PJPT: Exploitation Basics

What the exam tests

Exploitation basics covers validating a weakness and gaining an initial foothold without destabilizing the target. The exam rewards controlled exploitation, correct payload configuration, and clear evidence that the vulnerability was real.

Core rules and concepts

• Validate before exploiting: reproduce the condition with a benign request or read-only command.
• Prefer the least invasive exploit; avoid destructive payloads, disk wipes, and service restarts unless authorized.
• Match payload architecture and network path: set LHOST to the reachable interface, LPORT to a listening port, and use a staged payload only when size or stability demands it.
• Stabilize shells with python3 -c 'import pty; pty.spawn("/bin/bash")', then set TERM, background, and stty raw -echo.
• Capture command output and timestamps as evidence; note the exact exploit path and any failed attempts.

Worked example

Enumeration finds an outdated file-sharing service on 10.10.10.20. searchsploit identifies a remote code execution module. You start msfconsole, use the module, set RHOSTS 10.10.10.20, LHOST 10.10.10.50, LPORT 4444, and run it. The session returns as www-data. Reasoning: the module is chosen only after version confirmation, LHOST is the exam network interface, and the shell is stabilized before any privilege enumeration. If the first payload fails, you check firewall egress and architecture before trying another.

Traps

Leaving LHOST as a VPN address the target cannot reach, using a 64-bit payload on a 32-bit service, running an exploit without confirming the version, and failing to document failed attempts. Destructive exploits and uncontrolled brute force can invalidate the engagement.