Courseiva

CCNA Privilege Escalation Lateral Movement And Post Exploitation Questions

49 questions · Privilege Escalation Lateral Movement And Post Exploitation · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

A.gpresult /r
B.net user /domain
C.cmdkey /list
D.whoami /priv
AnswerC

The `cmdkey /list` utility enumerates all entries stored in Windows Credential Manager, displaying target names and types without revealing passwords. It directly satisfies the scenario's requirement to list saved credentials on the compromised host, running natively from the command line without additional tooling.

Why this answer

The cmdkey utility is a built-in Windows command-line tool that manages stored credentials in the Credential Manager. Running 'cmdkey /list' enumerates all saved credentials (including domain, generic, and certificate-based) for the current user, showing target names and types. This is the standard way a penetration tester checks for cached credentials that could be reused for lateral movement.

Exam trap

CPENT often tests the confusion between commands that enumerate accounts or privileges (net user, whoami /priv) and those that specifically enumerate stored credentials, causing candidates to pick a command that lists users rather than cached secrets.

How to eliminate wrong answers

Option A is wrong because 'gpresult /r' displays the Resultant Set of Policy (RSoP) for a user or computer — it reports applied Group Policy objects, not stored credentials. Option B is wrong because 'net user /domain' lists domain user accounts, not credentials stored on the local system. Option D is wrong because 'whoami /priv' shows the privileges assigned to the current token (e.g., SeDebugPrivilege), which is useful for privilege escalation analysis but does not reveal saved credentials.

Practice this question →
2
Multi-Selecthard

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

Select 3 answers
A.Adding a scheduled task or cron job in /etc/crontab or user crontabs to periodically execute a reverse shell
B.Adding a malicious SSH public key to the target user's ~/.ssh/authorized_keys file
C.Modifying the Windows Registry Run key using winereg
D.Injecting shellcode into the BIOS/UEFI firmware via flashrom without user interaction
E.Creating a custom systemd service unit file that executes a backdoor script on startup
AnswersA, B, E

Cron jobs in /etc/crontab or user crontabs execute automatically at scheduled intervals and survive reboots, satisfying the persistence requirement. They blend into legitimate administrative scheduling, so standard audits rarely flag them, unlike obvious rogue services or modified init scripts. This makes cron a low-noise, reboot-resilient mechanism.

Why this answer

Option A is correct because cron jobs placed in /etc/crontab or user crontabs (e.g., via crontab -e) are executed automatically by the cron daemon at scheduled intervals, and they persist across reboots since the crontab files are stored on disk and reloaded at boot. Option B is correct because appending an attacker-controlled public key to ~/.ssh/authorized_keys grants passwordless SSH login as that user, and the file persists on disk across reboots, providing a stealthy, standard-protocol backdoor. Option E is correct because a custom systemd unit file (e.g., in /etc/systemd/system/ with WantedBy=multi-user.target) is started by systemd at boot, giving reliable persistent execution of a backdoor script.

Option C is incorrect because winereg is not a real Linux tool and the Windows Registry Run key is a Windows persistence mechanism, not applicable to a Linux target. Option D is incorrect because injecting shellcode into BIOS/UEFI via flashrom requires physical access or firmware write privileges, is highly risky and hardware-specific, and is not a commonly implemented Linux persistence method.

Practice this question →
3
Multi-Selectmedium

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

Select 2 answers
A.DHCP spoofing
B.DNS poisoning
C.WMI (Windows Management Instrumentation)
D.PsExec
E.ARP cache poisoning
AnswersC, D

WMI executes commands and methods on remote Windows hosts over DCOM or WinRM using valid credentials, letting an attacker run processes on a server from a compromised workstation. This makes it a standard lateral movement technique within Active Directory environments.

Why this answer

WMI (Windows Management Instrumentation) is correct because attackers can use it remotely via DCOM/RPC (typically over TCP 135 plus dynamic RPC ports) to execute commands or spawn processes on a target server using valid domain credentials, making it a standard lateral movement technique in Active Directory environments. PsExec is also correct because it authenticates to the target's ADMIN$/SMB service (TCP 445), copies a service binary, and creates/remotely starts a Windows service to execute code as SYSTEM, which is a classic workstation-to-server lateral movement method. DHCP spoofing is not correct here because it is a rogue DHCP server attack used for initial access, traffic interception, or man-in-the-middle on a local segment, not for authenticated remote code execution on a server.

DNS poisoning is not correct because it redirects name resolution to malicious hosts and does not by itself provide code execution or administrative access on a target server. ARP cache poisoning is not correct because it is a layer-2 man-in-the-middle technique for intercepting or altering local traffic, not a technique for moving laterally by executing code on a remote server.

Practice this question →
4
MCQmedium

You have compromised a Windows workstation and want to maintain persistence by ensuring your malicious executable runs every time a user logs on. You have local administrator rights. Which registry key should you modify?

A.HKLM\Software\Microsoft\Windows\CurrentVersion\Run
B.HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
C.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
D.HKLM\System\CurrentControlSet\Services
AnswerA

The HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a common location for programs to run at system startup for all users. Since the tester has local administrator rights, they can modify this key to add a malicious executable that will execute each time any user logs on. This provides persistence across reboots and user logons.

Why this answer

The HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a standard location for programs that should run at startup for all users. With local administrator rights, a tester can add an entry here to ensure their executable runs every time any user logs on. This provides system-wide persistence and survives reboots.

It is a common technique used by malware and penetration testers alike.

Exam trap

The trap here is choosing the HKCU Run key, which only affects the current user, instead of the HKLM Run key, which provides system-wide persistence for all users.

Practice this question →
5
MCQhard

You have gained access to a Linux host and escalated to root. You want to maintain persistence by creating a backdoor that will execute a reverse shell each time the system reboots. Which method would best achieve this while evading common detection mechanisms?

A.Add a reverse shell command to /etc/rc.local.
B.Modify an existing systemd service file to include an ExecStartPre directive that runs a reverse shell.
C.Add a cron job with @reboot that executes a reverse shell.
D.Create a systemd service unit file in /etc/systemd/system/ that runs a reverse shell.
AnswerB

Modifying an existing systemd service file is stealthier because it does not create a new file that might be noticed. Adding an ExecStartPre directive to a legitimate service allows the reverse shell to execute before the main service starts, blending in with normal system behavior. This approach is less likely to be detected by routine audits that focus on new or unusual files.

Why this answer

Persistence on Linux often involves startup scripts, but stealthy persistence requires blending into existing configurations. Modifying an existing systemd service file with an ExecStartPre directive allows the backdoor to run as part of a legitimate service's startup sequence. This avoids creating new files that might be flagged and leverages the trust associated with system services.

It also ensures execution on reboot, maintaining access.

Exam trap

The trap here is assuming that any persistence mechanism is equally stealthy; creating new files or cron jobs is easily detected, while modifying existing service files is less obvious but still requires careful selection of a service that starts reliably.

Practice this question →
6
Multi-Selectmedium

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Select 3 answers
A./etc/passwd
B./proc/version
C.~/.ssh/
D./etc/crontab
E./var/log/syslog
AnswersA, C, D

/etc/passwd lists local accounts with UID, GID, home directory and shell, letting the tester enumerate valid users for password spraying or privilege-escalation targeting. It satisfies the stem's credential-discovery goal, though password hashes now reside in the shadowed /etc/shadow, so it reveals usernames rather than secrets directly.

Why this answer

Option A, /etc/passwd, is correct because it enumerates local user accounts (UIDs, GIDs, home directories, and login shells), which is essential for identifying valid usernames for credential attacks or privilege-escalation targets. Option C, ~/.ssh/, is correct because this directory typically holds private keys (id_rsa), authorized_keys, and known_hosts, which can yield reusable credentials for lateral movement or persistence. Option D, /etc/crontab, is correct because it defines system-wide scheduled tasks, revealing scripts or binaries that may run as root and can be abused for privilege escalation.

Option B, /proc/version, is not among the selected answers because it only discloses kernel and compiler version information, which is useful for exploit matching but not for locating configuration data, credentials, or cron jobs. Option E, /var/log/syslog, is not among the selected answers because it contains system event logs rather than the sensitive configuration files, credential stores, or scheduled-task definitions the question asks for.

Practice this question →
7
Multi-Selecthard

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Select 3 answers
A.arp -a
B.uname -r
C.ls -la /etc/sudoers.d/
D.sudo -l
E.cat /etc/sudoers
AnswersC, D, E

Listing `/etc/sudoers.d/` reveals drop-in sudoers files, which frequently hold custom or misconfigured privilege rules that the main `/etc/sudoers` file merely includes. Enumerating this directory exposes per-user or per-group grants, satisfying the stem's requirement to identify misconfigured sudo privileges on the Linux host.

Why this answer

Option D, `sudo -l`, is correct because it lists the sudo privileges of the invoking user, showing exactly which commands they may run as root or other users (including NOPASSWD entries and wildcard rules) — the primary way to spot exploitable sudo rights. Option E, `cat /etc/sudoers`, is correct because the main sudoers policy file defines user/group specifications, command aliases, and defaults; reading it (if permissions allow) reveals misconfigurations such as overly broad ALL=(ALL) ALL grants. Option C, `ls -la /etc/sudoers.d/`, is correct because sudoers drop-in files in /etc/sudoers.d/ are included via #includedir and often contain custom privilege rules that are easy to overlook; listing them identifies additional policy files to inspect.

Option A, `arp -a`, is not relevant because it only displays the ARP cache for network mapping, not sudo configuration. Option B, `uname -r`, is not relevant because it only prints the kernel release version, which does not reveal sudo privilege settings.

Practice this question →
8
MCQeasy

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

A.It will cause the system to BSOD.
B.It will alert the Security Operations Center (SOC) due to signature-based detection.
C.It will corrupt the LSASS process.
D.It requires a reboot to function.
AnswerB

Mimikatz is widely signatured, so Windows Defender detects its known binaries and memory patterns, generating alerts forwarded to the SOC. The primary operational risk is therefore detection and analyst response, not credential theft failure or system instability.

Why this answer

Windows Defender (and other EDRs) have specific signatures for Mimikatz and will trigger an alert or quarantine the file immediately upon execution.

Practice this question →
9
MCQeasy

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

A.Mimikatz credential dumper via direct LSASS memory injection.
B.Potato family exploits (e.g., PrintSpoofer, RoguePotato) that abuse token impersonation via named pipes.
C.PowerView domain enumeration modules.
D.Windows Subsystem for Linux (WSL) container breakouts.
AnswerB

Potato exploits abuse SeImpersonatePrivilege by coercing a privileged account into authenticating over a named pipe or COM server, then capturing that token via ImpersonateNamedPipeClient. PrintSpoofer and RoguePotato target the specific Windows token-impersonation mechanism this privilege grants, satisfying the stem's enabled SeImpersonatePrivilege constraint directly.

Why this answer

SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege allow an attacker to impersonate tokens. Tools like Rotten Potato, RoguePotato, or PrintSpoofer leverage this to escalate to NT AUTHORITY\SYSTEM.

Practice this question →
10
MCQeasy

During a penetration test on a Windows domain, a tester has compromised a workstation and obtained the NTLM hash of a domain user. The tester wants to authenticate to a remote server using this hash without cracking it. Which tool and command should the tester use to perform a pass-the-hash attack?

A.Use 'runas /user:domain\username /savecred' and enter the hash when prompted for a password.
B.Use 'net use \\server\share /user:domain\username hash' to authenticate using the NTLM hash directly.
C.Use 'psexec \\server -u domain\username -p hash cmd.exe' to execute a command on the remote server.
D.Use Mimikatz with 'sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd.exe' to launch a new process with the hash injected.
AnswerD

Mimikatz's sekurlsa::pth command performs pass-the-hash by starting a new process with the specified NTLM hash injected into its logon session. This allows the tester to access remote resources as the user without knowing the plaintext password. It is a standard technique for lateral movement in Windows environments when only the hash is available.

Why this answer

Pass-the-hash requires injecting the NTLM hash into a new logon session so that Windows can use it for authentication. Mimikatz's sekurlsa::pth command does exactly this by launching a process with the hash, allowing the tester to access remote resources. Standard commands like net use, runas, and psexec do not accept hashes directly, so they cannot perform pass-the-hash on their own.

Exam trap

The trap here is assuming that built-in Windows tools like net use or psexec can accept an NTLM hash as a password, when they require plaintext credentials.

Practice this question →
11
MCQhard

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

A.Mimikatz
B.Wireshark
C.Hashcat
D.Responder
AnswerA

Mimikatz parses memory dumps offline, extracting NTLM hashes and Kerberos tickets directly from LSASS structures without requiring live execution. This satisfies the stem's constraint of analysing an already-captured dump, since Mimikatz supports offline `sekurlsa` parsing against a saved file rather than only live memory.

Why this answer

Mimikatz is the standard tool used to parse LSASS dumps and extract authentication secrets.

Practice this question →
12
MCQeasy

During a post-exploitation phase, you have obtained domain administrator credentials. You want to extract all password hashes from the domain controller's Active Directory database without installing additional software. Which built-in Windows utility should you use?

A.vssadmin
B.ntdsutil
C.secretsdump.py
D.wmic
AnswerB

ntdsutil is a built-in command-line tool that can create a snapshot of the Active Directory database (ntds.dit) and then mount it. Once mounted, the tester can copy the ntds.dit file and the SYSTEM registry hive to extract password hashes offline. It requires domain administrator privileges and is a native Windows utility.

Why this answer

ntdsutil is a native Windows utility that allows domain administrators to create and mount snapshots of the Active Directory database. By using ntdsutil, a tester can obtain a copy of ntds.dit and the SYSTEM registry hive, which can then be used offline to extract password hashes with tools like secretsdump.py or mimikatz. This method avoids installing additional software on the domain controller.

Exam trap

The trap here is confusing tools that facilitate copying ntds.dit (like vssadmin) with the utility that actually creates a usable snapshot for extraction, which is ntdsutil.

Practice this question →
13
MCQhard

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

A.Standard FTP client configured to use port 53 as the control channel.
B.Wget command pointing to an external HTTP server listening on port 53.
C.Netcat in listening mode on TCP port 53.
D.A DNS tunneling tool such as dnscat2 or iodine to encode the archive into DNS query records.
AnswerD

DNS tunnelling encodes data within DNS query and response records, which traverse the firewall because outbound DNS is permitted. Tools such as dnscat2 or iodine provide that channel, satisfying the stem's constraint of exfiltrating the archive through a firewall allowing only outbound DNS traffic.

Why this answer

DNS tunneling tools like dnscat2 or iodine encapsulate data inside DNS queries (such as TXT, A, or CNAME records) sent to a controlled nameserver.

Practice this question →
14
Multi-Selecthard

A penetration tester has obtained domain user credentials and wants to perform lateral movement to a Windows Server 2016 host using WinRM. The tester has network access to the target on port 5985. Which TWO methods can be used to execute commands remotely via WinRM? (Choose two.)

Select 2 answers
A.Using WMI with the /node:target parameter
B.Using PowerShell Remoting with Enter-PSSession
C.Using WinRS (Windows Remote Shell) with winrs -r:target
D.Using PsExec with the -r flag to specify WinRM
E.Using SSH to connect to the Windows host
AnswersB, C

Enter-PSSession establishes an interactive PowerShell session over WinRM, allowing command execution on the remote host. It uses the WS-Management protocol and works when WinRM is enabled and the tester has valid credentials, making it a standard lateral movement technique.

Why this answer

WinRM allows remote command execution via WS-Management. PowerShell Remoting (Enter-PSSession) and WinRS are native tools that utilize WinRM. They enable interactive or one-off command execution when WinRM is enabled and credentials are available, making them effective for lateral movement in Windows environments.

Exam trap

The trap here is confusing WinRM with other remote execution protocols like SMB or DCOM, leading to selection of tools that do not operate over port 5985.

Practice this question →
15
MCQmedium

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

A.Invoke PowerShell with the Get-WmiObject Win32_Process cmdlet specifying the LSASS process handle
B.Execute the native net accounts command with the /dump flag to extract password hashes from the SAM registry hive
C.Run the built-in command rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:\temp\lsass.dmp full
D.Use the tasklist /m lsass.exe command to output the active directory database credentials to the console
AnswerC

Comsvcs.dll's MiniDump export, invoked via rundll32, writes the lsass.exe process memory to a file using a signed Microsoft binary, avoiding third-party tooling and the alerts it attracts. This satisfies the need to harvest credentials legitimately.

Why this answer

The comsvcs.dll MiniDump export can be invoked via rundll32.exe to dump the memory of any process by PID, including lsass.exe, producing a full memory dump for offline credential extraction. Because rundll32 and comsvcs.dll are signed Microsoft binaries, this technique (often called 'comsvcs MiniDump' or 'rundll32 LSASS dump') is a living-off-the-land method that evades many application-whitelisting controls.

Exam trap

The trap is confusing legitimate administrative commands (net accounts, tasklist, Get-WmiObject) with actual memory-dumping techniques; only the comsvcs.dll MiniDump via rundll32 actually extracts LSASS memory.

How to eliminate wrong answers

Option A is wrong because Get-WmiObject Win32_Process can enumerate processes but cannot dump LSASS memory; WMI has no memory-dump capability. Option B is wrong because 'net accounts' manages password and logon policy settings and has no /dump flag; SAM hashes are not extracted this way. Option D is wrong because 'tasklist /m lsass.exe' only lists modules loaded by LSASS and does not output credentials or dump memory.

Practice this question →
16
Multi-Selectmedium

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

Select 3 answers
A.FTP (File Transfer Protocol)
B.WinRM (Windows Remote Management)
C.SNMP (Simple Network Management Protocol)
D.RDP (Remote Desktop Protocol)
E.SMB / RPC (via Service Control Manager / ADMIN$)
AnswersB, D, E

WinRM provides native remote command execution over HTTP/S via the WS-Management protocol, letting an operator run PowerShell or cmd sessions on target hosts without deploying agents. It satisfies the stem's constraint of using built-in Windows administrative protocols for lateral movement, since WinRM ships enabled on modern Windows Server systems.

Why this answer

WinRM (B) is correct because it is a native Windows remote management service built on WS-Management and SOAP over HTTP/HTTPS (ports 5985/5986), allowing an operator to execute commands remotely via tools like winrs or PowerShell remoting without installing any agent. RDP (D) is correct because it is a built-in Windows remote desktop protocol (TCP 3389) that provides interactive graphical access to a remote host, enabling lateral movement using only native OS functionality. SMB/RPC via the Service Control Manager and ADMIN$ share (E) is correct because native Windows administrative tooling such as PsExec-style techniques use SMB (TCP 445) to copy a service binary to ADMIN$ and RPC to the Service Control Manager to start it remotely, requiring no third-party agent.

FTP (A) is not correct because it is a file-transfer protocol, not a remote execution or administrative control mechanism, and SNMP (C) is not correct because it is a monitoring/management protocol for querying device state, not a native Windows remote command-execution channel.

Practice this question →
17
Multi-Selectmedium

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

Select 2 answers
A.The target account's NTLM password hash must be known to the attacker
B.SMB signing must be globally disabled across the entire Active Directory forest
C.The target system must accept NTLM authentication (i.e., NTLM is not completely disabled via group policy)
D.The target user account must have Kerberos pre-authentication disabled
E.The local Windows Firewall on the domain controller must be completely disabled
AnswersA, C

NTLM authentication proves knowledge of the hash itself, not the plaintext, so possessing the target account's NTLM hash lets the attacker inject it into an authentication exchange and impersonate the user. Without that hash, no valid NTLM response can be computed, so the requirement is fundamental.

Why this answer

Option A is correct because Pass-the-Hash fundamentally requires the attacker to possess the target account's NTLM hash (the NT hash, i.e., the MD4 of the password) so it can be submitted directly in the NTLM authentication exchange without ever knowing the plaintext password. Option C is correct because PtH abuses the NTLM challenge/response protocol, so the target must still accept NTLM authentication; if NTLM is fully disabled via Group Policy (e.g., Network security: Restrict NTLM settings), the hash cannot be used and the attack fails. Option B is wrong because SMB signing does not need to be disabled forest-wide for PtH to work — signing only prevents relay/tampering, and even with signing enabled a valid NTLM hash can still authenticate (though it may hinder relay scenarios).

Option D is wrong because Kerberos pre-authentication is unrelated to NTLM-based PtH; disabling it enables AS-REP roasting, not hash-based NTLM logon. Option E is wrong because the domain controller's local firewall has no bearing on whether NTLM hash authentication succeeds against target hosts.

Exam trap

The trap is confusing PtH requirements with those of other attacks like SMB relay or Kerberos-based attacks. Candidates often think SMB signing must be disabled for PtH, but that is only for relay attacks.

Practice this question →
18
MCQeasy

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

A.Unquoted service path exploitation involving spaces in service binary names.
B.DLL Hijacking via PATH environment variable manipulation.
C.Insecure Scheduled Task Permissions / Writable Task Executable
D.Kerberoasting against domain service principal names.
AnswerC

A privileged scheduled task running a script writable by standard users lets any low-privileged account replace the script's contents, which then execute as administrator at the next trigger. The weakness is the writable executable referenced by the task, not the task's own configuration.

Why this answer

If a scheduled task runs as SYSTEM or an admin, and the underlying script or binary is writable by low-privileged users, it represents an insecure file permissions vulnerability leading to privilege escalation when the task triggers.

Practice this question →
19
Multi-Selecthard

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

Select 3 answers
A.Replacing the default bash shell
B.Modifying the kernel source code
C.Appending a public key to ~/.ssh/authorized_keys
D.Adding an entry to /etc/crontab
E.Creating a custom systemd service
AnswersC, D, E

Appending a public key to ~/.ssh/authorized_keys grants the attacker passwordless SSH access under the compromised account, surviving reboots and password changes. This satisfies the persistence requirement by establishing durable remote access without needing to re-exploit the initial vulnerability, and it often evades detection since legitimate administrators use the same mechanism.

Why this answer

Option C is correct because appending an attacker-controlled public key to ~/.ssh/authorized_keys grants persistent SSH access to the compromised account without needing the user's password, a classic Linux persistence technique. Option D is correct because adding a job to /etc/crontab (or /etc/cron.d, user crontabs) causes the scheduled command to execute repeatedly, re-establishing access or running malicious code on a recurring basis. Option E is correct because creating a custom systemd service (e.g., a unit file in /etc/systemd/system enabled with systemctl enable) causes the malicious process to start automatically at boot, providing durable persistence.

Option A is not a standard persistence technique: replacing the default bash shell would break normal login behavior and is not a recognized method for maintaining covert access. Option B is not practical for persistence: modifying kernel source code requires recompiling and reinstalling the kernel, which is far too invasive and disruptive compared to typical persistence mechanisms.

Practice this question →
20
Multi-Selecteasy

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Select 3 answers
A.scp
B.curl (using HTTPS)
C.sftp
D.nc (Netcat)
E.ftp
AnswersA, B, C

SCP tunnels file transfer through SSH, encrypting the archive in transit by default without extra configuration. This satisfies the stem's requirement for encrypted exfiltration using a standard tool, since SSH provides confidentiality and integrity out of the box on the compromised Linux host.

Why this answer

Option A (scp) is correct because it runs over SSH and encrypts the entire file transfer session, making it a standard encrypted exfiltration channel out of the box. Option B (curl using HTTPS) is correct because HTTPS wraps HTTP in TLS, so uploading the archive to an HTTPS endpoint encrypts the data in transit without additional tooling. Option C (sftp) is correct because it is the SSH File Transfer Protocol, tunneling file operations through SSH for encryption by default.

Option D (nc/Netcat) is not correct because it transmits raw data with no built-in encryption, so the archive would cross the network in cleartext. Option E (ftp) is not correct because standard FTP sends credentials and data unencrypted, requiring FTPS or SFTP for any confidentiality.

Practice this question →
21
MCQeasy

Which post-exploitation action is considered 'Living off the Land' (LotL)?

A.Using PowerShell to download and execute a script in memory.
B.Installing a rootkit driver.
C.Deploying a custom C++ backdoor.
D.Using a known Metasploit payload.
AnswerA

Living off the Land means abusing binaries and tooling already present on the host, avoiding dropped malware. PowerShell is native to Windows, and executing a script in memory via download-and-execute leaves no file on disk, matching the LotL definition.

Why this answer

LotL involves using pre-installed system tools (like PowerShell or WMI) to conduct malicious activities, minimizing the need for custom malware.

Practice this question →
22
MCQhard

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

A.Compiling and loading a malicious Loadable Kernel Module (LKM) rootkit.
B.Modifying the SSH authorized_keys file for the root user.
C.Creating a systemd service unit file that executes a reverse shell.
D.Placing a persistent cron job in /etc/cron.d/
AnswerA

A malicious LKM loads into kernel space, surviving reboots once configured to load at boot, and hooks system calls or patches kernel memory to hide processes, files and connections. This matches the requirement for reboot-surviving, stealthy kernel-level persistence on Linux.

Why this answer

Loadable Kernel Modules (LKMs) allow attackers to run code in kernel space, hide processes, files, and network connections, and persist across reboots if loaded at boot time.

Practice this question →
23
MCQmedium

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

A.Kerberoasting against computer accounts.
B.Performing an AS-REP Roasting attack on users with Kerberos pre-authentication disabled.
C.Running Responder on the local subnet to capture NTLMv2 hashes.
D.Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.
AnswerD

DCSync abuses the Directory Replication Service Remote Protocol, impersonating a Domain Controller to request password hashes via replication. This extracts credentials over the network without touching LSASS on the Domain Controller, satisfying the constraint of avoiding direct memory dumping.

Why this answer

DCSync is an attack technique that abuses the Directory Replication Service (DRS) remote protocol to simulate a domain controller and request password data (hashes) for user accounts from another domain controller.

Practice this question →
24
MCQhard

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

A.Use standard FTP data channels over ephemeral ports to push archives to an external staging server
B.Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker
C.Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets
D.Establish an HTTPS connection to an external IP address using port 443
AnswerB

Tunnelling data inside DNS queries exploits the sole permitted egress channel: port 53. Because the firewall allows only DNS to internal resolvers, encoding stolen data in TXT record requests to an attacker-controlled authoritative domain lets those resolvers recursively forward queries outward, returning responses through the same permitted path.

Why this answer

DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.

Practice this question →
25
MCQhard

You have compromised a Linux server and want to exfiltrate sensitive data to an external server. The network egress filtering only allows DNS traffic (UDP port 53) to a specific internal DNS resolver. Which technique would best allow you to exfiltrate data over DNS while evading detection?

A.Use SSH tunneling to forward data through the internal DNS resolver.
B.Use dnscat2 with a custom domain and encode data in DNS queries.
C.Use HTTP GET requests to a web server with data encoded in the URL.
D.Use ICMP tunneling with ptunnel to encapsulate data in ping packets.
AnswerB

dnscat2 is a tool designed for DNS tunneling, allowing data exfiltration over DNS queries and responses. It encodes data in subdomains or TXT records, and since DNS traffic is allowed, it can bypass egress filtering. Using a custom domain gives the attacker control over the authoritative DNS server, enabling reliable data transfer. This method is stealthy because DNS is often less monitored.

Why this answer

DNS tunneling is a reliable method for data exfiltration when only DNS traffic is allowed. dnscat2 establishes a command-and-control channel over DNS by encoding data in DNS queries and responses. It can use various record types and is designed to evade detection by blending with legitimate DNS traffic. Since the scenario permits DNS to a specific resolver, the attacker can configure dnscat2 to use that resolver, ensuring the traffic is not blocked.

Exam trap

The trap here is assuming that any tunneling protocol will work regardless of egress filtering; only DNS-based tunneling will succeed because other protocols are blocked.

Practice this question →
26
MCQmedium

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

A.Create a malicious script named after the command and prepend its directory to the PATH.
B.Modify /etc/ld.so.preload to inject a malicious library.
C.Exploit a buffer overflow in the binary using a NOP sled.
D.Use the --inject flag on the binary to force command execution.
E.null
AnswerA

Because the SUID binary resolves commands via relative paths, it inherits your PATH. Prepending a directory containing a malicious script named after the invoked command causes the root-privileged binary to execute your code, yielding escalation without needing to modify the binary itself.

Why this answer

When a SUID binary executes system commands using relative paths (e.g., calling 'cat' or 'ls' without a full path), it inherits the caller's PATH environment variable. An attacker can create a malicious executable with the same name as the called command in a writable directory, prepend that directory to PATH, and the SUID binary will execute the malicious script with elevated (root) privileges. This is a classic PATH hijacking privilege escalation.

Exam trap

CPENT often tests the distinction between privilege escalation vectors — candidates confuse PATH hijacking with library injection or buffer overflow, but the key indicator here is 'relative paths' in a SUID binary, which specifically points to PATH manipulation.

How to eliminate wrong answers

Option B is wrong because modifying /etc/ld.so.preload requires root privileges already — it is a persistence/rootkit technique, not a privilege escalation vector from an unprivileged account. Option C is wrong because a buffer overflow requires a specific memory corruption vulnerability in the binary; the question describes a relative-path command execution flaw, not a memory safety bug, and a NOP sled alone does not exploit anything. Option D is wrong because there is no generic '--inject' flag on Linux binaries; this is a fabricated option that does not correspond to any real privilege escalation technique.

Practice this question →
27
MCQeasy

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

A.uname -r
B.whoami
C.env
D.cat /etc/issue
AnswerA

uname -r prints the running kernel's release string, exposing the exact version needed to match against Dirty COW's affected ranges. This satisfies the requirement to confirm the precise kernel build before selecting a privilege escalation exploit.

Why this answer

The command uname -r displays the specific kernel release version, which is critical for identifying applicable kernel-level vulnerabilities.

Practice this question →
28
Multi-Selectmedium

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

Select 2 answers
A.Disabling Windows Defender real-time monitoring via PowerShell.
B.Adding a controlled user account to the Domain Admins or Enterprise Admins group.
C.Configuring a local Windows scheduled task to run netsh.
D.Flushing the local ARP cache on the workstation.
E.Injecting a malicious SID into the sIDHistory attribute of a controlled user account.
AnswersB, E

Adding a controlled account to Domain Admins or Enterprise Admins grants it persistent, highly privileged domain-wide access through AD group membership, which survives reboots and credential changes. This abuses native directory authorisation rather than host-level mechanisms, matching the AD-based persistence requirement.

Why this answer

Option B is correct because adding a controlled account to Domain Admins or Enterprise Admins grants it persistent, high-privilege domain-wide access that survives reboots and is a classic AD persistence technique (e.g., via net group "Domain Admins" user /add /domain or Add-ADGroupMember). Option E is correct because injecting a privileged SID (such as the Domain Admins or Enterprise Admins SID) into the sIDHistory attribute of a controlled account lets that account inherit the privileges of the injected SID during token creation, providing stealthy persistence that is not visible through normal group membership. Option A is not an AD persistence mechanism; disabling Defender real-time monitoring is a host-level defense evasion action that does not survive as a directory-based persistence foothold.

Option C is a local scheduled task, which is host persistence rather than an Active Directory mechanism. Option D is merely a local ARP cache flush, a network troubleshooting action with no persistence value.

Practice this question →
29
MCQmedium

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

A.rpcclient -U Administrator TargetServer
B.nbtstat -A TargetServer -winrm
C.mstv -target:TargetServer -port:5985
D.winrs -r:TargetServer -u:Administrator -p:Password cmd.exe
AnswerD

Winrs uses the WS-Management protocol over HTTP on port 5985, which the stem confirms is open, so it bypasses the blocked SMB ports that PsExec requires. It establishes an interactive remote shell on the domain controller without needing to upload a service binary, satisfying the firewall constraint directly.

Why this answer

The winrs utility is the built-in Windows Remote Shell client that uses WinRM (Windows Remote Management) over HTTP (port 5985) or HTTPS (port 5986). It allows an attacker with valid credentials to execute commands interactively on a remote system when SMB is blocked but WinRM is open. The syntax '-r:TargetServer' specifies the remote host, and the command to run (e.g., cmd.exe) is provided at the end.

Exam trap

The trap is selecting a Linux-based tool (rpcclient) or a non-existent utility (mstv) when the question specifies a built-in Windows command-line utility for WinRM. Candidates must know that winrs is the native client for WinRM.

How to eliminate wrong answers

Option A is wrong because rpcclient is a Linux tool for enumerating RPC endpoints and does not provide an interactive remote shell via WinRM. Option B is wrong because nbtstat is a NetBIOS diagnostic tool and has no '-winrm' option; it cannot establish remote sessions. Option C is wrong because 'mstv' is not a real Windows utility; it appears to be a fabricated command.

Practice this question →
30
Multi-Selecteasy

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

Select 2 answers
A.wevtutil cl <LogName>
B.netsh advfirewall reset
C.taskkill /f /im lsass.exe
D.ipconfig /flushdns
E.Clear-EventLog -LogName <LogName>
AnswersA, E

`wevtutil cl <LogName>` clears a specified Windows Event Log directly through the Windows Event Log API, satisfying the requirement to erase activity records during post-exploitation. Unlike PowerShell's `Clear-EventLog`, it works from any command shell and needs no scripting host, so it functions even where PowerShell logging or constrained language mode would expose the tester.

Why this answer

Option A, `wevtutil cl <LogName>`, is correct because wevtutil is the built-in Windows command-line utility for managing event logs, and the `cl` (clear-log) subcommand clears the specified log (e.g., `wevtutil cl Security`), directly serving the goal of erasing log evidence. Option E, `Clear-EventLog -LogName <LogName>`, is correct because it is the native PowerShell cmdlet that clears a specified event log on the local or remote computer, providing the same log-clearing capability through PowerShell. Option B, `netsh advfirewall reset`, is incorrect because it restores Windows Firewall configuration to default, which is unrelated to event log management.

Option C, `taskkill /f /im lsass.exe`, is incorrect because it force-terminates the LSASS process, which would crash the system and does not manage event logs. Option D, `ipconfig /flushdns`, is incorrect because it only clears the DNS resolver cache and has no effect on Windows Event Logs.

Practice this question →
31
Multi-Selecthard

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Select 2 answers
A.tracert <target_ip>
B.ping -t <target_ip>
C.nmap --script smb2-security-mode -p 445 <target_ip>
D.nslookup -type=mx <domain>
E.CrackMapExec (or NetExec) smb <subnet>
AnswersC, E

The smb2-security-mode NSE script negotiates an SMB2 session and reads the signing-required field from the response, reporting whether message signing is enabled and required. This directly satisfies the stem's need to enumerate hosts vulnerable to NTLM relay across the subnet.

Why this answer

Option C is correct because the Nmap NSE script smb2-security-mode queries SMB2 on port 445 and reports the message signing configuration, explicitly showing whether signing is required or not, which directly identifies hosts vulnerable to NTLM relay. Option E is correct because CrackMapExec/NetExec's smb module enumerates SMB hosts across a subnet and reports signing status (e.g., 'signing:False') in its output, making it ideal for quickly sweeping an internal range. Option A (tracert) only maps the network path to a target via ICMP TTL expiry and reveals nothing about SMB configuration.

Option B (ping -t) merely sends continuous ICMP echo requests to test reachability and cannot detect SMB signing. Option D (nslookup -type=mx) queries DNS mail exchanger records and is unrelated to SMB security settings.

Practice this question →
32
MCQmedium

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

A.Use GPP-decrypt to extract credentials from cached XML files.
B.Use PrintSpoofer to trigger a pipe connection from the spooler service.
C.Run Invoke-TokenManipulation to steal a process token.
D.Execute reg add to modify the ImagePath of a system service.
AnswerB

SeImpersonatePrivilege lets a process impersonate tokens from connections it can coerce. PrintSpoofer abuses the spooler service to trigger a named-pipe connection, capturing its SYSTEM token, satisfying the stem's requirement to reach NT AUTHORITY\SYSTEM from a service account.

Why this answer

PrintSpoofer exploits the SeImpersonatePrivilege by coercing the Print Spooler service to connect to a named pipe controlled by the attacker, then impersonating the resulting SYSTEM token. This is a well-known privilege escalation technique on Windows when SeImpersonatePrivilege is available. It directly achieves NT AUTHORITY\SYSTEM escalation.

Exam trap

CPENT often tests privilege escalation primitives, and candidates confuse credential extraction (GPP-decrypt) or generic token theft with the specific SeImpersonatePrivilege abuse technique that leverages the Print Spooler service.

How to eliminate wrong answers

Option A is wrong because GPP-decrypt extracts passwords from Group Policy Preferences XML files (cpassword), which is a credential harvesting technique, not a token impersonation escalation for SeImpersonatePrivilege. Option C is wrong because Invoke-TokenManipulation can steal tokens but requires appropriate privileges and is less reliable for SeImpersonatePrivilege abuse compared to dedicated tools like PrintSpoofer or JuicyPotato. Option D is wrong because modifying a service's ImagePath requires administrative privileges already and is a persistence/execution technique, not an escalation from SeImpersonatePrivilege.

Practice this question →
33
Multi-Selectmedium

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Select 3 answers
A.tasklist /svc
B.dir /s /b config.php
C.whoami /priv
D.systeminfo
E.netsh wlan show profiles
AnswersA, C, D

tasklist /svc enumerates running processes alongside their hosted services, revealing service accounts and privileged processes. This local enumeration satisfies the stem's requirement to gather host information for privilege escalation, exposing potential weak service configurations or credentials.

Why this answer

Option A (tasklist /svc) is correct because it enumerates running processes along with the services hosted in each process, revealing service accounts, potentially privileged processes, and unquoted service paths or vulnerable services that can be leveraged for escalation. Option C (whoami /priv) is correct because it lists the privileges assigned to the current token, such as SeImpersonatePrivilege, SeDebugPrivilege, or SeBackupPrivilege, which directly indicate escalation vectors like token impersonation or Potato-style attacks. Option D (systeminfo) is correct because it returns OS version, build number, hotfix level, and patch information, allowing an attacker to identify missing patches and known kernel or local privilege escalation exploits.

Option B (dir /s /b config.php) is not a Windows local enumeration technique for privilege escalation—it targets a PHP configuration file and is more relevant to web application reconnaissance. Option E (netsh wlan show profiles) only reveals saved wireless network profiles and their SSIDs, which is useful for credential or network discovery but not for local privilege escalation.

Practice this question →
34
MCQhard

A penetration tester has obtained a low-privileged shell on a Windows 10 workstation that is part of an Active Directory domain. The tester discovers that the workstation has Credential Guard enabled and that the current user has local admin rights on a different server. The tester wants to move laterally to the server using the current user's credentials without knowing the plaintext password. Which technique should the tester use to extract the user's Kerberos ticket from memory and reuse it on the target server?

A.Use 'net use \\server\share /user:domain\user' to authenticate to the server with an empty password, relying on cached credentials.
B.Use Mimikatz with the 'sekurlsa::logonpasswords' command to dump clear-text credentials from LSASS memory.
C.Use the Windows built-in 'runas /savecred' command to launch a new process with saved credentials from the Credential Manager.
D.Use Mimikatz with the 'sekurlsa::tickets /export' command to export all Kerberos tickets from memory, then inject the relevant ticket using 'kerberos::ptt'.
AnswerD

With Credential Guard enabled, plaintext passwords and NTLM hashes are protected, but Kerberos tickets may still be extractable from LSASS memory in some configurations. Mimikatz's sekurlsa::tickets /export exports tickets to .kirbi files, and kerberos::ptt injects a ticket into the current session, enabling lateral movement without the plaintext password. This is a standard pass-the-ticket technique that aligns with the scenario's constraints.

Why this answer

When Credential Guard is enabled, clear-text passwords and NTLM hashes are protected, but Kerberos tickets may still reside in memory and can be exported and reused. The tester should extract tickets using Mimikatz's sekurlsa::tickets /export, then inject the appropriate ticket with kerberos::ptt to authenticate to the target server. This pass-the-ticket approach allows lateral movement without knowing the plaintext password, directly addressing the scenario's constraints.

Exam trap

The trap here is assuming that Credential Guard completely prevents any credential theft, but Kerberos tickets can still be extracted and reused for lateral movement.

Practice this question →
35
MCQeasy

A penetration tester has obtained domain administrator credentials for a Windows Active Directory environment. The tester wants to extract the KRBTGT account password hash to create Golden Tickets. Which method is most direct for obtaining this hash?

A.Perform a Kerberoasting attack against the KRBTGT service account.
B.Run Mimikatz with the lsadump::dcsync command targeting the krbtgt account.
C.Use Volume Shadow Copy to copy the NTDS.dit file and extract hashes offline.
D.Run Mimikatz with the sekurlsa::logonpasswords command on a domain-joined workstation.
AnswerB

The lsadump::dcsync command in Mimikatz uses the Directory Replication Service (DRS) protocol to request replication data from a domain controller. With domain administrator privileges, this allows the tester to extract the KRBTGT account hash directly. This method is stealthy and does not require code execution on the domain controller itself, making it a preferred technique for Golden Ticket creation.

Why this answer

DCSync is a technique that impersonates a domain controller to request replication of account data, including password hashes. With domain administrator rights, Mimikatz's lsadump::dcsync can retrieve the KRBTGT hash directly from a domain controller without needing to access the DC's file system. This is the most direct and stealthy method for obtaining the KRBTGT hash to forge Golden Tickets.

Exam trap

The trap here is confusing DCSync with other credential dumping methods; DCSync specifically leverages replication permissions to pull hashes remotely, whereas other methods require local access or target different accounts.

Practice this question →
36
MCQmedium

During a CPENT engagement, you have obtained a low-privileged shell on a Windows Server 2019 host that is a member of an Active Directory domain. You notice the host has the SMB signing requirement disabled. You want to perform lateral movement to other hosts on the network by capturing and relaying authentication attempts. Which tool and technique would best allow you to relay NTLM authentication to a target host where SMB signing is not enforced?

A.Use Responder with the -w flag to capture NTLMv2 hashes and then crack them offline with Hashcat.
B.Use Metasploit's psexec module with the current user's credentials to move laterally.
C.Use Mimikatz to extract plaintext credentials from memory and then use them for lateral movement.
D.Use ntlmrelayx.py from Impacket to relay captured NTLM authentication to the target host's SMB service.
AnswerD

ntlmrelayx.py is designed to relay NTLM authentication to services like SMB, and when SMB signing is disabled on the target, the relay succeeds. It allows immediate code execution or command execution on the target without cracking hashes. This directly addresses the scenario's requirement for lateral movement via relay.

Why this answer

Relaying NTLM authentication is a powerful lateral movement technique when SMB signing is not enforced. The tool ntlmrelayx.py from Impacket is specifically built to relay authentication to SMB and other protocols. With SMB signing disabled on the target, the relayed authentication is accepted, allowing the attacker to execute commands or dump SAM hashes.

This avoids the need to crack captured hashes and directly leverages the authentication attempt.

Exam trap

The trap here is confusing hash capture and cracking with relay attacks; capturing NTLM hashes does not automatically enable lateral movement unless you can relay them to a service that does not enforce signing.

Practice this question →
37
MCQeasy

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

A.Append a new user account to the /etc/passwd file by leveraging a kernel exploit
B.Modify the /etc/sudoers file directly using a buffer overflow vulnerability
C.Inject shellcode into the target binary's memory space using GDB while running under sudo
D.Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command
AnswerD

Because the sudo binary calls system() with a relative 'tar' path, the shell resolves it via PATH. Prepending a malicious directory containing a fake tar binary causes sudo to execute it as root, satisfying the stem's relative-path constraint.

Why this answer

By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.

Practice this question →
38
MCQeasy

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

A.Creating a hidden scheduled task.
B.Modifying the default shell via Winlogon.
C.Replacing the utilman.exe binary with cmd.exe.
D.Adding an entry to the Run registry key in the current user hive.
AnswerD

The HKCU Run key is read by Explorer at each user logon and launches its listed programs automatically, giving per-user persistence without administrative rights, which satisfies the requirement for an automatic startup mechanism triggered during login.

Why this answer

The Run registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) is a documented Windows autostart extensibility point that executes programs automatically when the current user logs in. Adding an entry here provides user-level persistence that survives reboots and requires no special privileges, making it one of the most common and reliable persistence mechanisms.

Exam trap

CPENT often tests the distinction between persistence mechanisms — candidates may confuse privilege-escalation backdoors (utilman.exe swap) or system-wide shell modifications (Winlogon) with user-level login persistence (Run key).

How to eliminate wrong answers

Option A is wrong because while scheduled tasks can provide persistence, they are not the 'automatic startup mechanism that executes during user login' — they are a separate task-scheduling mechanism and are more heavily monitored. Option B is wrong because modifying the Winlogon shell (Shell value under HKLM\...\Winlogon) replaces the entire user shell and is a system-wide, high-privilege change, not a per-user login startup mechanism. Option C is wrong because replacing utilman.exe with cmd.exe is an accessibility-feature backdoor used for privilege escalation at the logon screen, not a login-time persistence mechanism.

Practice this question →
39
MCQhard

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

A.The target must have the Remote Registry service disabled.
B.The target must be running Windows 10 or higher.
C.You must have the plaintext password of the target account.
D.The target must have NTLM authentication enabled in the local security policy.
AnswerD

Pass-the-Hash replays a captured NTLM hash directly, so the target must accept NTLM authentication; if NTLM is disabled by local or domain policy, the forged credentials are refused and lateral movement fails. Enabling NTLM in the local security policy therefore satisfies the attack's mandatory prerequisite.

Why this answer

Pass-the-Hash (PtH) works by using the NTLM hash of a user's password to authenticate via NTLM, bypassing the need for the plaintext password. For this to succeed, the target system must accept NTLM authentication. If NTLM is disabled in the local security policy (e.g., via 'Network security: Restrict NTLM' settings), the attack fails because the hash cannot be used.

Thus, the mandatory prerequisite is that NTLM authentication is enabled on the target.

Exam trap

CPENT often tests the misconception that Pass-the-Hash requires the plaintext password or specific Windows versions, when the core prerequisite is simply that NTLM authentication is enabled on the target.

How to eliminate wrong answers

Option A is wrong because disabling the Remote Registry service does not prevent Pass-the-Hash; it only blocks remote registry access, which is unrelated to NTLM authentication. Option B is wrong because Pass-the-Hash works on many Windows versions, including older ones like Windows 7 and Server 2008, not just Windows 10 or higher. Option C is wrong because Pass-the-Hash specifically does not require the plaintext password; it uses the NTLM hash directly.

Practice this question →
40
MCQmedium

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

A.Modify /etc/passwd inside the container to add a root user.
B.Run 'docker run -v /:/hostfs --rm -it alpine chroot /hostfs' to mount the host root directory inside a new container.
C.Send a SIGKILL signal to the docker daemon process via kill -9 1.
D.Execute 'sudo su' inside the container environment.
AnswerB

Mounting the host root filesystem into a new container via the exposed socket grants direct read/write access to host files, effectively escaping isolation. The Docker daemon runs as root on the host, so any container it launches inherits that privilege.

Why this answer

Access to /var/run/docker.sock allows the container to interact with the host's Docker daemon. The tester can spin up a new container that mounts the host's root filesystem (/) and provides a chroot or direct execution shell on the host.

Practice this question →
41
MCQmedium

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

A.The NTLM hash (or AES keys) of the krbtgt service account.
B.The krbtgt account's public SSH key stored in Active Directory.
C.The global catalog server IP address and LDAP bind credentials.
D.The Domain Administrator's plaintext password.
AnswerA

Forging a Golden Ticket requires encrypting the forged TGT with the krbtgt account's key, so possessing its NTLM hash or AES keys lets the attacker mint valid tickets offline, granting domain-wide persistence without further authentication.

Why this answer

A Golden Ticket is forged using the KRBTGT account's NTLM hash (or AES keys), which allows the attacker to generate valid Kerberos Ticket Granting Tickets (TGTs) for any user.

Practice this question →
42
Multi-Selecteasy

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Select 2 answers
A.wmic useraccount get name
B.ipconfig /all
C.net user
D.tasklist /v
E.systeminfo
AnswersA, C

The wmic useraccount get name query reads the Win32_UserAccount class through WMI, returning local account names without extra tooling. It satisfies the enumeration goal, letting the tester identify high-privileged accounts for potential escalation on the compromised Windows host.

Why this answer

Option A, `wmic useraccount get name`, is correct because the WMIC `useraccount` alias queries the Win32_UserAccount WMI class and returns the names of all local user accounts, which is exactly what the tester needs for enumeration. Option C, `net user`, is correct because running it without arguments lists every local user account on the system, a classic built-in method for identifying accounts including privileged ones. Option B, `ipconfig /all`, only displays network adapter configuration such as IP addresses, MAC addresses, and DNS servers, so it does not enumerate users.

Option D, `tasklist /v`, lists running processes with verbose details and has nothing to do with local account enumeration. Option E, `systeminfo`, shows OS version, hotfixes, and hardware information but does not list local users or groups.

Practice this question →
43
MCQmedium

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

A.Get-WmiObject -ComputerName TargetHost -Class Win32_Process
B.Start-Process -FilePath "powershell.exe" -Credential ...
C.Invoke-Command -ComputerName TargetHost -ScriptBlock { ... }
D.Enter-PSSession -ComputerName TargetHost
AnswerC

Invoke-Command with -ComputerName and -ScriptBlock establishes a WinRM session over HTTP/5985 or HTTPS/5986, executing the script block remotely on the trusted host. This satisfies the requirement to run commands through WinRM rather than SMB or WMI.

Why this answer

Invoke-Command allows running script blocks or scripts on local or remote computers using WinRM.

Practice this question →
44
MCQhard

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

A..kirbi
B..ntds
C..sam
D..pfx
AnswerA

Mimikatz exports Kerberos tickets in the .kirbi format, a base64-encoded structure holding the ticket's encrypted blob and session key. This satisfies the stem's Pass-the-Ticket requirement, since the .kirbi file can be re-injected into a session via kerberos::ptt to impersonate the victim without knowing their password.

Why this answer

Mimikatz uses the .kirbi file extension to save exported Kerberos tickets.

Practice this question →
45
MCQeasy

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

A.It allows remote attackers to execute system calls over ICMP tunneling.
B.Any local user can execute commands as root by passing malicious arguments to the SUID binary.
C.The system is immune to local privilege escalation because SUID is disabled by SELinux.
D.It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.
AnswerD

The SUID bit makes /bin/ping run as root regardless of the invoking user, so any flaw permitting command execution or shell escape yields a root shell. This satisfies the scenario's implication: privilege escalation risk from owner-privilege execution.

Why this answer

The SUID bit causes /bin/ping to execute with the effective UID of its owner (root) rather than the invoking user, which is why unprivileged users can open raw ICMP sockets. If the binary contains a vulnerability — buffer overflow, command injection, or an unsafe system()/exec() call — or if it can be coerced into spawning a shell, the attacker inherits root privileges, making it a classic local privilege escalation vector.

Exam trap

The trap is assuming SUID automatically equals instant root — the correct reasoning is that SUID elevates the binary's privileges, and exploitation requires a flaw or unsafe behavior in that specific binary.

How to eliminate wrong answers

Option A is wrong because SUID on ping has nothing to do with ICMP tunneling; ICMP tunneling is a covert-channel technique that abuses the protocol itself, not the SUID bit. Option B is wrong because SUID does not automatically let any user run arbitrary commands as root — it only elevates the binary's own execution context, and exploitation requires a flaw or unsafe behavior in that specific binary. Option C is wrong because SELinux does not 'disable' SUID; it may confine the binary with a policy (e.g., ping_t), but the statement is a blanket false claim and SELinux is not even guaranteed to be enabled or enforcing.

Practice this question →
46
MCQeasy

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

A.Run a batch script that directly modifies the SAM database registry hive.
B.Execute a local exploit targeting the Print Spooler service via named pipes.
C.Generate a malicious MSI file using msfvenom and execute it using msiexec /quiet /qn /i exploit.msi.
D.Extract plaintext credentials from the lsass.exe process memory.
AnswerC

AlwaysInstallElevated set in both HKCU and HKLM lets any user install MSI packages with SYSTEM privileges. A crafted MSI executed via msiexec with /quiet /qn runs its payload as SYSTEM, escalating from the current user to full administrative control.

Why this answer

AlwaysInstallElevated allows MSI packages to be installed with elevated (NT AUTHORITY\SYSTEM) privileges. The tester can generate a malicious MSI file using msfvenom and install it silently.

Practice this question →
47
MCQmedium

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

A.Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.
B.Modify the /etc/exports file on the remote target directly via standard FTP.
C.Mount the NFS share using standard user privileges and create a standard user shell script.
D.Log into the NFS server directly via SSH using the exported share credentials.
AnswerA

With no_root_squash, the client's root UID is preserved on the share, so mounting as root and copying bash lets the tester chmod +s it, creating a root-owned SUID binary. This satisfies the requirement to write a SUID shell to the NFS export.

Why this answer

With no_root_squash enabled, the NFS server maps the root user on the client to root on the server, so a client that mounts the share as root can create files owned by root with the SUID bit set. Copying /bin/bash to the share and running chmod +s on it produces a root-owned SUID shell that, when executed on the target, grants root privileges. This is the classic no_root_squash privilege escalation.

Exam trap

CPENT often tests whether candidates understand that no_root_squash only helps if the client mounts as root; candidates frequently assume any user can exploit the share, missing the UID-mapping requirement.

How to eliminate wrong answers

Option B is wrong because /etc/exports is a server-side configuration file that controls which shares are exported and with what options; it cannot be edited over FTP, and doing so would not be the exploitation step for no_root_squash. Option C is wrong because mounting as a standard user means the client's UID is not root, so files created on the share are owned by that unprivileged UID and the SUID bit will not yield root — no_root_squash specifically requires the client to be root. Option D is wrong because NFS exports do not provide SSH credentials, and logging in via SSH is unrelated to exploiting the share's export options.

Practice this question →
48
MCQmedium

During a CPENT engagement, a tester gains a low-privileged shell on a Windows Server 2019 host. The tester runs 'whoami /priv' and sees SeImpersonatePrivilege enabled. The host is running IIS with a service account that has this privilege. Which tool is most appropriate to escalate privileges by leveraging this token privilege?

A.Juicy Potato
B.PrintSpoofer
C.RoguePotato
D.Sweet Potato
AnswerB

PrintSpoofer exploits SeImpersonatePrivilege by abusing the Print Spooler service to create a named pipe and impersonate a SYSTEM token. It works reliably on Windows Server 2019 without needing external redirects, making it ideal for this scenario where the privilege is enabled.

Why this answer

SeImpersonatePrivilege allows a process to impersonate a token, and PrintSpoofer leverages this by coercing the Print Spooler service to authenticate to a controlled named pipe, resulting in SYSTEM impersonation. Unlike older tools, it does not rely on port binding or remote redirects, making it highly effective on modern Windows Server 2019.

Exam trap

The trap here is assuming that any SeImpersonatePrivilege exploit will work universally, but newer Windows builds patched many COM-based techniques, making PrintSpoofer a more reliable choice.

Practice this question →
49
MCQhard

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

A.Initiating an RDP cliprdr channel file transfer.
B.Writing a payload to the target's startup folder via FTP.
C.Injecting shellcode into the lsass.exe process over WinRM.
D.Copying an executable to the ADMIN$ share and creating a remote Windows service via the Service Control Manager (SCM).
AnswerD

PsExec copies its service executable to the target's ADMIN$ share, then instructs the Service Control Manager over remote RPC to register and start that binary as a Windows service. The SCM launches the payload under SYSTEM context, satisfying the remote execution requirement.

Why this answer

PsExec connects to the remote ADMIN$ share, uploads a service executable (such as Psexecsvc.exe), and then creates and starts a Windows service using the Service Control Manager (SCM) via RPC.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Privilege Escalation Lateral Movement And Post Exploitation questions.

Start 20-question session