GIAC Penetration Tester (GPEN) — Questions 76–150

MSCache v2 hashes are stored in the registry under SECURITY\Cache and are used for offline domain logon. Hashcat mode 2100 is specifically designed to crack these Domain Cached Credentials 2 hashes. Since the scenario involves a cached domain credential from a workstation, mode 2100 is the correct mode to use for offline cracking.

The 'Contributor' role on a subscription allows management of Azure resources but not Azure AD objects. Adding a user to an Azure AD group requires Azure AD permissions, which the managed identity lacks. Therefore, the attacker cannot perform this action with the given role.

Even if the target is vulnerable, the exploit might fail due to environmental factors like antivirus, system stability, or specific patch levels not caught by the scanner. This is a common real-world failure mode where the vulnerability check passes, but the actual payload delivery or execution is blocked by security controls.

The NSE is designed to interact with services on an application level, such as sending HTTP requests or querying databases. This provides context beyond simple port status, allowing testers to confirm if a service is actually functioning and to gather metadata like site titles or server versions.

NTLM does not require the server to prove its identity to the client. This architectural flaw enables attackers to capture a client's authentication challenge and relay it to another server, effectively masquerading as the user without ever having to crack the password or hash.

The TCP ACK scan sends ACK packets to target ports. A stateless firewall will typically pass ACK packets or drop them based on simple rules, while a stateful firewall will drop unsolicited ACK packets because they do not belong to an established connection. By comparing responses to ACK packets on allowed and disallowed ports, you can infer whether the firewall is stateful.

If a script contains a cleartext password, an attacker who reads the file can immediately authenticate as the user or service account without the need for any complex cracking or relaying. This bypasses all authentication controls, providing direct access to whatever resources that account has been granted.

Researching specific CVEs for the identified CMS version allows the tester to understand the vulnerability's nature and impact. This information is crucial for planning a safe and effective exploitation strategy. It ensures that the subsequent testing phase is focused on valid attack vectors, minimizing the risk of unnecessary system downtime.

Malware often installs itself as a service to ensure it runs with high privileges upon system startup. An unrecognized service running as SYSTEM is a major red flag that warrants immediate investigation, as it is a common method for achieving both persistence and privilege escalation on Windows servers.

Pass-the-Hash leverages the NTLM hash to authenticate to remote services without knowing the plaintext password. Mimikatz's sekurlsa::pth command injects the hash into a new session, enabling access to SMB shares or other services that accept NTLM authentication. This is a core technique in penetration testing, as it bypasses the need to crack the hash.

The encryption type (e.g., RC4_HMAC_MD5 or AES256_CTS_HMAC_SHA1_96) determines the speed and difficulty of cracking. RC4 tickets are encrypted with the service account's NTLM hash, which is faster to crack than AES tickets that use stronger key derivation. Therefore, the encryption type directly impacts the cracking success rate and time.

Kerberoasting relies on the KDC encrypting a service ticket with the target service account's password. The attacker requests this ticket and then attempts to brute-force the password offline. Possessing the NTLM hash of the account does not provide the encrypted TGS blob needed for this specific offline cracking methodology.

Under HIPAA, PHI must be protected with appropriate administrative, physical, and technical safeguards. If testers extract PHI as proof of vulnerability, they must encrypt it in transit and at rest, and securely destroy it when no longer needed. This procedure directly addresses the confidentiality and security of PHI, making it the most critical element. It ensures compliance and reduces the risk of a data breach during the penetration test.

Mode 5600 is engineered precisely for cracking NetNTLMv2 hashes gathered via protocol coercion or LLMNR poisoning. It correctly structures the username, domain, server challenge, client challenge, and response fields so Hashcat can execute the required HMAC-MD5 cryptographic validation loops during brute-forcing.

With Contributor role on the subscription, the managed identity can create, modify, or delete any resource. Since the HTTP trigger is unauthenticated, anyone can invoke the function and have it perform actions using that identity. This could allow an attacker to escalate privileges, deploy malicious resources, or delete critical assets.

Union-based SQL injection allows you to append a second query to the original and directly retrieve data in the application's response. It is efficient and does not require delays or error triggering. By crafting a UNION SELECT statement, you can extract database schema, table names, and column names quickly. This method is safe if the number of columns matches and the data types are compatible.

Heap management structures store critical information about memory blocks. By corrupting these headers, an attacker can trick the allocator into writing data to an arbitrary memory location. This 'write-what-where' primitive is the foundational goal of heap exploitation, allowing for sophisticated control over the application's execution flow.

Some scanners test for SQL injection by injecting payloads into HTTP headers such as User-Agent or Referer, even if the page has no user input. If the application logs these headers into a database without proper sanitization, the scanner might detect a vulnerability. This can cause a false positive if the page itself is not vulnerable but the logging mechanism is, or if the scanner misinterprets the response.

A hybrid attack merges dictionary words with a mask, such as appending two digits to each word. This is highly effective against passwords that follow common patterns like 'password123'. Since NTLM hashes are fast to compute, hybrid attacks can quickly test a large number of combinations derived from common words. This technique balances efficiency and coverage, making it a preferred method for penetration testers aiming to recover passwords within a reasonable timeframe. It targets the human tendency to use predictable variations.

WHOIS and ASN records are public registries that document which netblocks an organization owns or leases. Reviewing them requires queries to registry databases, not to the target's IP space, so the activity remains passive. The resulting netblock map is essential for scoping later queries against third-party scan databases and for understanding the organization's internet footprint.

With a unique salt per entry, two users with the same password will have completely different hashes stored in the database. This obscures the fact that they are using the same password, which is a major security benefit when a database is compromised, as attackers cannot easily spot patterns.

A Golden Ticket is a forged TGT signed with the krbtgt account's NTLM hash. It remains valid until the krbtgt password is changed twice, so it survives normal Domain Admin password resets and reboots. Because it is generated on demand and not written to disk, it is stealthy and does not rely on a persistent binary, matching the scenario's constraints precisely.

SUID binaries owned by root execute with root privileges. If the binary is vulnerable to buffer overflows or path injection, an attacker can hijack the execution flow to launch a root shell. This is a classic and highly effective privilege escalation path on many legacy Linux systems.

Organizations often monitor for scanning activity and blacklist source IPs associated with malicious behavior. By using non-attributable sources, the tester ensures that if one source is detected and blocked, the testing engagement can continue from another, thus preventing a single block from prematurely ending the reconnaissance phase.

LHOST is the essential configuration setting that dictates where the victim machine should send the reverse connection. If this is incorrect, the target will attempt to connect to the wrong address, and the listener will never receive the connection, resulting in a failed exploitation attempt during the test.

The 'Escalation' field identifies the emergency contact form as the correct reporting channel. Since the finding is critical, the tester must escalate it immediately, even though it is outside the standard testing window. This balances the need for adherence to testing hours with the urgency of a critical finding.

AccessChk allows efficient command-line auditing of DACLs on files, directories, and services. Identifying weak permissions where standard users hold write or modify rights on service binaries enables successful replacement of legitimate executables with malicious payloads.

A BAA is required under HIPAA whenever a covered entity shares PHI with a business associate, including a penetration tester. By signing a BAA, you contractually agree to safeguard PHI and are legally permitted to access it during testing. Ensuring your infrastructure is covered prevents gaps if data is stored or processed on your systems.

In an NTLM authentication flow, the hash is the credential. If an attacker possesses the hash, they can present it to an authentication service, and the service will accept it as proof of identity. This bypasses the need to know the plaintext password entirely.

Hashcat mode 5600 is specifically designed for NetNTLMv2 (also called NTLMv2) challenge-response pairs captured from network traffic. It correctly parses the username, domain, server challenge, and response fields to perform an offline dictionary or brute-force attack. This is the correct mode because the scenario involves a captured challenge-response pair, not a raw NT hash. Using the wrong mode would result in errors or no cracks.

iodine is a DNS tunneling tool that encodes IPv4 data within DNS queries and responses, typically using NULL or TXT record types. It creates a virtual network interface (dns0) and can tunnel IP traffic through a DNS server you control. It is specifically designed for this purpose and is widely used in penetration testing to bypass captive portals and egress filtering.

Disabling SMB signing permits valid authentication responses captured from one victim machine to be forwarded directly to the target system. The target accepts the relayed session because it does not cryptographically verify the message origin or session keys.

A world-writable script executed by a root cron job is a classic privilege escalation vector. Since any user can modify the script, you can inject commands that will run as root when the cron job executes. This directly leads to privilege escalation. Defenders should ensure that scripts executed by privileged cron jobs are not writable by unprivileged users. This scenario is highly likely to allow escalation.

Throttling and reducing concurrency lower the load on the network and target devices. This helps prevent overwhelming legacy systems and IoT devices, which may have low bandwidth or processing power. By pacing the scan, the tester can avoid disruptions while still collecting vulnerability data over a longer period.

If the hashing algorithm is weak or lacks a salt, an attacker can crack the database in bulk regardless of the complexity enforced by the policy. A strong hashing algorithm acts as the final line of defense, rendering stolen hash files useless even when the database is fully compromised.

Scheduled tasks offer diverse triggers like system startup, user login, or specific time intervals. This granularity allows attackers to time their activity for periods of low system usage or to ensure their code runs reliably after reboots, maximizing the longevity of the persistent connection to the target system.

Specifying the encryption standards ensures that the sensitive data collected during the test is protected from unauthorized access at all times. By documenting these standards, both the client and the tester agree on the security measures required to protect the information throughout the duration of the engagement.

FAST (Flexible Authentication Secure Tunneling) establishes a secure tunnel between the client and the KDC for the AS-REQ/AS-REP exchange. This prevents attackers from sniffing credentials or tampering with the initial ticket request process, hardening the domain against several common Kerberos-based attacks.

Querying WHOIS databases is a passive technique because it retrieves information from third-party registries, not the target's systems. This can reveal registrar details, name servers, and contact information without alerting the target. It is a standard part of passive reconnaissance.

Kerberoasting is effective because the TGS ticket is encrypted with the service account's NT hash (for RC4-HMAC). An attacker who requests a service ticket can extract it and attempt to crack the encryption offline, without further interaction with the domain controller. This allows stealthy password recovery. The scenario specifies RC4-HMAC encryption, which is particularly vulnerable because it uses the NT hash directly as the key, making it a prime target for offline cracking.

Hashcat is the industry standard for offline cracking. By using dictionary files for common passwords and mask attacks for complexity patterns, a tester can efficiently find the password. This method is highly scalable and leverages GPU hardware to test millions of variations per second.

Files placed in /etc/cron.d/ are automatically parsed by the cron daemon. This is a common method for attackers to inject persistent tasks because it does not require modifying existing crontab entries, making it slightly more stealthy and easier to manage during the post-exploitation phase of an engagement.

ARP scanning sends ARP requests to all IPs in a subnet. Since ARP is a Layer 2 protocol, it does not traverse routers and is not typically monitored by IDS. It is fast, accurate, and stealthy for discovering live hosts on the local subnet. This makes it ideal for low-noise internal reconnaissance.

Metadata often contains fields like 'creator' or 'last modified by,' which can reveal internal usernames. Furthermore, the software version used to generate the file can indicate the patching level of the workstations. This provides attackers with concrete targets for crafting specialized phishing lures or identifying vulnerable software versions used internally.

Golden Tickets are forged TGTs, acting as a master key for the domain. Silver Tickets are forged TGS tickets for a specific service. By using the service account's password hash, the attacker can only successfully authenticate to the service associated with that specific account.

Reporting the vulnerability to the client is the correct path. It respects the contractual agreement and allows the client to handle their relationship with the third-party provider. This ensures that the client is aware of the risk and can manage their vendor dependencies effectively and legally.

This result occurs when Nmap sends a probe and receives no response. It could be that the port is open and the service is not replying, or that a firewall is filtering the traffic. The lack of feedback prevents Nmap from giving a definitive status, creating a state of uncertainty.

By prepending a user-controlled directory to the PATH variable, the system searches the attacker's directory first. If the binary calls 'date' and the attacker has placed a malicious file named 'date' in their directory, the system executes the malicious file with the privileges of the SUID binary.

When the same service responds locally but not across a router, the most likely explanation is an intermediate firewall or ACL dropping TCP/445. The scan itself is valid; the network path is filtering the probe or its response, which is why the port appears filtered or unreachable from the remote subnet.

A service unit that executes a script from a world-writable directory lets any local user replace that script with arbitrary code. Because the service runs as root under systemd, the replacement executes with root privileges on the next service start or restart. This is a direct and reliable escalation path from a standard user to root on the host.

A mask attack allows you to define the exact length and character set, drastically reducing the keyspace compared to a full brute-force. If you have intelligence suggesting the password is at least 13 characters and includes symbols, a mask attack focusing on that length and charset can be feasible, especially with optimized hardware. It directly targets the suspected structure without wasting time on shorter or simpler candidates.

The Rules of Engagement is the governing document that specifies authorized targets, testing windows, allowed techniques, emergency contacts, and handling of sensitive findings. It translates the Statement of Work into operational boundaries. For a healthcare client with compliance concerns, the Rules of Engagement provides the auditable record that testing stayed within agreed limits, satisfying both legal and regulatory expectations.

Auxiliary modules are the correct choice for non-intrusive tasks like port scanning, service enumeration, and vulnerability identification. They provide a safe and effective way to gather information about the target environment without the risk of triggering an unintended exploitation attempt, which is essential for professional and methodical penetration testing engagements.

Hashcat mode 5600 is specifically for NetNTLMv2 hashes. NetNTLMv2 is the challenge-response protocol used in NTLMv2 authentication, and captured hashes from tools like Responder are in this format. Using mode 5600 ensures Hashcat correctly parses the hash and applies the appropriate cracking algorithm, which involves HMAC-MD5 operations.

The vulners NSE script correlates detected service versions with CVE databases. A low confidence score means the match is approximate, often due to version string ambiguity or missing patch information. These findings are leads that require manual verification, such as checking the exact build or testing the vulnerability, before being included in a report.

SMB signing must be disabled on the target hosts for a relay attack to succeed, as signing prevents tampering with relayed authentication. If signing is enabled, the attacker cannot relay the authentication to another service. This condition is critical for the attack to work, making it a necessary requirement.

Pass-the-Ticket extracts a valid Kerberos ticket (including a TGT) from LSASS using sekurlsa::tickets and injects it into the current logon session with kerberos::ptt. This allows the operator to authenticate as the administrator to other services without the password or hash, directly satisfying the scenario's requirement of reusing the captured TGT.

Hashcat mode 5600 is specifically designed for NetNTLMv2 hashes. These hashes are captured from network authentication attempts and consist of the username, domain, server challenge, and the HMAC-MD5 response. Selecting this mode ensures Hashcat correctly parses the format and applies the appropriate cracking algorithm. Using any other mode would result in errors or incorrect cracking attempts.

Organizations often own IP ranges registered under different regional authorities depending on their global footprint. Using multiple WHOIS databases allows the tester to aggregate these records and build a complete picture of the organization's publicly registered network assets, which is essential for ensuring comprehensive testing of all in-scope infrastructure.

Because the cron job executes the script as root every minute and the file is writable by www-data, modifying its contents means your injected commands run with root privileges at the next scheduled interval. Appending a reverse shell payload is a direct, reliable escalation path that requires no exploit or kernel vulnerability.

A signed authorization naming the in-scope assets and time window is the core legal instrument that distinguishes authorized testing from unauthorized access. It establishes the client's consent, bounds the activity to specific systems and hours, and is the first document an investigator or court examines when testing activity is questioned, making it essential contractual protection.

Accessing the SAM database file directly allows for offline processing. Since the cracking happens entirely on the tester's machine, there is zero network interaction with the target, thus preventing account lockouts, avoiding detection by intrusion detection systems, and allowing for massively parallelized computation using high-end GPU hardware.

The `$2y$` prefix indicates bcrypt, and the `10` is the cost factor (2^10 iterations). Hashcat mode 3200 is correct for bcrypt. The cost factor increases the computational effort per guess, making brute-force and rule-based attacks much slower. This is the primary defensive advantage of bcrypt, and the tester must account for it when planning the attack.

Google Dorks utilize specific search operators like 'filetype:' or 'inurl:' to locate files like PDFs, spreadsheets, or configuration backups that were accidentally indexed. This helps in identifying sensitive information exposure, such as directory listings or login pages, without ever interacting directly with the target server's network infrastructure.

Custom performance settings allow fine-tuning of timeouts, throttling, and concurrent checks to balance speed and accuracy. This enables the tester to complete the scan within the window while reducing false negatives caused by timeouts. It is the most flexible approach to meet both coverage and impact constraints in a production environment.

The -sn option tells Nmap to perform host discovery only, without port scanning. It sends probes like ICMP echo, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp to determine if hosts are up. This is exactly what is needed to identify live hosts on a subnet without scanning ports.

Command and control is the industry-standard term for the maintenance of a communication channel between a compromised asset and an external adversary. This phase allows the attacker to maintain presence, send operational commands, and monitor the progress of their mission within the target environment.

The userPrincipalName attribute in the on-premises directory is synchronized to Microsoft Entra ID as the user's sign-in name, provided the domain is verified. Changing it to match the desired cloud UPN (e.g., jdoe@corp.com) will update the cloud userPrincipalName after synchronization. This is the correct attribute to modify to control the cloud sign-in address.

Kerberoasting is specifically defined as the process of requesting a service ticket for a service account and cracking the resulting TGS-REP hash offline. Since the ticket is encrypted with the service account's password hash, offline cracking reveals the service account password, often leading to significant privilege escalation.

DNS tunneling encapsulates C2 data within DNS queries and responses, which are allowed through the restricted network. Since only DNS traffic to the internal resolver is permitted, this technique can bypass the egress filtering. Tools like dnscat2 or iodine can establish a covert channel over DNS. This directly addresses the scenario's constraint and is a common method for C2 in heavily restricted environments.

Malleable C2 profiles allow operators to specify server responses, such as HTTP status codes, headers, and body content. This can include decoy pages or error messages that make the C2 server appear as a legitimate web server. By controlling responses, operators can further blend in and mislead defenders. This is a key benefit for maintaining stealth during a penetration test.

Statistical analysis looks for patterns that emerge over time, such as the mean interval between connections. Even with jitter, the underlying periodicity remains detectable. This method allows security teams to identify the 'pulse' of a C2 channel even when it is intentionally obfuscated by random timing variations.

Reporting the vulnerability without exploiting it respects the 'Forbidden_Attacks' constraint. This allows the client to understand the risk and patch the issue without suffering the downtime associated with a successful exploitation. It demonstrates professional judgment by balancing the need for security assessment with operational constraints.

A technical contact at a hosting company indicates the domain's DNS and possibly web hosting are managed by that provider. By examining the hosting provider's IP ranges, you can identify other domains hosted on the same infrastructure, which may reveal shared hosting or additional targets. This is a common reconnaissance technique to expand the attack surface and find related assets that might be less protected.

Off-peak testing reduces the number of users affected, and limiting deauthentication frames prevents overwhelming the network and causing widespread disconnections. This directly addresses the risk of disrupting legitimate wireless users. It is a specific, measurable control that can be included in the Rules of Engagement. This approach balances the need to test wireless security with the need to maintain network availability.