eJPT - eLearnSecurity Junior Penetration Tester Pivoting and Lateral Movement Questions and Answers — Questions and Answers
Question 1: In the context of a penetration test, which of the following best defines the term 'pivoting'?
- The process of escalating privileges from a standard user to an administrator on a single host.
- The technique of using a compromised system to attack other systems on different, non-directly accessible network segments. (Correct answer)
- The initial exploitation of a public-facing vulnerability to gain a foothold on the network perimeter.
- The act of analyzing network traffic to identify potential targets and services.
Correct answer: The technique of using a compromised system to attack other systems on different, non-directly accessible network segments.
Pivoting is the technique of using a compromised machine as a 'pivot point' or foothold to attack other systems within a network. This allows a penetration tester to access internal network segments that are not directly reachable from their own machine.
Question 2: A penetration tester has compromised a public-facing web server and wants to scan the internal network (192.168.10.0/24) from their attack machine. They set up a SOCKS proxy on the compromised server. Which tool is specifically designed to force other applications, like Nmap, to route their traffic through this SOCKS proxy?
- Netcat
- Wireshark
- ProxyChains (Correct answer)
- Hydra
Correct answer: ProxyChains
ProxyChains is a tool that allows a user to force any TCP connection made by a given application to pass through a series of proxy servers. It is commonly used in penetration testing to pivot into internal networks by routing tools like Nmap or Metasploit through a SOCKS proxy on a compromised host.
Question 3: After gaining an initial foothold on a user's workstation inside a corporate network, what is the primary objective of performing lateral movement?
- To install ransomware on the single compromised workstation.
- To immediately exfiltrate all data found on the initial host.
- To expand access by compromising other systems, locating valuable assets, and escalating privileges throughout the network. (Correct answer)
- To delete logs on the first machine to erase any evidence of the intrusion.
Correct answer: To expand access by compromising other systems, locating valuable assets, and escalating privileges throughout the network.
The primary goal of lateral movement is to move beyond the initial point of compromise to explore the network, gain access to more systems, find high-value targets (like domain controllers or databases), and escalate privileges. This expands the attacker's control and gets them closer to their ultimate objective.
Question 4: A tester has SSH access to a bastion host at `203.0.113.10`. This host can access an internal database server at `10.10.20.5` on port `3306`. To manage the database from their local machine, the tester needs to forward their local port `3307` to the database server through the bastion host. Which command will achieve this?
- ssh -D 3307 user@203.0.113.10
- ssh -R 3307:10.10.20.5:3306 user@203.0.113.10
- ssh -L 3307:10.10.20.5:3306 user@203.0.113.10 (Correct answer)
- ssh -J user@203.0.113.10 root@10.10.20.5
Correct answer: ssh -L 3307:10.10.20.5:3306 user@203.0.113.10
The `ssh -L` option creates a local port forward. The command `ssh -L 3307:10.10.20.5:3306 user@203.0.113.10` tells the SSH client to listen on local port 3307 and forward any connections to that port through the SSH server (`203.0.113.10`) to the destination host (`10.10.20.5`) on port `3306`.
Question 5: A penetration tester is on an internal network and uses a tool to intercept an NTLM authentication attempt from a victim client. The tester then forwards this authentication request to a target file server to gain access. What is this lateral movement technique called?
- Pass-the-Hash
- Kerberoasting
- SMB Relay (Correct answer)
- LLMNR Poisoning
Correct answer: SMB Relay
An SMB Relay attack involves an attacker placing themselves between a client and a server, intercepting an authentication request (like NTLM), and relaying it to a target server. If successful, the attacker gains access to the target server with the victim's privileges, without ever needing to crack the password hash.
Question 6: A penetration tester has established a foothold on a Windows machine in a DMZ. They discover this machine has a second network interface connected to an internal network segment (e.g., 172.18.0.0/24). Which of the following techniques would allow the tester to redirect traffic from their attacking machine through the compromised host to access services on the internal network?
- Privilege Escalation
- Credential Dumping
- Port Forwarding (Correct answer)
- Brute Forcing
Correct answer: Port Forwarding
Port forwarding is a technique used to redirect traffic from one network address and port number combination to another. In this scenario, the tester would set up port forwarding on the compromised DMZ machine to relay traffic from a port they can access to a target IP and port on the internal, otherwise unreachable network segment.
eJPT - eLearnSecurity Junior Penetration Tester Pivoting and Lateral Movement Questions and Answers
In the context of a penetration test, which of the following best defines the term 'pivoting'?