CVA CVA Exploit Frameworks & Attack Vectors

Question 1

What is the primary purpose of Metasploit Framework in a vulnerability assessment engagement?

Accepted Answer

Exploiting known vulnerabilities to demonstrate proof-of-concept compromise and validate scanner findings

Answer

Passive network traffic analysis

Answer

Generating compliance reports

Answer

Scanning for open ports and services

Question 2

In Metasploit, what is a 'payload' in the context of exploitation?

Accepted Answer

The code executed on the target system after a successful exploit to achieve an attacker objective

Answer

The initial network packet sent to identify open ports

Answer

The authentication bypass technique used against the target

Answer

The encrypted tunnel used for command and control communication

Question 3

What distinguishes a 'staged' payload from a 'stageless' payload in exploit frameworks?

Accepted Answer

Staged payloads send a small initial stage to download the full payload, while stageless payloads contain the complete functionality in one package

Answer

Staged payloads encrypt communication while stageless payloads do not

Answer

Staged payloads target Windows systems while stageless target Linux

Answer

Staged payloads require admin rights while stageless do not

Question 4

Which Metasploit module type is used for post-exploitation activities such as credential dumping and privilege escalation?

Accepted Answer

Post modules

Answer

Auxiliary modules

Answer

Exploit modules

Answer

Encoder modules

Question 5

What is the purpose of 'encoder' modules in exploit frameworks like Metasploit?

Accepted Answer

To obfuscate payloads to evade signature-based detection by antivirus or IDS

Answer

To speed up exploitation by pre-compiling shellcode

Answer

To convert exploit code between programming languages

Answer

To compress payload size for faster delivery

Question 6

During an assessment using exploit frameworks, what is 'privilege escalation' and why is it significant?

Accepted Answer

Expanding access from a low-privilege user account to higher-privilege or administrator-level access on a compromised system

Answer

Escalating the severity rating of a vulnerability finding

Answer

Gaining access to additional network segments

Answer

Increasing the priority of a Metasploit job