OffSec PEN-200 / OSCP Concepts (PEN-200) — Questions 226–285

The pattern-based approach is the de facto standard for determining the offset to the return address in a buffer overflow. By sending a unique cyclic pattern, the overwritten EIP value directly maps to a specific offset, which can be calculated with pattern_offset. This method is reliable because it does not rely on assumptions about stack layout and works even when the buffer size is not exactly known.

Local port forwarding allows you to tunnel traffic from a local port to a destination reachable by the SSH server. By mapping a local port to the internal web server's address, you bypass network restrictions imposed by firewalls. This technique is fundamental for pivoting through compromised hosts, enabling tools like Burp Suite or browsers to interact with internal services as if they were running locally, which is vital for further web application vulnerability assessment.

Fuzzing involves sending large amounts of data to an application to find stability issues. The most common indicator of a buffer overflow is the application crashing, specifically resulting in a segmentation fault or an access violation. This occurs because the injected data has overwritten critical stack memory, such as the return address, causing the CPU to attempt an execution from an invalid or unauthorized memory location.

Signature-based detection compares file bytes against known patterns derived from code, strings, and embedded payloads. Altering the source so the compiled binary's byte sequence changes, such as renaming functions and inserting junk instructions, breaks that match while preserving functionality. Metadata edits, directory changes, and privilege elevation leave the underlying bytes intact, so the original signature continues to identify the file.

When a user is allowed to run find with sudo, they can leverage the -exec action to execute arbitrary commands as root. Because the entire find process runs with root privileges, any command spawned by -exec inherits those privileges. This allows an attacker to spawn a root shell, achieving privilege escalation.

Open Redirect occurs when an application accepts user-supplied input to determine a destination URL without validating it against a whitelist. Attackers exploit this to redirect users to a malicious site. Because the URL starts with the trusted domain, victims are less likely to suspect a phishing attempt, making it a highly effective social engineering technique to steal credentials or deliver malware.

To redirect the execution flow, you must overwrite the saved Return Address on the stack. When a function finishes, the CPU pops the value at the saved EIP/RIP location into the Instruction Pointer. By overflowing the buffer and reaching this specific memory location, you gain control over the program's subsequent execution path, which is the foundational concept for stack-based buffer overflow exploitation in the PEN-200 curriculum.

A 'Connection refused' error usually indicates that the target port is not open, the service is not running, or a firewall is blocking the connection. Investigating the network connectivity and service status using tools like Nmap or netcat is essential. This allows you to confirm the service is actually reachable and running on the expected port before assuming the exploit itself is flawed or the payload is failing.

The PrintNightmare PoC abuses the Spooler's driver installation to load a DLL from a UNC path. The attacker must therefore host that DLL on an SMB share reachable by the target, typically with anonymous read access. The other options either target the wrong delivery mechanism or assume capabilities the attacker does not yet possess.

A local port forward created with -L makes your attacking machine listen on a chosen local address and port, then relays that traffic through the SSH server to a destination reachable from the pivot. Binding to 127.0.0.1 keeps the forwarded port private to your host, which is appropriate when only your local tools need to reach the internal SMB service. Remote and dynamic forwards solve different problems and do not give a direct local-to-internal mapping here.

Unconstrained delegation abuse requires two things: enabling the TRUSTED_FOR_DELEGATION flag on a controlled computer so the DC forwards TGTs to it, and coercing a privileged user to authenticate to that computer so a TGT is cached in memory. Extracting the TGT then allows impersonation. The other options describe constrained delegation, an unrelated SPN configuration, or a security control that blocks the attack.

CrackMapExec with valid credentials is the standard tool for quickly checking administrative access across many hosts. It performs a single authentication per host using the known password, avoiding lockout, and reports whether the account has local admin rights. Alternatives either risk lockout, capture unrelated credentials, or collect session data that does not directly answer the access question.

Stack addresses change during every execution of a program due to factors like system environment variables and memory allocation. If you use a hardcoded stack address in your exploit, it will likely be invalid the next time the program runs. A static JMP ESP address, found in a loaded DLL or the binary itself, remains constant, providing a reliable and stable redirect for your shellcode execution every time.

These security flags are critical for session hardening. 'HttpOnly' prevents client-side scripts from accessing the cookie via document.cookie, mitigating XSS-based session theft. 'Secure' ensures the cookie is only transmitted over encrypted HTTPS connections, preventing interception via man-in-the-middle attacks. Together, they provide a defense-in-depth layer protecting user session integrity, which is essential for maintaining secure authentication sessions against common web-based attacks during the post-authentication phase of an engagement.

The best action is to craft a URL with a malicious payload in the vulnerable parameter and send it to a victim. Because the vulnerability is DOM-based and triggered by URL parameters, visiting the link executes the payload in the victim's browser. This directly demonstrates the impact, such as session hijacking or data theft, and is a standard proof of concept for DOM-based XSS.

AMSI scans buffers passed to functions like AmsiScanBuffer; to evade it without disabling Defender, the tester can patch AmsiScanBuffer in memory to return a benign result. This prevents the shellcode from being flagged. Encoding, CFG, or user privileges do not stop AMSI from scanning the buffer at runtime.

Service binary hijacking is a powerful technique where an attacker replaces a legitimate executable with a malicious one. Since the service runs as SYSTEM, the replaced binary will execute with those high privileges upon the next service start. This method is often more reliable than DLL hijacking because it directly controls the primary execution flow of the service, provided the attacker can restart the service or wait for a system reboot.

Nmap is the industry-standard tool for port scanning and service enumeration. By identifying open ports and the software versions running on them, a tester can pinpoint specific vulnerabilities to research. This step is the foundation of the reconnaissance phase, as it maps the target's attack surface and guides the subsequent selection of exploits, ensuring a focused and efficient penetration testing process.

When a cron job runs as root, any script it executes also runs with root privileges. If the script is writeable by a low-privileged user, it can be modified to include a reverse shell. This is a common misconfiguration that highlights the importance of checking file permissions and cron job schedules during the post-exploitation phase of a penetration test or a professional security assessment.

The 'NOPASSWD' tag indicates that the user can execute the specified command with sudo privileges without being prompted for their own password. This is a critical misconfiguration, as it removes the authentication barrier for privilege escalation. In an attack scenario, it allows for immediate, automated execution of commands as root, which is significantly more dangerous than configurations that still require a user to authenticate via their password.

The `dig axfr` command is the direct way to request a zone transfer from a name server. It targets the specific DNS server and domain, and if the server allows transfers, it returns the full zone file. Other commands may perform DNS queries but do not explicitly request a zone transfer.

When ICMP is filtered by firewalls, TCP SYN scanning on common ports like 80 or 443 is an effective alternative for host discovery. This technique works because the target system responds to a SYN packet with a SYN/ACK if the port is open, or an RST if closed, confirming the host's presence. Mastering non-ICMP discovery is critical for bypass techniques in hardened network environments where security policies block traditional discovery methods.

Public exploits are typically written against a specific environment, which may differ from your target's configuration. Variations in operating systems, patch levels, installed libraries, or memory protection mechanisms like ASLR and DEP can prevent the exploit from succeeding. Understanding these environmental dependencies is key to troubleshooting failed exploits, as it often requires you to manually port or adjust the exploit to fit the target's unique security posture.

The correct technique is XSS-based request forgery, where JavaScript executed via XSS in the victim's browser is used to send authenticated requests to the application. Because the script runs in the origin of the vulnerable site, it can read anti-CSRF tokens and include them in the forged request, defeating typical CSRF protections. This is a client-side attack that combines script execution with request forgery.

Local port forwarding with SSH uses the -L local_port:remote_host:remote_port syntax. The attacking machine listens on the local port and forwards connections through the SSH tunnel to the pivot, which then connects to the specified remote host and port. This is the standard way to access an internal service from an external machine.

Nmap's scripting engine (NSE) is the most effective way to check for specific vulnerabilities like EternalBlue without requiring a full-scale vulnerability scanner. The 'smb-vuln-ms17-010' script is specifically designed to detect this vulnerability. Using such targeted scripts allows for accurate assessment with minimal footprint, which is a hallmark of professional penetration testing practices, ensuring the system's security posture is evaluated safely and effectively during the reconnaissance phase.

Header inspection and error-page analysis both identify server technology using ordinary, non-destructive requests. Headers may name the server and runtime directly, while distinctive 404 templates expose the stack when banners are hidden. Together they fingerprint the web service safely, whereas crash attempts, full port sweeps, and credential guessing are intrusive or simply unrelated to identifying the technology.

For an unquoted service path to be exploitable, a writable directory must exist in the search order before the intended executable, such as `C:\Program.exe` or `C:\Program Files\My.exe`. When the service starts, Windows will execute the first found executable from that path. If you can place a malicious binary in a writable location and the service restarts, you gain code execution as the service account.

A public exploit with a hardcoded return address and a note about ASLR being disabled on a different build is not portable as-is. The reliable path is to debug the target process, calculate the correct offset and return address for the specific Windows build, and update the exploit's payload. Blindly running it risks a crash, and altering the target's ASLR configuration is neither appropriate nor feasible without prior access.

Chisel's client dials the server, so a compromised host with only outbound access can still establish a tunnel. When the server is started with reverse tunneling and SOCKS support, the operator gets a SOCKS proxy locally that routes through the client into the internal network. This makes Chisel a practical choice when a full agent is undesirable.

JMP ESP is preferred because its address in a non-ASLR module is constant, whereas stack addresses fluctuate, making direct jumps unreliable. It provides a deterministic pivot to shellcode placed after the return address. It does not encode payloads, resize buffers, or change privileges; those are separate concerns in exploit development.

Module stomping avoids allocating new executable memory by reusing the existing .text section of a loaded DLL. Since the memory is already executable and associated with a legitimate module, it bypasses detection logic that looks for new PAGE_EXECUTE_READWRITE allocations or suspicious thread creation. Other injection methods require allocating or modifying executable memory in ways that behavioral monitoring commonly correlates with malicious activity, making them more likely to be flagged.

Bad characters are bytes that cause a function or protocol to stop processing input prematurely. If these characters exist in your shellcode, the application will truncate the payload. Identifying these characters ensures that the full exploit string is correctly placed into memory, allowing the overflow to reach the return address and execute the shellcode as intended without corruption or partial injection.

When HS256 is enforced but the secret is weak, the practical attack is an offline dictionary or brute-force attack against the HMAC using a captured token. Recovering the secret allows the attacker to mint arbitrary tokens, including one with elevated privileges. Algorithm-confusion and `alg:none` attacks require different misconfigurations that are not present in this scenario.

HttpOnly is designed to prevent client-side scripts from reading cookie values, but it does not prevent script execution or stop the browser from sending the cookie with requests. An attacker who achieves XSS can still act as the victim by issuing requests, reading page content, or capturing keystrokes. The session cookie may be inaccessible to document.cookie, but the authenticated session remains exploitable.

The EIP (Extended Instruction Pointer) register holds the memory address of the next instruction the CPU should execute. In an exploit, the goal is to overwrite this register by corrupting the saved return address on the stack. When the function finishes, the CPU pops this controlled value into EIP, forcing the processor to jump to the attacker's shellcode, thus hijacking the control flow of the entire application.

The 'GatewayPorts no' setting in the sshd_config specifically prevents forwarded ports from binding to any interface other than the loopback (localhost). Even if the user specifies 0.0.0.0 or a public IP in their SSH command, the server will ignore this request and bind the port only to 127.0.0.1. This is a common security hardening measure to prevent unauthorized access to forwarded ports from external networks.

AMSI performs in-process scanning through functions resolved from amsi.dll, most notably AmsiScanBuffer. Because the DLL is loaded into the calling process, a user-mode patch of that function in memory changes scan results for that process only, needs no administrative rights, and writes nothing to disk. Deleting system files, inventing registry policies, or adjusting execution policy do not alter the in-memory scanning path AMSI uses.

Understanding how an exploit communicates is vital for both success and stealth. By identifying the hardcoded target port and the type of callback payload (e.g., reverse shell vs. bind shell), you can align your listener and firewall configuration to ensure the exploit functions correctly. This level of technical oversight is essential to avoid common pitfalls where the exploit succeeds, but the attacker fails to receive the connection due to network-level misconfigurations.

When the stack is non-executable, direct shellcode execution fails. The ret2libc technique bypasses this by reusing existing executable code, typically calling functions like system() with controlled arguments. This is a standard method taught in PEN-200 for defeating NX, provided you can locate the necessary addresses and gadgets.

Dynamic port forwarding with ssh -D creates a local SOCKS proxy that forwards connections through the SSH server. Applications configured to use that SOCKS proxy can reach any host the SSH server can reach, making it ideal for pivoting into internal networks with tools like Nmap and Metasploit.

Reviewing the exploit's source code is the most important step because it reveals exactly what the code will execute. Permission and sandboxing are valuable but secondary to understanding the code, which protects both the client and the tester from unintended consequences.

An exposed '.git' directory allows an attacker to download the entire project repository, including source code, configuration files, and commit history. This is a critical discovery because the source code may contain hardcoded credentials, API keys, or sensitive business logic that would otherwise be hidden. Analyzing this data often provides the most direct path to exploitation, as it reveals the application's internal workings and potential flaws that are not apparent from the outside.

To forge a Golden Ticket, you need the KRBTGT account's NTLM hash to encrypt the ticket and the domain SID to populate the PAC correctly. These two elements allow you to create a TGT for any user, granting persistent domain-wide access. Other items like a valid TGT or user passwords are not required, as the ticket is self-signed with the KRBTGT hash.

The saved EBP is part of the standard function epilogue, which helps the program restore the stack frame of the calling function. In a buffer overflow, this value is overwritten immediately before the return address. While usually not the primary target for flow hijacking, it is a critical piece of the stack frame that, if corrupted, will likely cause the program to crash when it attempts to restore the stack frame after the function finishes.

Mapping administrative access requires testing authorization, not just reachability or inventory. Credentialed tools such as CrackMapExec and NetExec authenticate to each host and report whether the supplied account holds administrative rights, typically by performing a privileged action. Port scans only show that SMB is listening, directory queries only list computers, and packet capture observes rather than tests, so none of those alternatives directly answers where the low-privilege account can move laterally.

XSS occurs when untrusted user input is rendered in an unsafe context within the HTML document. Examining input reflected directly inside HTML body tags or inside event handler attributes (like onload or onerror) are primary areas where browsers will evaluate injected strings as executable JavaScript.

Blind SQL injection relies on inferring data through side channels like time delays or Boolean logic. Time-based payloads force the database to pause, while Boolean-based payloads cause the page content to change based on true/false conditions. These methods are essential when direct data output is suppressed, allowing an attacker to reconstruct the database contents systematically through repeated, measured queries to the back-end server.

The AlwaysInstallElevated policy is a specific Windows feature that allows non-privileged users to run Windows Installer (MSI) packages with SYSTEM privileges. For this to work, the policy must be enabled in both the machine (HKLM) and user (HKCU) registry hives. Attackers can exploit this by crafting a malicious MSI file that executes a command, such as adding a user or opening a reverse shell.

Creating a TUN or TAP device using tools like sshuttle or OpenVPN establishes a Layer 3 or Layer 2 tunnel respectively. A TAP interface operates at Layer 2, allowing raw Ethernet frames to cross the boundary. This capability is essential when standard TCP/UDP port forwarding fails because you need to execute broadcast-dependent reconnaissance or vulnerability scanning against hidden internal subnets.

The URL fragment (the part after the # character) is strictly handled by the browser and is never included in the HTTP request sent to the server. Because developers often assume this data is 'safe' or ignored by the backend, they frequently fail to sanitize it before using it in client-side operations, creating an ideal vector for DOM-based XSS attacks that bypass traditional WAFs.

By manipulating the PATH environment variable, you can point the system to a malicious 'cat' executable created in a writable directory. When the SUID binary runs, it executes your script with the permissions of the file owner rather than yours. This technique exploits the insecure execution of external commands, a common vulnerability in improperly coded SUID binaries that allows for arbitrary command execution under an elevated security context.

This command downloads and executes a PowerShell script directly into memory from a remote server. This is a common technique for running automated enumeration scripts like PowerUp or WinPEAS without writing them to the disk. By executing in memory, the attacker minimizes their footprint on the host system, avoiding detection by file-based signature scanning while gathering information about potential escalation vectors.

Clickjacking tricks users into clicking something different from what they perceive, often by overlaying a hidden, malicious iframe over a legitimate page element. The objective is to force the user to perform unintended actions, like changing account settings or transferring funds, while they believe they are interacting with the benign UI. This leverages the user's existing session to execute authorized requests without their informed consent.

Predictable tokens compromise the integrity of session management and password reset mechanisms. If an attacker can determine the algorithm and seed used by the generator, they can forge valid session tokens or reset codes for other users. This vulnerability highlights the necessity of using cryptographically secure pseudorandom number generators (CSPRNGs) to ensure that sensitive authentication tokens cannot be guessed or recreated by adversaries.