eJPT - eLearnSecurity Junior Penetration Tester Pivoting and Lateral Movement Questions and Answers

Question 1

In the context of a penetration test, which of the following best defines the term 'pivoting'?

Accepted Answer

The technique of using a compromised system to attack other systems on different, non-directly accessible network segments.

Answer

Pivoting is the technique of using a compromised machine as a 'pivot point' or foothold to attack other systems within a network. This allows a penetration tester to access internal network segments that are not directly reachable from their own machine.

Question 2

A penetration tester has compromised a public-facing web server and wants to scan the internal network (192.168.10.0/24) from their attack machine. They set up a SOCKS proxy on the compromised server. Which tool is specifically designed to force other applications, like Nmap, to route their traffic through this SOCKS proxy?

Accepted Answer

ProxyChains

Answer

ProxyChains is a tool that allows a user to force any TCP connection made by a given application to pass through a series of proxy servers. It is commonly used in penetration testing to pivot into internal networks by routing tools like Nmap or Metasploit through a SOCKS proxy on a compromised host.

Question 3

After gaining an initial foothold on a user's workstation inside a corporate network, what is the primary objective of performing lateral movement?

Accepted Answer

To expand access by compromising other systems, locating valuable assets, and escalating privileges throughout the network.

Answer

The primary goal of lateral movement is to move beyond the initial point of compromise to explore the network, gain access to more systems, find high-value targets (like domain controllers or databases), and escalate privileges. This expands the attacker's control and gets them closer to their ultimate objective.

Question 4

A tester has SSH access to a bastion host at `203.0.113.10`. This host can access an internal database server at `10.10.20.5` on port `3306`. To manage the database from their local machine, the tester needs to forward their local port `3307` to the database server through the bastion host. Which command will achieve this?

Accepted Answer

ssh -L 3307:10.10.20.5:3306 user@203.0.113.10

Answer

The `ssh -L` option creates a local port forward. The command `ssh -L 3307:10.10.20.5:3306 user@203.0.113.10` tells the SSH client to listen on local port 3307 and forward any connections to that port through the SSH server (`203.0.113.10`) to the destination host (`10.10.20.5`) on port `3306`.

Question 5

A penetration tester is on an internal network and uses a tool to intercept an NTLM authentication attempt from a victim client. The tester then forwards this authentication request to a target file server to gain access. What is this lateral movement technique called?

Accepted Answer

SMB Relay

Answer

An SMB Relay attack involves an attacker placing themselves between a client and a server, intercepting an authentication request (like NTLM), and relaying it to a target server. If successful, the attacker gains access to the target server with the victim's privileges, without ever needing to crack the password hash.

eJPT - eLearnSecurity Junior Penetration Tester Practice Test

eJPT - eLearnSecurity Junior Penetration Tester Practice Test

eJPT - eLearnSecurity Junior Penetration Tester Pivoting and Lateral Movement Questions and Answers