CVA CVA Operating System & Host-Based Vulnerabilities 2 — Questions and Answers
Question 1: What is a pass-the-hash (PtH) attack?
- Cracking a hashed password offline using a rainbow table
- Using a captured NTLM password hash to authenticate without knowing the plaintext password (Correct answer)
- Injecting a hash collision into a digital certificate
- Replacing a legitimate file hash to bypass integrity checks
Correct answer: Using a captured NTLM password hash to authenticate without knowing the plaintext password
In a pass-the-hash attack, an attacker uses a stolen NTLM hash to authenticate to a remote system without needing the actual plaintext password.
Question 2: Which tool is most commonly associated with extracting Windows credential hashes from memory during a penetration test?
- Nmap
- Mimikatz (Correct answer)
- Burp Suite
- Wireshark
Correct answer: Mimikatz
Mimikatz is a widely used post-exploitation tool that can extract plaintext passwords, hashes, and Kerberos tickets from Windows memory (LSASS process).
Question 3: What is the primary function of a Host-Based Intrusion Detection System (HIDS)?
- Blocking inbound network traffic based on firewall rules
- Monitoring and analyzing activity on a single host for signs of compromise (Correct answer)
- Performing automated vulnerability scans across the network
- Encrypting data at rest on the host operating system
Correct answer: Monitoring and analyzing activity on a single host for signs of compromise
A HIDS monitors system logs, file integrity, and process activity on a specific host to detect unauthorized changes or suspicious behavior indicative of a compromise.
Question 4: What type of vulnerability occurs when a program writes more data to a buffer than it was allocated to hold?
- SQL injection
- Buffer overflow (Correct answer)
- Race condition
- Null pointer dereference
Correct answer: Buffer overflow
A buffer overflow occurs when excess data overwrites adjacent memory regions, potentially allowing attackers to overwrite return addresses or inject shellcode.
Question 5: Which Linux file stores hashed user passwords and is typically readable only by root?
- /etc/passwd
- /etc/shadow (Correct answer)
- /etc/login.defs
- /etc/pam.conf
Correct answer: /etc/shadow
The /etc/shadow file contains hashed passwords for user accounts and is restricted to root access, separating password hashes from the world-readable /etc/passwd file.
Question 6: What is the Windows Security Accounts Manager (SAM) database used for?
- Storing Kerberos tickets for domain authentication
- Storing local user account credentials and password hashes (Correct answer)
- Managing Windows Defender virus definition updates
- Tracking software license keys for installed applications
Correct answer: Storing local user account credentials and password hashes
The SAM database stores local user account names and their hashed passwords (NTLM), and is a common target for credential harvesting during host-based attacks.
Question 7: What does kernel exploitation typically aim to achieve?
- Enumerating open network ports on a target system
- Obtaining ring-0 (kernel-level) privileges to fully control the operating system (Correct answer)
- Generating a denial-of-service condition on a web server
- Bypassing application-layer firewalls using crafted HTTP headers
Correct answer: Obtaining ring-0 (kernel-level) privileges to fully control the operating system
Kernel exploitation targets vulnerabilities in the OS kernel to gain ring-0 (highest privilege) access, giving an attacker complete control over the system including hardware and all processes.
CVA CVA Operating System & Host-Based Vulnerabilities 2
What is a pass-the-hash (PtH) attack?