eJPT - eLearnSecurity Junior Penetration Tester Host and Network Auditing Questions and Answers — Questions and Answers
Question 1: After gaining initial access to a Windows host, a penetration tester wants to audit the system for missing security patches that could be leveraged for privilege escalation. Which of the following native Windows commands is most suitable for quickly listing the installed hotfixes?
- systeminfo
- wmic qfe list (Correct answer)
- netstat -ano
- tasklist
Correct answer: wmic qfe list
The `wmic qfe list` command is the most direct and suitable method for this task. It uses the Windows Management Instrumentation Command-line (WMIC) to query the Quick Fix Engineering (QFE) database, providing a clear list of all installed patches and hotfixes. `systeminfo` provides general system information but the patch data is less structured. `netstat` lists network connections, and `tasklist` shows running processes.
Question 2: During a network audit, a junior penetration tester captures network traffic using Wireshark. They apply the display filter `http.request.method == "POST"`. What is the primary purpose of using this specific filter?
- To isolate all unencrypted web traffic.
- To find DNS queries for HTTP servers.
- To identify potential login attempts or data submissions over HTTP. (Correct answer)
- To view only the responses from web servers.
Correct answer: To identify potential login attempts or data submissions over HTTP.
The `http.request.method == "POST"` filter in Wireshark specifically isolates HTTP requests that use the POST method. This method is commonly used to send data from a client to a server, such as submitting login credentials, filling out forms, or uploading files. Analyzing this traffic is crucial for finding sensitive information being transmitted in cleartext.
Question 3: A penetration tester is auditing a Linux server and wants to review which commands a specific user, 'jdoe', has executed. Assuming the user's command history is being saved, which file should the tester examine?
- /etc/passwd
- /var/log/auth.log
- ~jdoe/.bash_history (Correct answer)
- /root/.profile
Correct answer: ~jdoe/.bash_history
The `.bash_history` file, located in a user's home directory (represented by `~`), stores a log of the commands entered into the Bash shell. By examining `~jdoe/.bash_history`, a tester can see the command history for the user 'jdoe'. `/etc/passwd` contains user account information, `/var/log/auth.log` tracks authentication events, and `/root/.profile` is a configuration file for the root user's shell.
Question 4: While auditing a network, you identify a device responding on UDP port 161. You suspect it might be running the Simple Network Management Protocol (SNMP) with a default community string. Which of the following actions would be the most effective next step to confirm this and enumerate information?
- Run an Nmap TCP scan using `nmap -sT -p 161 <IP>`.
- Use a tool like `snmp-check` or `onesixtyone` with a list of common community strings. (Correct answer)
- Attempt to connect to the port using Netcat to grab the banner.
- Perform a full UDP port scan on the host using `nmap -sU <IP>`.
Correct answer: Use a tool like `snmp-check` or `onesixtyone` with a list of common community strings.
Tools like `snmp-check` and `onesixtyone` are specifically designed to query SNMP services. They can be used with a wordlist of common community strings (like 'public' and 'private') to test for access and, if successful, automatically dump a large amount of system and network information. This is far more effective than just confirming the port is open.
Question 5: A penetration tester is performing an internal network audit and needs to check for null sessions on a Windows host at 192.168.1.50. A null session vulnerability could allow an unauthenticated user to enumerate information. Which of the following commands would be used to attempt to establish a null session?
- smbclient //192.168.1.50/IPC$ -U ""
- net view 192.168.1.50
- rpcclient -U "" -N 192.168.1.50 (Correct answer)
- nmap -sU --script smb-enum-shares.nse 192.168.1.50
Correct answer: rpcclient -U "" -N 192.168.1.50
The `rpcclient` tool is designed to execute client-side MS-RPC functions. The command `rpcclient -U "" -N 192.168.1.50` attempts to connect to the target's RPC service using an anonymous username (`-U ""`) and no password (`-N`), which is the definition of a null session. `smbclient` is for SMB shares, `net view` lists shares but doesn't explicitly test the null session in this manner, and the Nmap command specified is for UDP scanning.
Question 6: During a host audit of a Linux machine, you need to find all files that have the Set User ID (SUID) permission bit set, as these could be potential vectors for privilege escalation. Which of the following commands would accomplish this?
- find / -perm -u=s -type f 2>/dev/null (Correct answer)
- ls -l / -R | grep 'r-s'
- chmod -R u+s /
- grep -r "suid" /etc
Correct answer: find / -perm -u=s -type f 2>/dev/null
The command `find / -perm -u=s -type f 2>/dev/null` is the standard and most accurate way to locate SUID files. `find /` starts the search from the root directory. `-perm -u=s` specifies the permission to look for (SUID bit for the user). `-type f` limits the search to files only. `2>/dev/null` redirects any permission-denied errors to null, cleaning up the output.
eJPT - eLearnSecurity Junior Penetration Tester Host and Network Auditing Questions and Answers
After gaining initial access to a Windows host, a penetration tester wants to audit the system for missing security patches that could be leveraged for privilege escalation.
Which of the following native Windows commands is most suitable for quickly listing the installed hotfixes?