eJPT Attacks and Exploits 5 — Questions and Answers
Question 1: What is a 'null session' attack against Windows SMB?
- An attack that sends empty packets to crash SMB
- An unauthenticated connection to IPC$ share used to enumerate network info (Correct answer)
- A session that bypasses firewall rules using null bytes
- An attack that clears active SMB sessions
Correct answer: An unauthenticated connection to IPC$ share used to enumerate network info
A null session connects to the IPC$ share without credentials, historically allowing enumeration of users, groups, and shares on older Windows systems.
Question 2: In web application testing, what does CSRF (Cross-Site Request Forgery) force a victim to do?
- Download malware from a malicious site
- Execute unwanted actions on a site where they are already authenticated (Correct answer)
- Reveal their password through a fake login form
- Run client-side scripts injected into the page
Correct answer: Execute unwanted actions on a site where they are already authenticated
CSRF tricks authenticated users into unknowingly submitting forged requests to a web application, performing actions like changing passwords or transferring funds.
Question 3: Which Meterpreter command captures screenshots of the victim's desktop?
- screen_grab
- screenshot (Correct answer)
- desktop_capture
- printscreen
Correct answer: screenshot
The `screenshot` command in Meterpreter captures the current state of the victim's desktop and saves it locally for the attacker.
Question 4: What is 'pass-the-hash' in Windows environments?
- Cracking NTLM hashes offline then using the password
- Authenticating using the NTLM hash directly without knowing the plaintext password (Correct answer)
- Sending password hashes across the network to brute-force
- Using rainbow tables to reverse NTLM hashes
Correct answer: Authenticating using the NTLM hash directly without knowing the plaintext password
Pass-the-hash uses a captured NTLM hash directly for authentication in Windows, bypassing the need to crack it to plaintext first.
Question 5: Which tool is commonly used in eJPT labs to intercept and modify HTTP/HTTPS traffic from a web browser?
- Wireshark
- Nmap
- Burp Suite (Correct answer)
- Netcat
Correct answer: Burp Suite
Burp Suite acts as an intercepting proxy between the browser and web server, allowing testers to capture, inspect, and modify HTTP/HTTPS requests and responses.
Question 6: What is the goal of a 'brute-force' attack on an SSH service?
- To exploit a buffer overflow in the SSH daemon
- To systematically try every possible username/password combination until successful (Correct answer)
- To capture the SSH private key via traffic analysis
- To downgrade the SSH protocol version to SSHv1
Correct answer: To systematically try every possible username/password combination until successful
A brute-force attack against SSH exhaustively tries all combinations of credentials until it finds a valid username and password pair.
Question 7: When exploiting a vulnerable web application with SQL injection, what does the UNION keyword allow an attacker to do?
- Combine results from a malicious SELECT with the original query's results (Correct answer)
- Merge two database tables permanently
- Execute operating system commands via the database
- Bypass authentication by injecting always-true conditions
Correct answer: Combine results from a malicious SELECT with the original query's results
UNION-based SQL injection appends an attacker-controlled SELECT statement to the original query, allowing retrieval of data from other tables in the database.
eJPT Attacks and Exploits 5
What is a 'null session' attack against Windows SMB?