Privilege Escalation Lateral Movement And Post Exploitation

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

Which TWO methods are commonly used for data exfiltration during a penetration test to bypass basic network monitoring?

You are assessing a Linux privilege escalation path. Which THREE techniques would allow you to escalate to root if you have write access to the /etc/passwd or /etc/shadow file?

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

You have identified an unquoted service path vulnerability on a Windows server. What is the correct remediation path to escalate privileges?

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

During an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?

An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Which post-exploitation action is considered 'Living off the Land' (LotL)?

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?