CVA Exploit Frameworks & Attack Vectors Flashcards

What is the primary purpose of Metasploit Framework in a vulnerability assessment engagement?

Answer: Exploiting known vulnerabilities to demonstrate proof-of-concept compromise and validate scanner findings

Metasploit provides a collection of exploits, payloads, and auxiliary modules used to validate whether identified vulnerabilities are actually exploitable in the target environment.

In Metasploit, what is a 'payload' in the context of exploitation?

Answer: The code executed on the target system after a successful exploit to achieve an attacker objective

A payload is the code delivered through an exploit that executes on the compromised target, providing the attacker with capabilities like a shell, Meterpreter session, or file execution.

What distinguishes a 'staged' payload from a 'stageless' payload in exploit frameworks?

Answer: Staged payloads send a small initial stage to download the full payload, while stageless payloads contain the complete functionality in one package

Staged payloads use a small first stage to call back and download the larger payload, useful when exploit buffer size is limited; stageless payloads contain everything needed in a single, self-contained package.

Which Metasploit module type is used for post-exploitation activities such as credential dumping and privilege escalation?

Answer: Post modules

Post modules in Metasploit perform post-exploitation tasks on an already-compromised session, including credential harvesting, privilege escalation, and persistence establishment.

What is the purpose of 'encoder' modules in exploit frameworks like Metasploit?

Answer: To obfuscate payloads to evade signature-based detection by antivirus or IDS

Encoder modules transform payload shellcode to avoid bad characters and evade signature-based detection, though modern AV/EDR has largely reduced their effectiveness.

During an assessment using exploit frameworks, what is 'privilege escalation' and why is it significant?

Answer: Expanding access from a low-privilege user account to higher-privilege or administrator-level access on a compromised system

Privilege escalation moves from an initial low-privilege foothold to higher-privilege access (e.g., SYSTEM/root), dramatically expanding the impact and scope of a compromise.