Hard Difficulty Questions

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Why it fails: /dev/shm is a tmpfs backed by container-local memory, not a host filesystem path, so writes there never reach the host's /etc/passwd. It is tempting because shared memory sounds host-accessible, and would be correct if a host directory were bind-mounted into the container.

Using the ptrace system call to inject code into the host's systemd daemon process.

Why it fails: CAP_SYS_ADMIN does not bypass the ptrace access checks that block tracing processes outside the container's PID namespace, such as host systemd. It is tempting because CAP_SYS_ADMIN is powerful, and ptrace injection would be correct were the container running with --pid=host and shared process visibility.

Issuing a mount command to repartition the host's primary storage block device.

Why it fails: CAP_SYS_ADMIN permits mounting filesystems, not raw block-device repartitioning, which requires CAP_SYS_RAWIO and access to the host's block device nodes. It is tempting because mount is the classic cgroup v1 escape, and would be correct when abusing the release_agent path instead.

arp -a

Why it fails: arp -a lists the neighbour cache, exposing hosts on the local segment, not sudo privileges. It tempts during network reconnaissance or lateral-movement mapping, and would be correct for enumerating adjacent systems, but sudo escalation needs sudo -l, sudoers file review, and checks for editable scripts or LD_PRELOAD rights.

uname -r

Why it fails: uname -r prints the kernel release and reveals nothing about sudoers entries or permitted commands. It tempts because kernel version maps to known local exploits, and would be correct when hunting kernel-level escalation, but sudo misconfiguration requires reading /etc/sudoers via sudo -l and checking NOPASSWD or wildcard entries.

UDP 1900

Why it fails: UDP 1900 carries SSDP, the discovery component of UPnP, used by devices to advertise and locate services on a LAN, not CoAP messaging. It is tempting because smart meters and IoT devices commonly enable UPnP discovery, but it would be the correct target when probing for UPnP-exposed services rather than crafting CoAP requests.

UDP 5353

Why it fails: UDP 5353 carries multicast DNS, used for local service discovery such as mDNS and DNS-SD, and no CoAP endpoint listens there by default. It is tempting because both protocols are UDP-based and lightweight for constrained devices, but it would be the correct target when enumerating printers or IoT services advertising via Bonjour.

UDP 5060

Why it fails: UDP 5060 carries SIP signalling, not CoAP, so no CoAP request would reach the smart meter's service. It is tempting because SIP also runs over UDP and appears in VoIP and embedded-device assessments, where 5060 would indeed be the correct target for interrogating a SIP endpoint.

The target must have the Remote Registry service disabled.

Why it fails: Pass-the-Hash authenticates using the NTLM hash directly, so it never contacts the Remote Registry service; disabling that service neither enables nor blocks the attack. Remote Registry is instead relevant to remote registry reconnaissance and configuration tampering, where an operator needs to read or modify keys on a distant host.

The target must be running Windows 10 or higher.

Why it fails: Pass-the-Hash exploits the NTLM authentication protocol, which remains present across Windows versions, so a Windows 10 baseline is irrelevant to the domain controller scenario. The version requirement would matter only when targeting features introduced in a specific release, not for replaying a captured NTLM hash.

You must have the plaintext password of the target account.

Why it fails: Pass-the-Hash specifically avoids needing the plaintext password: the attacker submits the captured NTLM hash to authenticate. Plaintext credentials are required for other techniques, such as explicit credential logon or Kerberos-based attacks, where the password itself must be supplied rather than a hash.

Disable Kerberos pre-authentication across all domain controller computer accounts.

Why it fails: Kerberos pre-authentication is unrelated to AD CS abuse; disabling it weakens authentication and enables AS-REP roasting. It is tempting as a hardening-sounding account change, and would be correct where the goal is reducing authentication traffic, though that never justifies removing a security control.

Enforce unconstrained delegation on all certificate authority servers.

Why it fails: Unconstrained delegation lets any service on those hosts impersonate users to any resource, worsening ESC abuse rather than remediating it. It is tempting because delegation is a legitimate CA configuration, and would be correct where a service genuinely must authenticate to arbitrary back-end resources on a user's behalf.

Use standard FTP data channels over ephemeral ports to push archives to an external staging server

Why it fails: FTP data channels use ephemeral TCP ports, all of which the egress firewall blocks; only port 53 is permitted. FTP is tempting because it moves large archives efficiently, and it would be correct where outbound high ports are unrestricted.

Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets

Why it fails: ICMP is not TCP or UDP, so it is not covered by the port-53 exception; the firewall blocks ICMP outright, and DNS monitoring is irrelevant to it. ICMP tunnelling is tempting as a covert channel, and would be correct where ICMP echo is permitted through the firewall.

Establish an HTTPS connection to an external IP address using port 443

Why it fails: Port 443 is blocked by the egress firewall, which permits only port 53, so the HTTPS connection never leaves the network. It is tempting because HTTPS over 443 is the standard covert channel when firewalls allow web traffic, and would be correct in an environment permitting outbound TLS.

The user can extract the master node's etcd database encryption keys.

Why it fails: Reading etcd encryption keys requires access to the control plane's filesystem or etcd itself, typically via hostPath mounts or node access. The create verb on pods/exec only opens an exec session inside a running container, which does not expose master node key material.

The user can modify the cluster's underlying cloud provider IAM policies.

Why it fails: Cloud provider IAM policies are managed through the provider's API, not Kubernetes RBAC verbs. The create verb on pods/exec permits exec sessions inside containers; modifying IAM policies needs cloud credentials or workload identity permissions, which this role does not confer.

The user can bypass network policies by altering iptables rules on the host node.

Why it fails: The create verb on pods/exec grants spawning exec subresources inside existing pods, yielding command execution in those containers, not host-level iptables manipulation. Altering node iptables requires host access via privileged pods or node compromise, a separate privilege entirely.

-sN

Why it fails: -sN sends a packet with no TCP flags set at all, so it cannot carry FIN, PSH and URG simultaneously. It is tempting because it is likewise a flagless stealth scan that slips past some packet filters, and it would be correct when probing ports without setting any control bits.

-sF

Why it fails: -sF transmits only the FIN flag, producing a bare FIN scan rather than the FIN, PSH and URG combination. It is tempting because it is also a flag-based stealth scan that evades some stateless filters, and it would be correct if the requirement were simply to send a lone FIN probe.

-sW

Why it fails: -sW is the TCP window scan, which reads the window field of returned RST packets to infer port state; it sets no FIN, PSH or URG flags. It is tempting as another non-connect scan, and it would be correct on systems where window size reliably distinguishes open from closed ports.

Query Active Directory for the ms-DS-MachineAccountQuota attribute on the domain object to determine which machines allow unsigned SMB.

Why it fails: The ms-DS-MachineAccountQuota attribute controls how many computer accounts a non-privileged user may create in the domain; it has no relationship to SMB signing enforcement on individual hosts. Reading it tells you about account creation rights, not about whether a particular server will accept unsigned SMB sessions. It cannot distinguish relay-feasible targets from hardened ones.

Enable the LanmanServer service on each target and set the RequireSecuritySignature registry value to 0 before testing.

Why it fails: Modifying the target's registry to weaken signing is a destructive change that alters the environment under test and invalidates the engagement. A penetration tester must observe the existing configuration, not change it to manufacture a finding. This action would also require administrative access that the scenario does not grant, and it defeats the purpose of identifying genuinely vulnerable hosts.

Perform a broadcast NetBIOS name query for each host to read the SMB signing flag from the node status response.

Why it fails: A NetBIOS name query returns name and role information from the target's NetBIOS name table; it does not carry SMB2 negotiate data and therefore exposes no signing configuration. SMB signing enforcement is negotiated in the SMB2/3 negotiate response, which requires an actual SMB connection. This action cannot produce the required list of signing-disabled hosts.

.ntds

Why it fails: The .ntds file is an Active Directory database extract, not a Kerberos ticket container, so Mimikatz cannot export tickets into it. It is tempting because .ntds is genuinely used in credential-extraction workflows, such as dumping domain password hashes with secretsdump, but that scenario concerns offline hash cracking rather than Pass-the-Ticket.

.sam

Why it fails: The .sam extension denotes the Security Account Manager hive, which stores local password hashes rather than Kerberos tickets, so it cannot hold the credential material Pass-the-Ticket replays. It is tempting because Mimikatz does target SAM for hash dumping, and that hive would be the right artefact when harvesting local NTLM hashes for Pass-the-Hash.

.pfx

Why it fails: A .pfx file stores X.509 certificate and private key material, not Kerberos tickets, so Mimikatz cannot export TGTs or service tickets into it. It is tempting because .pfx is genuinely used to bundle certificates for TLS client authentication or smart-card logon, which would be the right answer if the question asked about certificate-based authentication rather than Pass-the-Ticket.

The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.

Why it fails: WriteDACL over the CA object describes ESC7-style CA-level ACL abuse, not a template misconfiguration. It is relevant when assessing CA object permissions, but ESC1 is defined at the certificate template: a template that lets the requester specify a subject alternative name and grants low-privileged users enrolment rights.

The template publishes certificates to Active Directory user objects automatically.

Why it fails: Automatic publication to user objects is a separate enrolment setting, unrelated to ESC1's privilege escalation path. It matters when auditing certificate autoenrolment scope, but ESC1 specifically requires a template permitting the requester to supply a subject alternative name combined with low-privileged enrolment rights.

The template has Manager Approval enabled and requires enterprise admin signatures.

Why it fails: Manager approval and enterprise admin signatures are hardening controls that mitigate abuse, not the ESC1 misconfiguration itself. Such restrictions are desirable in high-assurance templates; ESC1 instead hinges on enrollee-supplied subject alternative names plus broad enrolment rights, letting any user request a certificate impersonating another principal.

Snort

Why it fails: Snort is a signature-based network intrusion detection system inspecting packet traffic; it cannot disassemble or decompile an ELF binary. It is tempting because both support security analysis, but static reverse engineering of auth_service needs Ghidra, which handles ARM ELF disassembly and decompilation.

Autopsy

Why it fails: Autopsy is a digital forensics platform for disk images and file-system artefacts, performing no disassembly or decompilation of ELF binaries. It is tempting because firmware analysis involves examining extracted file systems, but static binary reverse engineering of auth_service requires Ghidra, the NSA framework.

Wireshark

Why it fails: Wireshark captures and dissects network protocol traffic; it performs no static analysis of ELF binaries. It is tempting because firmware investigation often includes traffic inspection, but disassembling and decompiling auth_service requires Ghidra, the NSA-developed reverse engineering framework.

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Why it fails: Aircrack-ng targets 802.11 Wi-Fi WPA-PSK handshakes and keys, not 802.15.4 frames or Zigbee network keys. It tempts because it is a familiar wireless auditing suite, but Zigbee operates on a different radio standard requiring dedicated 802.15.4 sniffing and injection hardware.

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Why it fails: msfvenom generates Windows Meterpreter payloads for host compromise and Active Directory persistence, none of which touch 802.15.4 or Zigbee radio traffic. It tempts because Metasploit is a staple penetration-testing framework, but Zigbee assessment needs radio-layer capture and injection tools.

Burp Suite Professional for intercepting HTTP requests from web applications

Why it fails: Burp Suite Professional intercepts HTTP and HTTPS traffic from web applications, operating at the application layer, whereas Zigbee runs over 802.15.4 at the link layer. It tempts for IoT web interfaces, but assessing Zigbee frames requires 802.15.4-aware sniffing and injection tooling.

John the Ripper

Why it fails: John the Ripper cracks password hashes offline after capture; it does not sniff or parse live network traffic. It tempts because it recovers credentials, but that occurs post-capture against hash files, whereas the scenario requires on-the-wire interception tools such as Wireshark or Ettercap.

Sqlmap

Why it fails: Sqlmap automates SQL injection against database endpoints; it neither captures nor parses network authentication traffic. It tempts because it extracts credentials from vulnerable databases, but that requires an injection point, not a man-in-the-middle position, so it cannot intercept ARP-spoofed traffic.

FTP

Why it fails: FTP is a file-transfer protocol and sends no ARP frames at all, so it cannot poison a switch's ARP cache or sustain a man-in-the-middle position. It is tempting because it also operates at the application layer over IP networks, but it would only be the right answer for transferring files to or from a compromised host.

Ping

Why it fails: Ping uses ICMP echo request and reply packets, which carry no ARP payload and therefore cannot rewrite a target's ARP cache entry. It is tempting because it is a lightweight, low-frequency network utility, but it would be the correct choice only for reachability testing or host discovery, not cache poisoning.

Telnet

Why it fails: Telnet is a cleartext remote-shell protocol; it transmits no forged ARP replies and cannot alter any host's IP-to-MAC mapping. It is tempting because it is a low-volume interactive tool, but it would be the right answer only for logging into a remote device or testing whether a TCP port is listening.

AD CS ESC8 NTLM relay attacks

Why it fails: ESC8 targets HTTP enrollment endpoints, independent of cross-forest trust filters.

Standard Kerberoasting against domain controllers

Why it fails: Kerberoasting is unrelated to trust SID filtering configurations.

Unconstrained delegation exploitation via print spooler

Why it fails: Print spooler abuse relies on unconstrained machine accounts, not trust filters.

Mount the Docker socket inside the container using the mount syscall enabled by CAP_SYS_ADMIN.

Why it fails: Incorrect. CAP_SYS_ADMIN alone does not automatically mount the Docker socket unless explicitly configured.

Execute the 'docker run' command inside the container to spin up a sibling container.

Why it fails: Incorrect. The Docker CLI inside a container cannot talk to the host daemon unless the socket is explicitly mounted.

Write directly to the host's /proc/sysrq-trigger file without any additional mounts.

Why it fails: Incorrect. /proc is typically container-namespaced unless explicitly mounted from the host.

Disable all TCP and UDP ports on the SCADA network switches

Why it fails: Disabling all TCP and UDP ports would halt SCADA communications entirely, breaking industrial control processes. The goal is to constrain traffic to necessary flows, not eliminate connectivity. Port-level filtering via firewalls or ACLs, permitting only required protocol traffic between known hosts, is the compensating control.

Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

Why it fails: PLCs run real-time operating systems and often cannot host traditional antivirus agents without risking process disruption or violating vendor certification. Network segmentation, protocol-aware firewalls, and monitoring are viable compensating controls. Endpoint antivirus belongs on general-purpose IT hosts, not embedded industrial controllers.

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Why it fails: SSH is used for secure shell remote logins, not for connecting to CoAP/DTLS services.

nc -u 192.168.1.50 5684

Why it fails: Netcat (nc) does not handle DTLS handshaking or Pre-Shared Key cryptography natively.

telnet 192.168.1.50 5684

Why it fails: Telnet operates in cleartext and cannot negotiate DTLS or handle PSK cipher suites.

Flashing a modified bootloader directly onto the physical SPI flash chip using a desoldered programmer

Why it fails: SPI flash chip flashing is a physical hardware manipulation technique, not a static software file system analysis step.

Capturing over-the-air 802.11 management frames using Wireshark

Why it fails: Packet capturing is a dynamic wireless monitoring technique, not static firmware analysis.