CVA Operating System & Host-Based Vulnerabilities Flashcards

What is a pass-the-hash (PtH) attack?

Answer: Using a captured NTLM password hash to authenticate without knowing the plaintext password

In a pass-the-hash attack, an attacker uses a stolen NTLM hash to authenticate to a remote system without needing the actual plaintext password.

Which tool is most commonly associated with extracting Windows credential hashes from memory during a penetration test?

Answer: Mimikatz

Mimikatz is a widely used post-exploitation tool that can extract plaintext passwords, hashes, and Kerberos tickets from Windows memory (LSASS process).

What is the primary function of a Host-Based Intrusion Detection System (HIDS)?

Answer: Monitoring and analyzing activity on a single host for signs of compromise

A HIDS monitors system logs, file integrity, and process activity on a specific host to detect unauthorized changes or suspicious behavior indicative of a compromise.

What type of vulnerability occurs when a program writes more data to a buffer than it was allocated to hold?

Answer: Buffer overflow

A buffer overflow occurs when excess data overwrites adjacent memory regions, potentially allowing attackers to overwrite return addresses or inject shellcode.

Which Linux file stores hashed user passwords and is typically readable only by root?

Answer: /etc/shadow

The /etc/shadow file contains hashed passwords for user accounts and is restricted to root access, separating password hashes from the world-readable /etc/passwd file.

What is the Windows Security Accounts Manager (SAM) database used for?

Answer: Storing local user account credentials and password hashes

The SAM database stores local user account names and their hashed passwords (NTLM), and is a common target for credential harvesting during host-based attacks.

What does kernel exploitation typically aim to achieve?

Answer: Obtaining ring-0 (kernel-level) privileges to fully control the operating system

Kernel exploitation targets vulnerabilities in the OS kernel to gain ring-0 (highest privilege) access, giving an attacker complete control over the system including hardware and all processes.