OffSec PEN-200 / OSCP Concepts (PEN-200) — Questions 151–225

The -c command flag executes a command immediately upon vim startup. By invoking :!/bin/sh, the user forces vim to spawn a system shell. Because vim is running with sudo privileges, the spawned shell inherits root permissions, effectively escalating the user's access level to the highest possible on the system.

Overly permissive DACLs on the parent folder allow standard users to create a malicious executable that matches the first space-separated token of the path. When the service starts, Windows executes this malicious binary instead of the intended program because quotes are missing.

EDR behavioral monitoring often flags the creation of a new, unsigned process that immediately performs suspicious actions. Injecting into an existing trusted process like explorer.exe avoids a new process creation event and places the malicious code inside a process the EDR considers benign. This directly addresses the behavioral monitoring component described in the scenario.

If the binary expects to find a script in a relative path like './scripts/run.sh', you can create a directory named 'scripts' in your current location and place a malicious 'run.sh' inside. When the binary runs, it will find and execute your script, inheriting the binary's SUID privileges.

The '(M)' permission granted to BUILTIN\Users allows any standard user to write to, modify, or delete the file. By replacing the service executable with a malicious payload, the user can ensure that the next time the service starts, the malicious code executes with SYSTEM privileges.

Matching the listener protocol to the payload is mandatory for a successful reverse shell. If the exploit expects to send data via TCP and your listener is configured differently, the handshake will fail. This is a common point of failure for beginners during their first few attempts.

To perform a UNION attack, the number of columns in the injected query must match the original query. Using ORDER BY with increasing column numbers or injecting UNION SELECT with NULLs helps determine the column count. Without this, the database returns an error, and the injection fails. This step is fundamental to crafting a valid UNION statement that aligns with the original query's structure.

Importing VirtualAlloc from kernel32.dll via P/Invoke declarations supplies the missing unmanaged Win32 API that the .NET runtime cannot expose natively, resolving the compile error. This satisfies the stem's requirement for low-level memory allocation, since managed C# has no built-in equivalent for reserving executable pages.

The crash indicates the exploit reached the vulnerable code but the return address was incorrect for this kernel. Debugging the crash (e.g., with a core dump or attaching a debugger) lets you determine the actual offset to the return address. Replacing the hardcoded offset with the correct one for the target kernel is the precise fix, rather than abandoning the exploit.

Packing involves using a tool to compress and wrap the original executable within a new outer layer. When the file is scanned on disk, the antivirus only sees the packer's code rather than the malicious payload. At runtime, the packer decompress the original code into memory, effectively hiding the malware from static analysis.

Password spraying involves trying a single password against many accounts to avoid lockouts. Waiting between attempts (e.g., 30 minutes) ensures that the account lockout threshold is not triggered, as most lockout policies count failed attempts within a time window. This approach balances efficiency and stealth, directly addressing the scenario's goal of avoiding lockouts while testing common passwords.

The script is world-writable, meaning any user can modify its contents. Since the cron job runs as root, overwriting the script with a payload that creates a SUID root shell or connects back to your listener will execute with root privileges. The directory permissions do not prevent modifying the file's contents because the file itself is world-writable. This is a direct and reliable escalation.

The script-src directive includes 'unsafe-inline', so the browser executes the inline <script> block defining the token. This nullifies CSP's core defence against injected inline scripts, allowing an attacker who achieves HTML injection to run arbitrary JavaScript despite the policy being present.

Pass-the-Ticket with Mimikatz's kerberos::ptt injects the extracted TGT into the current logon session, allowing the attacker to impersonate the user for Kerberos authentication. This enables access to network resources like file shares without knowing the password. It is the standard method for leveraging stolen Kerberos tickets in Active Directory environments.

Sending the full byte range and examining memory after the crash reveals exactly which bytes are removed, terminated, or transformed by the vulnerable function. For example, a null byte may truncate a string copy, and a newline may terminate input. This empirical approach is the standard method taught in PEN-200 for mapping bad characters before finalizing shellcode.

Operating system native support for mounting disk images allows users to open ISO files easily. Depending on how files are copied out of the ISO, the Mark of the Web security identifier may not propagate as reliably as it does with direct browser downloads.

Security solutions place inline hooks within user-mode DLLs like ntdll.dll to monitor API calls. Implementing direct system calls bypasses these hooked functions entirely, allowing the payload to interact directly with the kernel without triggering user-mode security monitoring alerts.

This is correct because SafeSEH only protects exception handlers, not the return address overwrite. If you can overwrite the return address and redirect to a JMP ESP in a module without SafeSEH (or with SafeSEH disabled), you can still execute your shellcode. SafeSEH does not prevent stack overflow exploitation via return address overwrite.

Hardware-enforced Data Execution Prevention flags stack memory segments as non-executable data pages. When the CPU attempts to fetch and execute instructions located at the stack address pointed to by ESP, it triggers an access violation exception.

Reviewing publicly available information is a passive reconnaissance technique that does not involve any direct interaction with the target. Job postings might mention specific operating systems or technologies, and the website's technology stack can be inferred from headers or public profiles. This meets the requirement of sending no packets to the target.

If the vulnerable function uses a string copy function like strcpy, null bytes in the shellcode will terminate the copy, truncating the shellcode. Even if the JMP ESP is correct, the shellcode on the stack may be incomplete, leading to failed execution. This is a common issue in Windows exploits, as many shellcodes contain null bytes. The scenario notes that shellcode is in memory, but it might be truncated. Thus, null bytes are a likely culprit.

This is the default configuration file for Proxychains. It defines the proxy servers, the chain type, and other operational parameters. Editing this file to add your SOCKS proxy entry at the bottom is the standard procedure to enable Proxychains to successfully route traffic through your established pivot tunnel.

The payload 'admin'-- comments out the rest of the SQL query, effectively removing the password check. This allows the attacker to log in as admin without knowing the password. This is a classic authentication bypass using SQL injection. It does not require data extraction or error messages, and the result is immediate access, making this the correct categorization.

If a user has write permissions on a GPO linked to an OU with privileged servers, they can modify the GPO to include a malicious scheduled task or startup script. This task will execute with SYSTEM privileges on all affected computers when Group Policy refreshes. This is a direct and effective privilege escalation method, as it leverages the GPO's application to gain elevated code execution.

When a session cookie lacks the SameSite attribute, browsers may send it with cross-site requests. This allows an attacker to craft a malicious page that submits a request to the target application, and the victim’s browser automatically includes the session cookie. The server then processes the request as the authenticated user, enabling CSRF. SameSite is a primary defense against this class of attack.

Rewriting the exploit to use native libraries is the most reliable method for ensuring execution in restrictive environments. It removes the dependency on external packages, making the script more robust and independent of the specific environment's pre-installed tools, which is crucial for successful exploitation in an exam.

If a character is not identified as 'bad' during the initial testing phase, it can cause the input function to terminate the copy operation. This results in the shellcode being truncated, so the buffer contains only a partial payload that cannot perform the intended task when the CPU jumps to it.

Reputable sources like Exploit-DB maintain a degree of oversight and community scrutiny. Verified GitHub repositories often include commit history and issue trackers where users report concerns. Reviewing this metadata helps ensure the code's provenance and provides confidence that the exploit performs only the documented actions against the intended target.

CrackMapExec (now NetExec) supports pass-the-hash via the `-H` flag, allowing SMB authentication with an NTLM hash without cracking it. It sends the hash in the NTLM authentication exchange, which the server accepts because it only verifies the hash. This is the standard method for lateral movement when only the hash is available, and it works against SMB services that permit NTLM authentication.

SNMPv2c with the default community string `public` is commonly left enabled on Linux servers, and `snmpwalk` recursively walks the MIB tree to reveal system description, interfaces, routes, users, and installed software. It is a read operation that does not attempt authentication, so it gathers maximum information without locking accounts or generating failed-login events.

Auditing the request construction reveals exactly what parameters and payloads are sent, and reproducing the same application version locally lets you observe the exploit's real effect without touching the production service. This combination gives verifiable behavior before any live request, which is the core discipline of safe exploit validation in PEN-200.

LDAP is the primary protocol for directory services in Windows domains. Connecting to port 389 allows for queries that can return lists of users, groups, and computers. This is a standard enumeration technique used to map the domain and prepare for further attacks like password spraying or credential harvesting.

Because the directory `/opt/scripts` is group-writable and you are a member of the `developers` group, you can delete the existing `backup.sh` file and create a new file with the same name. The new file will be owned by your user, but the cron job runs as root and will execute it. This is a classic privilege escalation via writable directory containing a root-executed script. The original file's permissions do not prevent deletion because deletion is controlled by the directory's permissions, not the file's.

When an application loads a DLL, it searches the application directory first. If you have write access to that directory, you can place a malicious DLL with a matching name. The application will load it instead of the system version, executing your code under the service's context.

Executing JavaScript in the victim browser permits access to session identifiers stored in cookies or local storage, facilitating session hijacking. The attacker can also forge HTTP requests using the user's active session to perform unauthorized administrative actions.

Passive reconnaissance involves gathering information without directly interacting with the target, such as using search engines, public records, or WHOIS data. This is completely stealthy, as it leaves no trace on the target system or their network, making it an essential first step in any professional engagement.

Without HttpOnly, JavaScript can access the session cookie via document.cookie. If an attacker can inject and execute JavaScript through an XSS vulnerability, they can read the cookie and send it to a remote server, hijacking the session. This is a direct consequence of missing HttpOnly, as the flag is designed to prevent exactly this type of theft.

When AlwaysInstallElevated is enabled in both HKLM and HKCU, any MSI package installed by the user runs with elevated (SYSTEM) privileges. You can generate a malicious MSI that executes a command, for example adding a user to the Administrators group, and then install it using `msiexec` with quiet flags to avoid user interaction.

Domain fronting leverages a CDN's shared TLS endpoint to hide the true destination in the encrypted SNI, so network defenders only see a benign domain. Combined with a valid TLS certificate and business categorization, it blends with normal traffic and bypasses signature-based detection that relies on IP or domain reputation.

Hidden directories often contain configuration files, backup scripts, or administrative interfaces that lack proper authentication. Identifying these paths provides a significant advantage, as they may contain sensitive information or serve as entry points that bypass the main application's security controls, providing easier access for a penetration tester.

This is correct because sending a unique cyclic pattern allows you to identify the exact offset by observing the overwritten EIP value. Tools like Mona.py in Immunity Debugger or pattern_create/pattern_offset in Metasploit can generate and locate the offset. This is a standard step in buffer overflow exploitation.

Encoders like Shikata Ga Nai are designed to transform shellcode to avoid bad characters such as null bytes. They prepend a decoder stub that reconstructs the original shellcode at runtime. This is a standard technique in exploit development when bad characters are present. The encoded shellcode is larger but functionally equivalent after decoding.

Since the scheduled task runs cleanup.exe as SYSTEM and the folder is writable by Users, you can create a malicious executable named cleanup.exe. When the task triggers, it will execute your payload with SYSTEM privileges. This is a straightforward privilege escalation via a missing binary in a writable directory.

The 'ps aux' command lists every process on the system, and 'grep root' filters that list to show only those owned by the root user. This is the fastest way to identify all high-privilege services, which are the most valuable targets for your privilege escalation attempts.

Requesting a harmless file like a public document is a safe way to confirm the path traversal vulnerability exists. If you receive the file content back successfully, you have proven the vulnerability without causing any disruption to the service or damaging the target system's stability.

The LAPS solution stores the cleartext local administrator password in the ms-MCS-AdmPwd attribute of the computer object. If a domain user has read access to this attribute, they can retrieve the password, enabling them to authenticate as the local administrator on that specific computer, facilitating unauthorized access.

SMB signing forces the use of cryptographic signatures for every packet. Because the attacker cannot generate valid signatures for the relayed authentication without the session key, the target server rejects the relayed packets. This makes it impossible to relay authentication successfully between a client and a target server.

A TGS-REP ticket encrypted with RC4-HMAC can be brute-forced offline because the checksum is keyed by the service account's NT hash. Hashcat mode 13100 targets Kerberos 5 TGS-REP etype 23 hashes exactly, allowing a wordlist or rule-based attack to recover the plaintext, which is the standard Kerberoasting cracking path.

Mode 1000 identifies the hash type as NTLM, and -a 0 specifies the dictionary attack mode. This combination is the standard method for attempting to recover plaintext passwords from NTLM hashes using a predefined list of words, which is the most efficient starting point for offline password recovery in Windows environments.

Sideloading takes advantage of the Windows DLL search order, which prioritizes the application's directory over system directories. By naming the malicious file after a required dependency, the attacker tricks a trusted application into executing their code. This is a highly effective way to gain execution while appearing as a legitimate, signed process.

Automated sandboxes are often resource-constrained to save costs, frequently operating with only one or two CPU cores and minimal memory. Legitimate modern workstations typically have more resources. Malware can check these hardware specifications and terminate execution if they fall below a certain threshold, assuming the environment is a virtualized analysis lab.

Impacket's psexec.py supports Pass-the-Hash via the -hashes argument, allowing an attacker to authenticate to SMB services using an NTLM hash without knowing the plaintext password. It constructs the SMB session using the provided LM:NT hash pair, which is precisely the objective in this scenario where only the hash was recovered from a compromised workstation.

The scan report explicitly shows that ports 22/tcp and 80/tcp are in the 'open' state. Correctly identifying these ports is fundamental to the reconnaissance phase, as it provides the necessary roadmap for deciding which service to analyze further for potential vulnerabilities or configuration weaknesses during the engagement.

A custom loader with encrypted embedded shellcode presents a different on-disk artifact than the original msfvenom executable, so the signature that matched the raw payload no longer applies. The executable's own code is unique to the tester, and the shellcode is not present in a recognizable form until runtime decryption. This directly addresses signature-based detection at delivery without relying on well-known encoders.

EDR tools can compare the executable's entry point and memory map against the original file on disk. When a process is hollowed, the memory contents and the entry point are modified to point to the malicious code. This mismatch is a clear sign that the process has been tampered with and is no longer legitimate.

Base64 is designed to represent binary data in an ASCII string format. It offers no confidentiality or integrity. Using it to store credentials is a critical vulnerability because it exposes plaintext passwords to anyone who can view the cookie, allowing for trivial credential theft and subsequent unauthorized account access by an attacker.

Hashcat mode 5600 is specifically designed for NetNTLMv2 (NTLMv2 challenge-response) hashes. These are network captures that include the server challenge, username, and domain, and are cracked as a challenge-response pair. This mode correctly handles the format and cryptographic operations needed to test candidate passwords against the captured NTLMv2 response, making it the appropriate choice for this scenario.

This is the classic example of a Path Traversal attack. By moving up the directory tree using '..', the attacker can point the application to sensitive files like /etc/passwd that reside outside the intended document root, effectively bypassing access controls.

Combining ICMP echo with TCP SYN probes to frequently open ports catches hosts that block ping but still expose services, a common configuration. This layered discovery approach maximizes live-host detection quickly, providing a target list for later, more intensive service enumeration without wasting time scanning dead addresses.

Analyzing the source code allows you to confirm that the exploit performs exactly what you expect. It helps identify hardcoded credentials, malicious payloads, or potential stability issues that could crash the target service, which is essential for maintaining control and stability during your assessment.

Passive DNS databases store historical resolution data collected from recursive resolvers and other sensors, so querying them reveals IP addresses and subdomains without any packet ever reaching the target's infrastructure. That directly satisfies the requirement to identify hosts while remaining passive. Historical records can also expose decommissioned or origin hosts that current DNS no longer advertises, adding reconnaissance value.

Because the existing script block already has a valid nonce, any JavaScript injected inside it is considered trusted by the CSP. By breaking out of the current JavaScript context (e.g., closing a string or statement) and appending your code, you can execute arbitrary JavaScript without triggering CSP violations. This is a common bypass when user input is reflected into a nonce-protected script block.

The cookie stores user ID and role in plaintext after base64 decoding. By changing the role to 'admin' and re-encoding, you forge a valid cookie. The server does not verify integrity, so it accepts the tampered value, granting administrative access. This is a classic insecure direct object reference combined with cookie tampering.

Hashcat mode 5600 is specifically for NetNTLMv2 hashes. Using a wordlist with rule-based mutations (e.g., best64.rule) increases the likelihood of cracking common password patterns. This approach is efficient because it leverages GPU acceleration and targets the exact hash format. The challenge-response nature of NetNTLMv2 means the hash cannot be used directly for pass-the-hash, so cracking is often necessary to obtain the plaintext for further access.

The Service Control Manager only executes the binary when the service is started. Replacing the file does not affect the currently running process. A restart is required to stop the original binary and initiate the new one, which allows the attacker's code to run as the service user.

An RST/ACK reply to a SYN means the host's TCP stack is alive and actively rejecting the connection because no process is bound to that port. This is the canonical 'closed port' response and confirms host reachability, which is why filtered versus closed distinctions matter so much during enumeration.

Context-aware encoding ensures that data is neutralized based on where it is displayed—HTML body, attribute, or JavaScript. By correctly encoding characters like '<', '>', and quotes, the browser is instructed to display the input literally rather than executing it, which is the standard defensive requirement.

Enabling directory indexes allows the server to generate a listing of all files in a directory. This often reveals sensitive files like config.php, database dumps, or backup files that the administrator forgot to remove, giving the attacker a roadmap for further exploitation of the application.

The service executable is run with SYSTEM privileges. By replacing the binary and starting the service, your malicious code executes as SYSTEM. Since the service is stopped, you can overwrite the file and then start it. This is a direct and reliable method.

DCSync uses the DRS protocol to request that a domain controller send account data, including password hashes, as if it were performing a legitimate replication operation. This allows an attacker to dump credentials for any user in the domain without ever needing to log into the domain controller itself.

The shellcode within the payload is designed to perform a specific task, such as opening a network port or running an OS command. Once the CPU is redirected to the shellcode, it runs with the privileges of the application, effectively giving the attacker control over the system as intended by the exploit.

A successful exploit trigger with no callback almost always means the payload executed but its network path failed. Outbound filtering on the target or a payload pointing at an unreachable address prevents the reverse connection even though the vulnerability was exploited, which matches the observed success-without-shell behavior exactly.

Password spraying aims to avoid lockouts by trying one password against many accounts, then waiting before trying another password. Using a single attempt per account per lockout window respects the lockout threshold, minimizing the risk of locking accounts. This is a core principle of password spraying.

This setting is the primary vulnerability that makes AS-REP Roasting possible. When disabled, the domain controller sends an encrypted TGT without verifying the user's password first. This encrypted ticket can then be captured and cracked offline, making it a highly effective method for gaining access to user accounts.

With HS256, the token is signed using a symmetric secret. If the secret is weak or guessable, an attacker can brute-force it offline using tools like hashcat or john. Once the secret is recovered, the attacker can modify the "role" claim and generate a valid signature, forging an admin token. This is a common and effective attack when the secret is not strong.