NTLM hashes are protected, but Kerberos tickets may still be extractable from LSASS memory in some configurations. Mimikatz's sekurlsa::tickets /export exports tickets to .kirbi files, and kerberos::ptt injects a ticket into the current session, enabling lateral movement without the plaintext password. This is a standard pass-the-ticket technique that aligns with the scenario's constraints.

Aggressive mode transmits a hash derived from the pre-shared key in a form that can be captured and attacked offline. Ike-scan with --pskcrack extracts that material into a hash file compatible with cracking tools such as psk-crack or hashcat, allowing dictionary or brute-force recovery without further interaction with the device. This matches the requirement of offline PSK recovery from an exposed aggressive-mode service.

DNP3 Secure Authentication adds challenge-response exchanges for critical function codes, so inspecting captured traffic reveals whether the RTU and master negotiate authentication. This passive analysis determines whether authentication is enforced without sending any control commands. It is the safest way to assess authentication on a live ICS and directly answers the question about enforcement on critical functions.

Publicly Accessible plus 0.0.0.0/0 on port 3306 exposes MySQL directly to internet scanning and brute force. Restricting the security group to trusted CIDR blocks and disabling public accessibility removes that exposure, satisfying the stem's immediate-risk and control requirement.

With EDITF_ATTRIBUTESUBJECTALTNAME2 enabled, the requester can embed an arbitrary SAN in the CSR, and the CA copies it into the issued certificate. Because the template permits client authentication, the resulting certificate authenticates via PKINIT as the impersonated account, such as Domain Admin.

The lsadump::dcsync command in Mimikatz uses the Directory Replication Service (DRS) protocol to request replication data from a domain controller. With domain administrator privileges, this allows the tester to extract the KRBTGT account hash directly. This method is stealthy and does not require code execution on the domain controller itself, making it a preferred technique for Golden Ticket creation.

Scapy provides an IEC 60870-5-104 contrib layer (scapy.contrib.iec104) with APCI/ASDU classes, letting you craft and send raw application-layer frames over TCP. This satisfies the requirement to forge a circuit-breaker command ASDU at the application layer.

Snmpwalk issues SNMP GETNEXT requests using the default community string, walking the MIB tree to dump OIDs covering user accounts, routing tables and running processes. It directly satisfies the need to enumerate those objects over UDP port 161.

Metasploit's auxiliary/server/socks_proxy module runs inside an existing Meterpreter session, exposing a SOCKS4a listener that routes arbitrary TCP through the compromised host. This satisfies the requirement to pivot deeper without deploying separate tooling on the target.

Gobuster is purpose-built for directory and file brute-forcing, using a wordlist to fire rapid HTTP requests and flag valid responses by status code. Its dedicated dir mode satisfies the requirement to locate hidden administrative directories and backup files quickly, unlike general-purpose scanners or manual requests.

ntlmrelayx.py is designed to relay NTLM authentication to services like SMB, and when SMB signing is disabled on the target, the relay succeeds. It allows immediate code execution or command execution on the target without cracking hashes. This directly addresses the scenario's requirement for lateral movement via relay.

Recursive grep scans every file under squashfs-root, matching the literal PEM header that precedes hardcoded private RSA keys in firmware. The -r flag satisfies the requirement to search the entire extracted directory tree, while -n reports line numbers for locating each key within its file.

Telnet transmits all data, including login credentials, as unencrypted plaintext over TCP port 23, so any sniffer on the path captures usernames and passwords directly. This satisfies the stem's cleartext-credential constraint, unlike SSH or TLS-wrapped alternatives that encrypt the session.

Disabling HTTP web enrolment or enforcing HTTPS with Extended Protection for Authentication blocks NTLM relay to the CA web interface, directly mitigating ESC8. EPA binds the authentication exchange to the TLS channel, so a relayed credential cannot be reused against the enrolment endpoint.

An OT-tuned IDS passively monitors SCADA traffic and alerts on protocol anomalies and malicious command sequences, compensating for the absent encryption and authentication in legacy protocols by detecting exploitation attempts that those protocols cannot themselves prevent or log.

CAP_SYS_ADMIN plus a read-write cgroup v1 mount lets the tester write to the release_agent file, which the host kernel executes outside the container's namespace. This directly satisfies the escape precondition the stem describes, yielding host-level command execution.

The Microsoft Graph endpoint /identity/conditionalAccess/policies returns the collection of conditionalAccessPolicy objects, including their state (enabled/disabled), conditions, grant controls, and session controls. With a token possessing Policy.Read.All or Policy.Read.ConditionalAccess, a tester can enumerate exactly which policies exist, whether legacy authentication is blocked, and which users or apps are excluded, directly informing the attack plan.

When MQTT CONNECT packets lack a username and password, the broker may be configured to allow anonymous access. This means any client can connect without credentials and potentially subscribe to sensitive topics or publish malicious data. In IoT environments, this is a common misconfiguration that can lead to data leakage or device manipulation. Therefore, this observation indicates a significant security risk.

A publicly exposed API server on 0.0.0.0/0 without IP whitelisting or strong authentication lets unauthenticated attackers reach the control plane, enumerate resources and attempt privilege escalation. This directly satisfies the stem's high-risk cluster setup flaw criterion.

Because the sudo binary calls system() with a relative 'tar' path, the shell resolves it via PATH. Prepending a malicious directory containing a fake tar binary causes sudo to execute it as root, satisfying the stem's relative-path constraint.

AWS evaluates all applicable policies together, and any explicit Deny overrides every Allow, whether from an ACL, bucket policy or identity policy. The public-read ACL grant is therefore negated by the bucket policy's explicit Deny, so anonymous requests receive Access Denied.

The HKCU Run key is read by Explorer at each user logon and launches its listed programs automatically, giving per-user persistence without administrative rights, which satisfies the requirement for an automatic startup mechanism triggered during login.

Pass-the-Hash replays a captured NTLM hash directly, so the target must accept NTLM authentication; if NTLM is disabled by local or domain policy, the forged credentials are refused and lateral movement fails. Enabling NTLM in the local security policy therefore satisfies the attack's mandatory prerequisite.

Mounting the host root filesystem into a new container via the exposed socket grants direct read/write access to host files, effectively escaping isolation. The Docker daemon runs as root on the host, so any container it launches inherits that privilege.

A hostPath volume bind-mounts a host filesystem path directly into the pod, bypassing the container's isolated mount namespace. Mounting '/' or '/proc' exposes host files, credentials and kernel interfaces, enabling escape by writing to host binaries or reading sensitive host data.

MQTT, by default, does not encrypt traffic. If TLS is not configured, all data, including CONNECT packets with username and password, is sent in cleartext. This is the most likely reason for the exposure. The tester observed credentials in cleartext, which directly indicates the absence of TLS encryption on the MQTT connection.

Legacy OT protocols such as Modbus and DNP3 were designed without authentication, so any host on the segment can forge control commands. This satisfies the spoofing vector, letting an attacker issue unauthorised setpoints or commands to PLCs.

curl sends an arbitrary POST with a JSON body and explicit Content-Type header, letting the tester deliver the injection payload to the unauthenticated API endpoint. It satisfies the constraint of crafting a custom JSON request from the command line without needing a scripting language or interactive client.

Forging a Golden Ticket requires encrypting the forged TGT with the krbtgt account's key, so possessing its NTLM hash or AES keys lets the attacker mint valid tickets offline, granting domain-wide persistence without further authentication.

The wmic useraccount get name query reads the Win32_UserAccount class through WMI, returning local account names without extra tooling. It satisfies the enumeration goal, letting the tester identify high-privileged accounts for potential escalation on the compromised Windows host.

SharpHound is the official BloodHound collector, gathering ACLs, sessions and object relationships via LDAP and SMB into JSON for ingestion. It satisfies the reconnaissance requirement by automating collection that would otherwise need manual enumeration, mapping attack paths across the Active Directory domain.

S7comm Read Variable requests retrieve data from specified memory areas, including the process image inputs (PE) and outputs (PA), without writing to the PLC. This satisfies the requirement to observe current I/O state while leaving the running program and physical process untouched. It is a standard, low-impact method used during OT enumeration on Siemens S7-1200/1500 devices.

The root user holds unrestricted, non-revocable privileges across the entire AWS account, so using it for routine operations removes least-privilege boundaries and exposes every resource to accidental or malicious compromise. This is a significant identity and access management risk.

Invoke-Command with -ComputerName and -ScriptBlock establishes a WinRM session over HTTP/5985 or HTTPS/5986, executing the script block remotely on the trusted host. This satisfies the requirement to run commands through WinRM rather than SMB or WMI.

Plaintext connection strings in App Service application settings are readable by anyone holding Reader or Contributor on the resource, exposing database credentials directly. This satisfies the stem's attack path: no Key Vault reference means no separate secret access control.

TheHarvester queries search engines and public databases to enumerate emails, subdomains and hosts for a target domain, satisfying the requirement for passive open-source intelligence gathering. Unlike active scanning tools, it never touches the target's infrastructure directly, keeping the reconnaissance covert during the external engagement.

The -sX flag sets FIN, PSH and URG simultaneously, producing the Xmas tree scan. Because these flags are meaningless on a normal open port, compliant stacks drop the packet, letting Nmap infer state while evading payload-flag inspection.

CrackMapExec and its successor NetExec include a module that reports SMB signing status per host across a CIDR range. Running it with domain credentials enumerates many hosts quickly and outputs a clear required/not-required indicator, which directly identifies relay-feasible targets. This is a standard, efficient way to build the signing-disabled list during an internal engagement.

dsacls is a built-in Windows command-line tool that allows viewing and modifying ACLs on Active Directory objects, including OUs. With WriteDACL permission, you can use dsacls to grant yourself Full Control on the OU, then further compromise objects within it. It is part of the AD DS tools and is available on domain controllers and administrative workstations.

Modbus TCP encapsulates its protocol data unit directly in TCP segments, and the specification reserves port 502 as the registered default for this traffic. Targeting 502 lets the tester issue function code 3 read-holding-register requests to the PLC, satisfying the requirement to query holding registers and assess the process state.

With Secure transfer required disabled, the storage account accepts requests over plain HTTP, so credentials, tokens and object data travel unencrypted. An attacker positioned on the network path can capture that traffic, satisfying the question's focus on interception of data in transit.

Ghidra, released by NSA, disassembles and decompiles ELF binaries across architectures including ARM, so it handles the router's auth_service without executing it. Static analysis of compiled code for buffer overflows is exactly its supported workflow.

Wireshark's Modbus/TCP dissector decodes function codes, register addresses and values, and its IO Graph and statistics features plot register state changes over capture time. This satisfies the stem's requirement to automatically extract registers and visualise changes from the PCAP.

HackRF One is a half-duplex SDR transceiver covering 1 MHz to 6 GHz, spanning the 433 MHz band, with RTL-SDR as a receive-only alternative. It satisfies the stem's capture-and-replay requirement, unlike fixed-frequency hardware that cannot record arbitrary waveforms.

IPv6 RA Guard on the switch inspects and drops rogue Router Advertisement messages arriving on host-facing ports, blocking the spoofed advertisements NDP spoofing relies on. This satisfies the requirement to prevent malicious rogue advertisements on the local enterprise network segment.

Mimikatz exports Kerberos tickets in the .kirbi format, a base64-encoded structure holding the ticket's encrypted blob and session key. This satisfies the stem's Pass-the-Ticket requirement, since the .kirbi file can be re-injected into a session via kerberos::ptt to impersonate the victim without knowing their password.

The -sn option performs a ping scan, which sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request to determine if hosts are up. It does not scan ports, making it faster and less likely to trigger IDS than a full port scan. This is the recommended way to discover live hosts on a network without scanning ports.

The -L flag makes smbclient list the shares exported by the target host over SMB, returning share names and comments without mounting them. This directly satisfies the requirement to enumerate available shares on the remote Windows file server during the internal audit.

Pass-the-Hash uses the NTLM hash directly in the authentication process, bypassing the need for the plaintext password. In this scenario, you have extracted the hash from LSASS, and since the domain user has an active logon session, the hash is valid for NTLM authentication. Tools like Mimikatz or Impacket's psexec.py can perform PtH to access remote resources.

TCP ACK pings (-PA80) bypass the ICMP-blocking perimeter firewall because they are sent as bare TCP ACK segments, which many stateless firewalls pass and which elicit RST replies from live hosts. This satisfies the stem's constraint of discovering hosts when ICMP echo requests are filtered.