OffSec PEN-200 / OSCP Concepts (PEN-200) — Questions 1–75

A successful AXFR returns every record in the zone, exposing hostnames, subdomains, mail servers, and address mappings that are normally hidden. This comprehensive inventory reveals internal naming conventions and network layout, giving an attacker a detailed map of reachable systems far beyond what individual queries would disclose.

Manually building the syscall stub bypasses userland hooks because the hook resides in ntdll's exported function, not in the kernel transition path. By placing the syscall number in EAX and executing the syscall instruction directly, the loader skips the modified ntdll code entirely. This works without kernel privileges and is a standard PEN-200 technique for evading EDR hooks on memory allocation and protection APIs.

Spraying a single common password across many accounts increases the statistical likelihood of hitting at least one user who utilizes that password. This method is specifically designed to maximize credential acquisition while staying beneath the radar of lockout policies that are configured to monitor individual account failures.

Many string-handling functions, like strcpy or those used in network socket communication, interpret \x0d as a carriage return, signaling the end of an input stream. If the shellcode contains this byte, the program stops copying input to the buffer, leaving the exploit payload incomplete and effectively preventing successful execution.

Heuristic engines look for characteristics and behaviors rather than exact byte sequences. By identifying that the file structure or the sequence of API calls closely resembles known malware, the antivirus can make an educated guess that the file is malicious, even if the specific strings and variables have been altered by the penetration tester.

Capabilities break down root privileges into smaller units. If a binary is granted the 'CAP_DAC_OVERRIDE' capability, for example, it can bypass file permission checks even if the binary itself isn't running as root. This allows for privilege escalation by leveraging the binary's authorized, high-level permissions.

Placing the payload in the ThisDocument module's Document_Open routine causes Word to execute it as part of loading the document, once macros are enabled. This is the standard way to achieve automatic execution without any further user interaction. It directly satisfies the scenario's requirement for immediate, hands-off execution.

An isolated disposable VM confines any malicious behavior to a system you can discard, while the lack of shared folders and bridged networking prevents the malware from reaching your host files or the broader network. This containment strategy is the most reliable protection when the trustworthiness of an exploit archive cannot be established.

The Windows Installer policy check evaluates both the current user hive and the local machine hive before executing installations. Setting this specific registry key to 1 in the user hive informs the operating system that packages run by this user should receive elevated rights.

The binary uses system("ps"), which invokes the shell to run the command. If the PATH environment variable includes a writable directory before /bin, you can place a malicious 'ps' there. When the SUID binary runs, it will execute your 'ps' as root, granting escalation. This is a classic PATH hijacking attack.

If an application executes OS commands based on user input, injecting common Linux commands like 'whoami' will cause the application to return the current user's identity. This direct reflection of command results is the most clear proof-of-concept for a command injection vulnerability.

Privilege escalation requires moving from a lower privilege level to a higher one. If the task runs as the current low-privilege user, executing code through it provides no elevation. Targeting tasks that run as SYSTEM ensures that once the execution path is hijacked, the resulting shell or command will possess maximum system authority.

NTLM Relay is the process of intercepting authentication requests and forwarding them to a target machine. If successful, the attacker gains access to the target host with the privileges of the authenticated user. This attack is highly effective against environments where SMB signing is not enforced on network servers.

Golden tickets require the hash of the KRBTGT account, which allows the forging of TGTs for any resource. Silver tickets require the hash of a specific service account (e.g., MSSQL or CIFS), allowing the forgery of TGS tickets for that specific service, which is much more targeted and quieter.

Dynamic port forwarding acts as a SOCKS proxy, allowing client applications to route traffic through the SSH server to any destination reachable by that server. This eliminates the need to create individual -L tunnels for every specific internal IP or service, providing much greater flexibility during network enumeration.

A cyclic pattern lets you map the exact bytes that land in EIP. When the service crashes, the value in EIP will be a recognizable slice of that pattern, proving you control the saved return address and revealing the precise offset. This is the standard first step in PEN-200 buffer overflow methodology before selecting a jump instruction or encoding shellcode.

The 'LocalSystem' account is inherently privileged. Whether a service is 'interactive' or not only dictates its ability to show a desktop window. The underlying privileges remain the same, meaning an attacker gaining control of the service process still gains full administrative control over the host.

NetNTLMv2 hashes are highly effective when used in SMB relay attacks. If the target system has SMB signing disabled, an attacker can relay the hash to authenticate as the victim, gaining immediate access to the system without ever needing to know the user's actual password.

A UNION-based SQL injection requires that the injected SELECT statement returns the same number of columns as the original query. Without knowing the column count, the database will throw an error and the injection will fail. Testers typically use ORDER BY clauses or UNION SELECT with increasing numbers of NULLs to determine the column count. This step is fundamental to crafting a valid UNION query that retrieves data.

Antivirus vendors include the signatures for common Metasploit encoder stubs in their databases. Even though the payload itself is 'randomized' by the encoder, the small piece of code that decrypts that payload remains recognizable. Since this stub must run first, the antivirus identifies it immediately and blocks the execution before the payload is even unpacked.

The endpoint is vulnerable to insecure direct object reference (IDOR). By enumerating IDs, you can access other users' data, including potentially administrators. This demonstrates the impact and is a standard penetration testing step to prove the vulnerability. It is ethical because you are authorized and should avoid modifying data.

Hardcoded network parameters are common in public exploits. If the target IP or callback port does not match your environment, the exploit either fails to reach the vulnerable service or the payload connects to the wrong host. Correcting these variables aligns the exploit with your engagement setup and ensures the reverse connection returns to your listener.

Auditing the code is the only way to ensure the exploit is not performing unauthorized actions, like installing a backdoor on your own machine. This is a critical security practice for any penetration tester who wants to maintain a secure and professional testing environment.

The 'unshare' or 'clone' syscalls allow creating new namespaces without root. Exploits often target how the kernel handles these namespaces to escalate privileges. Because these features are often exposed to all users, they serve as a critical vector for local privilege escalation attacks on outdated kernels.

Because kernel exploits manipulate sensitive memory structures and CPU instructions, any mistake or unexpected state will trigger a kernel panic. This results in an immediate and total system crash, which is a major risk when attempting privilege escalation on live systems that need to remain operational.

DCSync abuses the Directory Replication Service (DRS) protocol by impersonating a domain controller. To do so, the account must have the Replicating Directory Changes All extended right on the domain partition, which allows it to request replication of directory data including password hashes. Without this permission, the DRS request will be denied, making this a necessary condition.

Hashcat mode 13100 is specifically for cracking Kerberos 5 TGS-REP etype 23 (RC4) hashes. These hashes are obtained through Kerberoasting. Using this mode allows efficient offline cracking with wordlists or brute-force, making it the correct choice for this scenario.

Whatweb and Wappalyzer are specialized reconnaissance tools that automatically detect the software stack, including the CMS, by analyzing server headers and page source code. This is the professional standard for quickly identifying the application framework, which is essential for tailoring your exploitation strategy to the specific target platform.

SeImpersonatePrivilege allows a process to impersonate a token, and tools like JuicyPotato or PrintSpoofer abuse this by coercing a privileged service to authenticate, then capturing and impersonating its token. This directly leverages the privilege to escalate to SYSTEM without needing to modify files or registry keys.

This is correct. Since the script is writable by the current user and executed by root via cron, modifying it to include a reverse shell or a command that creates a SUID binary will execute with root privileges. Waiting for the next cron interval triggers the escalation.

When a master password is not required, the application must derive the decryption key from static sources, such as registry keys, machine GUIDs, or environment variables. An attacker with access to the system can easily locate these sources to decrypt the vault, rendering the 'encryption' effectively transparent to them.

When a parameter controls a navigation target without validation, the site becomes an open redirect. Attackers abuse the trusted domain to send victims to a lookalike login page or malware host, which is especially convincing in phishing. This matches the described behavior and its most direct client-side consequence.

NTLM authentication protocols authenticate using the NTLM hash directly. By providing the hash to the authentication process, the attacker can successfully impersonate the user without needing to crack the hash to reveal the cleartext password, making it an immediate and highly effective method for lateral movement.

Modern Linux systems often have the NX (No-eXecute) bit enabled, marking the stack as non-executable. Even if EIP is redirected to JMP ESP, the jump lands on the stack where shellcode resides, but the CPU refuses to execute it due to NX. This results in a segmentation fault. To bypass NX, you would need to use return-oriented programming (ROP) or another technique to mark the stack executable or call mprotect.

Indirect syscalls bypass the user-mode hooks installed by EDRs in common Windows APIs like NtAllocateVirtualMemory. By invoking the kernel directly from the assembly, the shellcode avoids passing through monitored functions, effectively blinding the EDR to the memory allocation process, which is the primary indicator of malicious injection.

Members of the docker group can control the Docker daemon, effectively giving root-level access to the host. This command starts a container, mounts the host's root filesystem at /mnt inside the container, and then uses chroot to change the root to /mnt, spawning a shell with root privileges on the host's filesystem. This is a classic and reliable privilege escalation technique when docker group membership is present.

Reflected XSS targets client-side execution by injecting malicious JavaScript through unvalidated parameters that get rendered immediately. This vulnerability allows attackers to steal session cookies, capture keystrokes, or perform actions on behalf of the authenticated user when they click a crafted link.

Because the application searches HKCU first, it will find and use the attacker's malicious COM mapping instead of the legitimate one in HKLM. This results in the trusted application loading the attacker's DLL. This is an effective evasion technique because the malicious activity is masked by the legitimate process's identity.

The `$6$` prefix in /etc/shadow indicates SHA-512crypt, a widely used password hashing algorithm on Linux systems. It is based on the SHA-512 algorithm and includes a salt to protect against rainbow table attacks. Knowing the algorithm is crucial for selecting the correct cracking mode in tools like Hashcat (mode 1800) or John the Ripper (format sha512crypt). This prefix is part of the modular crypt format used by many Unix-like systems.

JuicyPotato exploits SeImpersonatePrivilege by tricking a privileged process into connecting to a malicious named pipe, then impersonating its token. It is specifically designed for Windows systems where SeImpersonate is enabled. The tool leverages COM object hijacking and is effective on many Windows versions, including Server 2016. It directly addresses the scenario.

Hardcoded values in public exploits are specific to the original researcher's environment. Updating these to match your current target is mandatory for the exploit to reach the intended destination. Failing to do this will result in the exploit attempting to connect to an irrelevant host.

The '-m' flag is specifically designed to mirror an exploit file into your current directory, making it accessible for modification. This is an essential step for any tester who needs to customize an exploit before execution, ensuring the original database remains untouched for future use.

Modern Microsoft Office suites isolate downloaded documents in Protected View and display a yellow security banner warning about active content. Execution only occurs if the user explicitly overrides these security controls by clicking the enable button.

Certutil is a command-line program for managing certificates, but it includes a '-urlcache -split -f' parameter that allows it to download files from the internet. Because it is a trusted system utility, many basic antivirus programs and firewall rules do not flag it when it initiates a network connection to retrieve a file.

Reviewing source code allows you to identify hardcoded variables such as LHOST, LPORT, or specific file paths that must align with your attack machine. Customizing the script ensures that the reverse shell or exploit payload reaches the correct destination without being blocked or routed to an incorrect internal address.

Directory busting helps discover unlinked files and directories that could contain sensitive information, backups, or administrative interfaces. This enumeration phase is vital because many web applications rely on security by obscurity, and finding these hidden paths often provides the necessary leverage for a successful penetration test and further exploitation.

Port 2049 is NFS, and showmount -e queries the target's mount daemon to display each exported share along with the host or subnet allowed to mount it. That output directly answers what is exported and to whom, which is exactly the reconnaissance objective. It is a lightweight, standard query that does not modify anything on the server, making it the most direct and appropriate next step.

Stored XSS involves injecting malicious code into persistent storage like a database, forum post, or profile field. When other users view the page, the server delivers the stored payload to their browsers, which then execute it. This allows for persistent, widespread impact across all users visiting the compromised page.

Microsoft SQL Server supports conditional execution using IF statements combined with the WAITFOR DELAY command. By measuring how long the web server takes to respond, you can infer whether your injected logical condition evaluated to true or false.

SharpHound is the official BloodHound collector, and the -c All method gathers group memberships, ACLs, sessions, and trusts. The resulting JSON data imports directly into BloodHound, which computes shortest paths to high-value targets like Domain Admin. This combination directly satisfies the requirement to map relationships and visualize escalation paths.

Port scanning requires sending packets directly to the target system to determine if specific ports are open. This interaction is recorded in logs and constitutes a clear 'active' action, as the target system must process and reply to the probes, making it a highly visible reconnaissance technique.

This payload injects a script tag that executes in the context of the victim's browser when the reflected response is rendered, directly confirming reflected cross-site scripting. Because the parameter is reflected unencoded into the HTML body, the browser parses the script element and runs the JavaScript, causing an alert that displays the current domain. This is a standard, minimal proof-of-concept for reflected XSS in an authorized penetration test.

By breaking a keyword like 'amsiInitFailed' into smaller pieces (e.g., 'am' + 'si' + 'Init') and joining them at runtime, the static scanner cannot see the full word. Since AMSI often relies on keyword-based signatures, this simple technique can effectively prevent the script from being flagged during the pre-execution scan.

The smbclient tool is the standard Linux utility for interacting with SMB shares. The -L flag queries the target for a list of shares, and the -N flag specifies no password, which is essential when testing for null sessions or guest access that might be improperly enabled on the target.

Shikata_ga_nai is an encoder that transforms the payload's bytes using a polymorphic XOR additive feedback loop, changing the binary appearance while preserving functionality. Applying it multiple times further mutates the signature, which can help evade static signature-based detection. This is a classic PEN-200 technique for altering the file's binary appearance without changing what the payload does.

The ability to traverse directories using sequences like '../' or absolute paths allows the application to serve files outside the intended directory. This occurs when user-supplied input is passed directly to file system APIs without sanitization, leading to unauthorized disclosure of sensitive data residing on the underlying server.

Heuristic analysis analyzes the structural makeup of an executable, including imported DLLs like VirtualAlloc and CreateThread. When these suspicious API combinations appear together in an unknown binary, the engine flags it as a potential threat based on risk scoring.

Mode 1000 directs Hashcat to target NTLM hashes, which matches the format of password hashes dumped directly from the Windows NTDS.dit database. Combining this mode with attack mode 0 enables a standard dictionary attack using your specified wordlist against the collected credentials.

By default, ports forwarded with -R bind to the loopback interface on the remote server. However, if the server configuration allows it or if you bind to all interfaces, any user on that server can access the forwarded port, effectively hijacking your pivot for their own network activities or malicious use.

Using the -exec flag with /bin/sh allows you to spawn a shell. The -p flag is essential for 'sh' to maintain the SUID privilege level instead of dropping it to the user's real UID. This command effectively drops you into a root shell because 'find' is executing as root.

Static on-disk scanning matches byte signatures and PE characteristics before execution. A crypter that XOR-encrypts the original payload bytes and only reconstructs them in memory changes the stored file's byte pattern, so the signature that flagged the plaintext implant no longer matches the file on disk. The implant logic still runs after decryption, satisfying the requirement to preserve behavior while reducing file-based detection.

Signature detection compares a file's content against a list of known malware 'fingerprints.' Behavioral detection, on the other hand, monitors the actual operations a program performs while running, such as attempting to inject code into another process or modifying sensitive registry keys, allowing it to catch zero-day threats.

Certificate Transparency (CT) logs are public, passive sources that record every SSL/TLS certificate issued by participating CAs. Searching CT logs for the target domain can reveal subdomains and virtual hostnames without sending any traffic to the target. This is a passive reconnaissance technique that does not trigger IDS because you are querying third-party logs, not the target.

This script attempts to connect to the SMB service and extract the OS version, NetBIOS name, domain, and other details without requiring credentials. It is specifically designed for unauthenticated enumeration of SMB hosts and is part of the default Nmap Scripting Engine library. It is the correct choice for the scenario.

Data Execution Prevention utilizes processor features to enforce non-executable memory pages, stopping shellcode placed directly on the stack from running. Bypassing this defense requires employing Return-Oriented Programming chains to alter memory protections or execute existing code blocks.

The Content-Type header is easily modified in an intercepting proxy. If the server trusts this header, an attacker can send a PHP script while labeling it as 'image/jpeg'. The server accepts it, potentially allowing the attacker to execute malicious code on the system.

robots.txt frequently lists directories that administrators want excluded from crawlers, which often correlates with sensitive or administrative areas. Sitemap.xml enumerates pages the site owner considers important. Both are publicly accessible and cost almost nothing to retrieve, and they routinely surface paths that are not linked in navigation menus. That makes them a high-value, low-noise source for discovering hidden or restricted areas during enumeration.

Knowing the exact password policy allows you to filter your wordlists to exclude passwords that would be rejected by the application's validation logic. This optimization significantly speeds up the brute-forcing process by ensuring that every password tested is at least theoretically compliant with the target organization's security policy.

The 'Exhausted' status explicitly confirms that every entry in wordlist.txt was processed against the loaded hash. Since no match was found, the password is simply not included in the dictionary, necessitating a shift to other techniques like brute-forcing or rule-based mangling to find the cleartext.

A JSONP endpoint on the same origin returns JavaScript that calls a user-supplied callback. Because the script is served from the target origin, script-src 'self' permits it. The attacker can craft a callback that executes arbitrary code, effectively using the trusted origin to bypass the CSP. This is a classic same-origin script gadget.

The /etc/sudoers file is the definitive source for sudo permissions. It lists all users and groups that have been granted sudo rights and specifies the exact scope of those rights. This file is the primary target for auditing privilege assignments on any Linux system.

A half-open SYN scan with -T2 timing and only the most common 100 ports balances coverage and stealth. SYN scanning never completes the TCP handshake, reducing load on target services, while -T2 slows packet delivery to avoid overwhelming hosts or triggering rate-based alarms. Limiting to top ports keeps the footprint small, which directly satisfies the non-disruptive requirement while still identifying live hosts and their common open TCP ports.

SVG supports SMIL animation elements such as `<animate>` and `<set>`, which fire `onbegin` and `onend` events as soon as the document renders. Because the sanitizer only strips `<script>` tags, this event-handler vector survives and executes automatically when the victim views the profile, achieving same-origin script execution without interaction. This is a well-known SVG XSS bypass.

Snmpwalk is the standard tool for querying SNMP agents. Testing common default community strings is the industry-standard initial step for enumerating SNMP. If the agent responds, it reveals a wealth of information about the target's configuration, which is essential for informed decision-making during the subsequent stages of testing.

XOR encoding modifies every byte of the payload based on a key, entirely changing the static file hashes and byte signatures. A custom runtime stub allocates memory, decrypts the payload on the fly, and executes it without ever writing the cleartext binary back to disk.