EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) (CPENT) — Questions 226–254

Seamless SSO creates the AZUREADSSOACC$ computer account in on-premises AD, whose Kerberos decryption key Microsoft Entra ID shares. Domain-joined users obtain a Kerberos service ticket for that account, which the browser presents for cloud authentication. Compromising the account's key enables forging tickets for any user, satisfying the hybrid SSO constraint.

Once devices are discovered, the ReadProperty service can retrieve the object-list property, which enumerates all BACnet objects (analog inputs, binary outputs, schedules, etc.) on the device. This is a read-only operation that maps the device's exposed points. It is a core active enumeration technique for understanding what is controllable or monitorable on the BACnet network.

The SUID bit makes /bin/ping run as root regardless of the invoking user, so any flaw permitting command execution or shell escape yields a root shell. This satisfies the scenario's implication: privilege escalation risk from owner-privilege execution.

The trust policy's Principal element is what permits any account user to call sts:AssumeRole. Adding a Condition block — restricting the principal or demanding MFA via aws:MultiFactorAuthPresent — closes that gap while preserving legitimate role assumption, directly addressing the overly permissive trust relationship.

The -D flag on the SSH client starts a dynamic SOCKS proxy that forwards arbitrary TCP connections through the SSH server. Because the compromised host is dual-homed, connections to internal web servers on TCP/8080 originate from its internal interface, reaching hosts that are not routable from the attack machine. Pointing tools at the local SOCKS5 listener routes all their traffic through the pivot correctly.

The role's trust policy names the external account as principal, so any identity in that account can call sts:AssumeRole. Absent an ExternalID condition, the confused-deputy weakness lets that account assume the role without proving it is the intended tenant.

Lua is embedded in Wireshark as its scripting engine for lightweight, user-written dissectors, letting the tester parse the proprietary UDP binary structure without recompiling C code. This satisfies the stem's requirement for a natively supported scripting language.

Owner at root management group scope grants external guests full control over every subscription and resource, including RBAC changes. This violates least privilege at the broadest possible scope, making it a high-severity finding in the stem's review.

Snap7 is an open-source Ethernet communication suite specifically designed for Siemens S7 PLCs. It implements the S7comm protocol and allows a tester to connect to S7-1200/1500/300/400 PLCs over TCP port 102, read/write memory areas, and even manipulate the PLC program. It is the correct tool for actively interacting with the S7-1200 in this scenario.

A trust policy allowing any AWS account in the partition to assume the role, with no ExternalId condition, enables the confused deputy problem: any third party can obtain the role's credentials. This is the insecure cross-account assumption configuration the review seeks.

The modbus-discover NSE script sends a safe Modbus Read Device Identification request to TCP port 502 and parses the response to list slave IDs, vendor, and supported function codes. Running it with a normal TCP scan on port 502 is non-intrusive and ideal for enumerating PLCs on a live control VLAN without writing coils or registers.

DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights permit a principal to invoke directory replication, letting it pull password hashes and other secrets directly from a domain controller without touching its filesystem. Granting both satisfies the replication requirement that makes DCSync possible, unlike ordinary read or logon rights.

The -sS flag performs a half-open TCP SYN scan, sending SYN packets and never completing the three-way handshake. This satisfies the stealth requirement because no full connection is established, so stateless packet filters see only unsolicited SYNs rather than completed sessions, reducing logging and detection compared with a full connect scan.

Snap7 is an open-source library exposing S7comm client functions, letting an attacker craft packets that read and write PLC memory and change the operating mode. This satisfies the requirement to inject malicious logic into the S7-300.

Pass-the-Hash allows an attacker to authenticate using the NTLM hash directly, without needing the plaintext password. This works because NTLM authentication can use the hash as proof of identity. Tools like Mimikatz or Impacket's psexec can leverage the hash to access remote systems where the user has administrative privileges.

SSRF lets the attacker reach the link-local IMDS endpoint (169.254.169.254), which issues OAuth2 access tokens for the assigned Managed Identity via its metadata endpoint. This satisfies the stem's chaining constraint, escalating from a web request forgery to authenticated access to Azure resources.

ticketer.py is specifically designed to create Golden and Silver tickets. It takes the KRBTGT hash and domain SID as input to forge a TGT that can be used for authentication. This tool allows the tester to generate a ticket file that can be injected into the session, enabling lateral movement with domain admin privileges.

AlwaysInstallElevated set in both HKCU and HKLM lets any user install MSI packages with SYSTEM privileges. A crafted MSI executed via msiexec with /quiet /qn runs its payload as SYSTEM, escalating from the current user to full administrative control.

With no_root_squash, the client's root UID is preserved on the share, so mounting as root and copying bash lets the tester chmod +s it, creating a root-owned SUID binary. This satisfies the requirement to write a SUID shell to the NFS export.

ListAccounts enumerates every account in the organization along with its ID, ARN, email, and status. From the management account, this provides the target list of member accounts that could be reachable through identity center permission sets or cross-account roles. Without this enumeration, the tester cannot know which accounts exist or where to focus escalation attempts, making it a necessary first step.

Mimikatz's `kerberos::ptt` passes the ticket into the current logon session by injecting it into LSASS, satisfying the requirement to import a captured TGT without re-authentication. The `.kirbi` file holds the Kerberos ticket; `ptt` (pass-the-ticket) loads it so the session presents it for network resource access.

Autoroute reads the compromised host's routing table and injects routes into Metasploit's session, so TCP SYN scans traverse eth1 into 192.168.100.0/24. It satisfies the pivot constraint: reaching an isolated subnet through a dual-homed host without manual proxy configuration.

The IMDS endpoint is accessible from within the VM and provides OAuth2 tokens for the managed identity when requested with the appropriate header. By exploiting SSRF, an attacker can make the web application send a request to this endpoint and retrieve the token. This token can then be used to authenticate to Azure services that the managed identity has access to, such as Azure Resource Manager or Key Vault.

When a compromised host has multiple interfaces but no direct route to the target subnet, you can leverage it as a pivot by configuring a route through the host and a SOCKS proxy. Metasploit's autoroute adds a route in the Meterpreter session, and proxychains directs tools through the SOCKS proxy. This allows traffic to be forwarded from your attack machine through the compromised host to the target network, assuming the host can reach it via one of its interfaces.

ProcDump.exe captures a full memory dump of a running process, and targeting lsass.exe yields credential material such as NTLM hashes and Kerberos tickets for offline extraction. It satisfies the scenario's requirement for a Sysinternals utility usable post-exploitation, since it runs natively on Windows without installing additional agents.

PrintSpoofer exploits SeImpersonatePrivilege by abusing the Print Spooler service to create a named pipe and impersonate a SYSTEM token. It works reliably on Windows Server 2019 without needing external redirects, making it ideal for this scenario where the privilege is enabled.

Unconstrained Delegation lets the host cache any authenticating user's TGT in LSASS. Coercing a Domain Administrator to authenticate deposits their TGT there, which the operator extracts and injects to impersonate them domain-wide — satisfying the scenario's requirement to abuse the delegation flag for full-domain privilege escalation.

PsExec copies its service executable to the target's ADMIN$ share, then instructs the Service Control Manager over remote RPC to register and start that binary as a Windows service. The SCM launches the payload under SYSTEM context, satisfying the remote execution requirement.

UDP 5683 is the IANA-assigned default port for unencrypted CoAP, matching the stem's plaintext constraint. CoAP's encrypted variant, CoAPs, uses UDP 5684 with DTLS instead. Targeting 5683 lets the Scapy packet reach the smart meter's standard CoAP endpoint without TLS interception.