eJPT Pivoting and Lateral Movement 4

Question 1

What technique does 'Pass-the-Hash' exploit to authenticate to Windows services without knowing the plaintext password?

Accepted Answer

Using the captured NTLM hash directly for authentication

Answer

Pass-the-Hash abuses NTLM's challenge-response protocol by supplying the captured hash directly, since NTLM does not require the plaintext password.

Question 2

Which tool is commonly used for Pass-the-Hash attacks to get a shell on a remote Windows machine over SMB?

Accepted Answer

pth-winexe

Answer

pth-winexe is a modified version of winexe that accepts NTLM hashes directly, enabling remote command execution over SMB without a plaintext password.

Question 3

During lateral movement, a pentester discovers a Windows service account password hash. To move laterally using WMI, which Impacket script is most appropriate?

Accepted Answer

wmiexec.py

Answer

Impacket's wmiexec.py executes commands on remote Windows hosts via WMI, a stealthier alternative to psexec that doesn't drop a service binary.

Question 4

What network protocol does PsExec primarily use to move laterally between Windows hosts?

Accepted Answer

SMB (port 445)

Answer

PsExec creates a service on the target by uploading an executable over SMB's admin share (ADMIN$), then starts it remotely.

Question 5

Which Metasploit module can dump password hashes from a compromised Windows host to facilitate lateral movement?

Accepted Answer

post/windows/gather/hashdump

Answer

The hashdump post module extracts NTLM password hashes from a Windows host's SAM database, which can then be used for Pass-the-Hash attacks.

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eJPT Pivoting and Lateral Movement 4