eJPT - eLearnSecurity Junior Penetration Tester Pivoting and Lateral Movement Questions and Answers

Question 1

In the context of a penetration test, which of the following best defines the term 'pivoting'?

Accepted Answer

The technique of using a compromised system to attack other systems on different, non-directly accessible network segments.

Answer

The process of escalating privileges from a standard user to an administrator on a single host.

Answer

The initial exploitation of a public-facing vulnerability to gain a foothold on the network perimeter.

Answer

The act of analyzing network traffic to identify potential targets and services.

Question 2

A penetration tester has compromised a public-facing web server and wants to scan the internal network (192.168.10.0/24) from their attack machine. They set up a SOCKS proxy on the compromised server. Which tool is specifically designed to force other applications, like Nmap, to route their traffic through this SOCKS proxy?

Accepted Answer

ProxyChains

Answer

Netcat

Answer

Wireshark

Answer

Hydra

Question 3

After gaining an initial foothold on a user's workstation inside a corporate network, what is the primary objective of performing lateral movement?

Accepted Answer

To expand access by compromising other systems, locating valuable assets, and escalating privileges throughout the network.

Answer

To install ransomware on the single compromised workstation.

Answer

To immediately exfiltrate all data found on the initial host.

Answer

To delete logs on the first machine to erase any evidence of the intrusion.

Question 4

A tester has SSH access to a bastion host at `203.0.113.10`. This host can access an internal database server at `10.10.20.5` on port `3306`. To manage the database from their local machine, the tester needs to forward their local port `3307` to the database server through the bastion host. Which command will achieve this?

Accepted Answer

ssh -L 3307:10.10.20.5:3306 user@203.0.113.10

Answer

ssh -D 3307 user@203.0.113.10

Answer

ssh -R 3307:10.10.20.5:3306 user@203.0.113.10

Answer

ssh -J user@203.0.113.10 root@10.10.20.5

Question 5

A penetration tester is on an internal network and uses a tool to intercept an NTLM authentication attempt from a victim client. The tester then forwards this authentication request to a target file server to gain access. What is this lateral movement technique called?

Accepted Answer

SMB Relay

Answer

Pass-the-Hash

Answer

Kerberoasting

Answer

LLMNR Poisoning

Question 6

A penetration tester has established a foothold on a Windows machine in a DMZ. They discover this machine has a second network interface connected to an internal network segment (e.g., 172.18.0.0/24). Which of the following techniques would allow the tester to redirect traffic from their attacking machine through the compromised host to access services on the internal network?

Accepted Answer

Port Forwarding

Answer

Privilege Escalation

Answer

Credential Dumping

Answer

Brute Forcing