eJPT Attacks and Exploits 4 — Questions and Answers
Question 1: Which protocol is most commonly exploited by the EternalBlue vulnerability (MS17-010)?
- HTTP
- SMB (Correct answer)
- RDP
- FTP
Correct answer: SMB
EternalBlue exploits a buffer overflow vulnerability in Microsoft's SMBv1 protocol, enabling unauthenticated remote code execution.
Question 2: What is the purpose of the `john` tool in a penetration test?
- Network packet capture
- Password hash cracking (Correct answer)
- Port scanning
- Exploit development
Correct answer: Password hash cracking
John the Ripper is a password cracking tool that uses dictionary, brute-force, and rule-based attacks against hashed passwords.
Question 3: In a dictionary attack against a login form, what is the attacker using as input?
- Randomly generated character strings
- A precompiled list of common passwords/words (Correct answer)
- Leaked encryption keys
- Rainbow table hashes
Correct answer: A precompiled list of common passwords/words
A dictionary attack uses a wordlist of likely passwords (common words, phrases, known breached passwords) rather than pure random guessing.
Question 4: Which Metasploit payload format is completely self-contained with no external stager needed?
- Staged payload (windows/meterpreter/reverse_tcp)
- Stageless payload (windows/meterpreter_reverse_tcp) (Correct answer)
- Reflective payload
- Inline listener
Correct answer: Stageless payload (windows/meterpreter_reverse_tcp)
Stageless payloads (with underscore before the payload name) include the full Meterpreter embedded in the shellcode without needing a separate stager.
Question 5: What is 'fuzzing' in the context of vulnerability research?
- Obfuscating exploit code to bypass AV
- Sending large volumes of random/malformed data to discover crashes (Correct answer)
- Using social engineering to extract credentials
- Scanning for open ports with randomized timing
Correct answer: Sending large volumes of random/malformed data to discover crashes
Fuzzing sends unexpected, malformed, or random input to an application to trigger crashes, memory corruption, or other vulnerabilities.
Question 6: Which technique does Hydra use to test credentials against network services?
- Hash interception via MITM
- Online brute-force / dictionary attacks (Correct answer)
- Pass-the-hash authentication
- Kerberoasting
Correct answer: Online brute-force / dictionary attacks
Hydra performs online brute-force and dictionary attacks by directly attempting credential combinations against live network services like SSH, FTP, HTTP.
Question 7: What is the main risk of leaving SMBv1 enabled on a network according to eJPT objectives?
- It creates excessive broadcast traffic
- It is vulnerable to critical exploits like EternalBlue allowing remote code execution (Correct answer)
- It prevents proper file sharing between modern clients
- It exposes NetBIOS name resolution data
Correct answer: It is vulnerable to critical exploits like EternalBlue allowing remote code execution
SMBv1 contains multiple critical vulnerabilities including MS17-010 (EternalBlue) that allow unauthenticated attackers to execute code remotely.
eJPT Attacks and Exploits 4
Which protocol is most commonly exploited by the EternalBlue vulnerability (MS17-010)?