eJPT Pivoting and Lateral Movement 2

Question 1

You have a Meterpreter session on a compromised host with IP 10.10.10.5 that can reach the internal subnet 192.168.1.0/24. Which Metasploit command adds a route so subsequent modules can reach that internal subnet through this session?

Accepted Answer

route add 192.168.1.0/24 [session_id]

Answer

The `route add` command in Metasploit tells the framework to route traffic destined for the specified subnet through an existing session.

Question 2

When using proxychains for pivoting, which configuration file must be edited to specify the SOCKS proxy address and port?

Accepted Answer

/etc/proxychains.conf

Answer

Proxychains reads its proxy chain configuration (type, address, port) from /etc/proxychains.conf by default.

Question 3

Which SSH command syntax creates a dynamic SOCKS proxy on local port 1080 through a remote SSH server at jump.example.com?

Accepted Answer

ssh -D 1080 user@jump.example.com

Answer

The -D flag in SSH creates a dynamic application-level port forward (SOCKS proxy) on the specified local port.

Question 4

After setting up a Metasploit SOCKS proxy module (auxiliary/server/socks_proxy), what tool is typically used on the attacker machine to route other tools' traffic through it?

Accepted Answer

proxychains

Answer

Proxychains wraps any tool's TCP connections and routes them through a configured SOCKS proxy, enabling tools like nmap to reach internal networks.

Question 5

A pentester compromises a dual-homed Linux host at 10.0.0.5 (eth0) and 172.16.0.5 (eth1). To scan the 172.16.0.0/24 network from their Kali machine, they set up a SOCKS5 proxy and prepend 'proxychains' before which tool?

Accepted Answer

nmap

Answer

Proxychains can wrap nmap so that TCP scans are routed through the SOCKS proxy to reach otherwise unreachable internal segments.

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eJPT Pivoting and Lateral Movement 2