eJPT Attacks and Exploits 2 — Questions and Answers
Question 1: Which Metasploit command is used to search for a specific exploit module by name?
- use <module>
- search <keyword> (Correct answer)
- find <module>
- locate <keyword>
Correct answer: search <keyword>
The `search` command in msfconsole allows you to search for modules by keyword, name, CVE, or platform.
Question 2: What type of payload establishes a connection FROM the target machine TO the attacker?
- Bind shell
- Staged payload
- Reverse shell (Correct answer)
- Inline payload
Correct answer: Reverse shell
A reverse shell has the victim connect back to the attacker's machine, which helps bypass firewalls that block inbound connections.
Question 3: In an ARP poisoning attack, what does the attacker send to redirect traffic through their machine?
- Forged DNS responses
- Gratuitous ARP replies with the attacker's MAC (Correct answer)
- Fake DHCP offers
- ICMP redirect packets
Correct answer: Gratuitous ARP replies with the attacker's MAC
The attacker sends gratuitous ARP replies associating the gateway IP with their own MAC address, causing victims to send traffic through the attacker.
Question 4: Which SQL injection technique retrieves data by causing the database to generate time delays?
- Union-based injection
- Error-based injection
- Boolean-based blind injection
- Time-based blind injection (Correct answer)
Correct answer: Time-based blind injection
Time-based blind SQL injection uses functions like SLEEP() or WAITFOR DELAY to infer data based on how long the response takes.
Question 5: What is the primary purpose of a staged Metasploit payload (e.g., windows/meterpreter/reverse_tcp)?
- To encrypt the payload to avoid detection
- To send a small stager first that downloads the full payload (Correct answer)
- To use multiple protocols simultaneously
- To run the exploit in multiple stages against different ports
Correct answer: To send a small stager first that downloads the full payload
Staged payloads send a tiny initial stager that connects back to Metasploit and downloads the full Meterpreter payload, keeping the initial shellcode small.
Question 6: Which command in Meterpreter is used to escalate privileges by attempting known local exploits?
- getsystem (Correct answer)
- getuid
- elevate
- priv
Correct answer: getsystem
`getsystem` attempts various privilege escalation techniques automatically to gain SYSTEM-level access on Windows.
Question 7: What does a 'bind shell' payload do differently from a reverse shell?
- It encrypts traffic using TLS
- It listens on a port on the target for the attacker to connect to (Correct answer)
- It uses UDP instead of TCP
- It embeds itself in a legitimate process
Correct answer: It listens on a port on the target for the attacker to connect to
A bind shell opens a listening port on the compromised target, and the attacker connects to that port to get a shell.
eJPT Attacks and Exploits 2
Which Metasploit command is used to search for a specific exploit module by name?