eJPT Pivoting and Lateral Movement 4 — Questions and Answers
Question 1: What technique does 'Pass-the-Hash' exploit to authenticate to Windows services without knowing the plaintext password?
- Using the captured NTLM hash directly for authentication (Correct answer)
- Cracking the hash offline and using the plaintext password
- Relaying the hash to a Kerberos KDC
- Injecting shellcode into lsass.exe
Correct answer: Using the captured NTLM hash directly for authentication
Pass-the-Hash abuses NTLM's challenge-response protocol by supplying the captured hash directly, since NTLM does not require the plaintext password.
Question 2: Which tool is commonly used for Pass-the-Hash attacks to get a shell on a remote Windows machine over SMB?
- pth-winexe (Correct answer)
- Mimikatz
- Hydra
- Ncrack
Correct answer: pth-winexe
pth-winexe is a modified version of winexe that accepts NTLM hashes directly, enabling remote command execution over SMB without a plaintext password.
Question 3: During lateral movement, a pentester discovers a Windows service account password hash. To move laterally using WMI, which Impacket script is most appropriate?
- wmiexec.py (Correct answer)
- psexec.py
- smbexec.py
- dcomexec.py
Correct answer: wmiexec.py
Impacket's wmiexec.py executes commands on remote Windows hosts via WMI, a stealthier alternative to psexec that doesn't drop a service binary.
Question 4: What network protocol does PsExec primarily use to move laterally between Windows hosts?
- SMB (port 445) (Correct answer)
- RDP (port 3389)
- WMI (port 135)
- SSH (port 22)
Correct answer: SMB (port 445)
PsExec creates a service on the target by uploading an executable over SMB's admin share (ADMIN$), then starts it remotely.
Question 5: Which Metasploit module can dump password hashes from a compromised Windows host to facilitate lateral movement?
- post/windows/gather/hashdump (Correct answer)
- auxiliary/scanner/smb/smb_login
- exploit/windows/smb/ms17_010_eternalblue
- post/multi/recon/local_exploit_suggester
Correct answer: post/windows/gather/hashdump
The hashdump post module extracts NTLM password hashes from a Windows host's SAM database, which can then be used for Pass-the-Hash attacks.
Question 6: A pentester has valid credentials for a Windows domain account. Which technique allows them to execute commands on a remote Windows host using those credentials without a pre-existing shell?
- PsExec lateral movement via SMB (Correct answer)
- ARP spoofing
- LLMNR poisoning
- Kerberoasting
Correct answer: PsExec lateral movement via SMB
PsExec-style lateral movement uses valid credentials to authenticate over SMB, upload a service binary, and execute commands on the remote host.
Question 7: When enumerating a newly reached internal subnet through a pivot, which Metasploit scanner quickly identifies live hosts?
- auxiliary/scanner/discovery/udp_sweep (Correct answer)
- auxiliary/scanner/smb/smb_ms17_010
- post/multi/manage/shell_to_meterpreter
- exploit/multi/handler
Correct answer: auxiliary/scanner/discovery/udp_sweep
The udp_sweep scanner sends UDP packets to identify live hosts on a subnet, useful for quick discovery when routed through a pivot.
eJPT Pivoting and Lateral Movement 4
What technique does 'Pass-the-Hash' exploit to authenticate to Windows services without knowing the plaintext password?