Domain Escalation and Persistence

During a penetration test, you gain access to a server and want to add a new SSH key for persistent access. Where should you place the key in the user's home directory?

Which technique is most effective for maintaining persistence on a Windows domain-joined machine while remaining stealthy by avoiding common registry keys?

During a penetration test on a Linux system, you have gained root access and want to ensure that your backdoor survives system reboots. Which of the following methods is the most reliable and commonly used for this purpose?

During a post-exploitation phase, you identify an unquoted service path vulnerability on a Windows target. What is the most reliable way to escalate privileges through this misconfiguration?

Which TWO of the following are common indicators that a Windows system has been compromised with persistence?

A penetration tester has obtained Domain Admin credentials during an internal engagement and wants to establish long-term persistence that survives a Domain Admin password reset and reboots. The tester needs a method that remains stealthy and does not rely on leaving a binary on disk. Which technique best meets these requirements?

Which THREE of the following are valid techniques for privilege escalation on a Linux system?

Which of the following is a key advantage of using a 'Scheduled Task' for persistence on Windows systems?

Which TWO of the following methods are commonly used by attackers to achieve persistence on a Linux system via cron jobs?

Refer to the exhibit. Given this output, which action is most appropriate for a penetration tester?

When attempting to escalate privileges on a Linux system, what is the significance of the SUID bit on a file owned by root?

You have obtained domain administrator credentials during a penetration test. To maintain stealthy persistence on a Windows domain controller, you decide to abuse Kerberos. Which method allows you to authenticate as any user without knowing their password, and is a known persistence technique?

What is the primary danger of leaving a 'backdoor' account on a compromised system after a penetration test?

You have obtained Domain Admin credentials during an internal penetration test. To ensure continued access even if the compromised user's password is changed, you decide to create a Golden Ticket. Which artifact is required to forge a Golden Ticket?

During a penetration test on a Windows Server 2019 domain controller, you discover that the KRBTGT account password was last set 5 years ago. You extract the KRBTGT hash and create a Golden Ticket with a 10-year expiration. What is the primary reason this persistence method is particularly effective in this scenario?

Which of the following describes the 'Persistence' phase in the context of the cyber kill chain?