eJPT Pivoting and Lateral Movement 5 — Questions and Answers
Question 1: A pentester has a shell on a Windows pivot host and wants to enumerate all network interfaces to identify additional subnets. Which command shows this information?
- ipconfig /all (Correct answer)
- netstat -an
- arp -a
- route print
Correct answer: ipconfig /all
ipconfig /all displays all network adapter configurations including IP addresses, subnets, and gateways, revealing additional network segments.
Question 2: In a pivoting scenario, a pentester has routed through a compromised host to reach 172.16.0.0/24. Running nmap via proxychains returns only TCP results and misses ICMP-based host discovery. Why?
- SOCKS proxies only support TCP, not ICMP (Correct answer)
- Nmap's ICMP probes are blocked by the firewall
- Proxychains does not support nmap
- ICMP is disabled in the internal subnet
Correct answer: SOCKS proxies only support TCP, not ICMP
SOCKS proxies are TCP-only protocols and cannot tunnel ICMP packets, so nmap host discovery using ping (-PE) will not work through proxychains.
Question 3: After pivoting into a network via Metasploit routes, which nmap flag should be used to disable ICMP ping discovery so host scanning works through the SOCKS proxy?
- -Pn (Correct answer)
- -sP
- -PE
- -sn
Correct answer: -Pn
The -Pn flag tells nmap to skip host discovery (no ping) and treat all hosts as up, which is necessary when scanning through a SOCKS proxy that can't forward ICMP.
Question 4: A pentester uses SSH local port forwarding: 'ssh -L 8080:192.168.1.10:80 user@pivot'. After this, how does the pentester access the internal web service at 192.168.1.10?
- Browse to http://127.0.0.1:8080 on the attacker machine (Correct answer)
- Browse to http://192.168.1.10:80 directly
- Browse to http://pivot:8080
- Browse to http://192.168.1.10:8080
Correct answer: Browse to http://127.0.0.1:8080 on the attacker machine
Local port forwarding binds the specified port on the local (attacker) machine, so connections to 127.0.0.1:8080 are forwarded through the SSH tunnel to the target.
Question 5: Which Windows command can a pentester run on a pivot host to discover other machines with open SMB shares in the local subnet (Windows built-in)?
- net view (Correct answer)
- ipconfig /all
- arp -a
- tasklist /v
Correct answer: net view
The `net view` command enumerates computers and shared resources visible on the Windows network, helping identify lateral movement targets.
Question 6: During an eJPT lab, a pentester needs to upgrade a basic netcat shell on a pivot host to a Meterpreter session for better pivoting capabilities. Which Metasploit post module accomplishes this?
- post/multi/manage/shell_to_meterpreter (Correct answer)
- post/windows/manage/migrate
- exploit/multi/handler
- auxiliary/server/socks_proxy
Correct answer: post/multi/manage/shell_to_meterpreter
The shell_to_meterpreter post module injects a Meterpreter payload into an existing basic shell session, upgrading it to a full Meterpreter session.
Question 7: What is the primary security risk that makes pivoting possible in a segmented network during a penetration test?
- A compromised dual-homed host that bridges network segments (Correct answer)
- Weak firewall rules on the internet gateway
- Unpatched vulnerabilities on the external DMZ server
- Misconfigured DNS servers leaking internal hostnames
Correct answer: A compromised dual-homed host that bridges network segments
Pivoting exploits a compromised host that has connectivity to multiple network segments, using it as a relay to reach otherwise isolated internal resources.
eJPT Pivoting and Lateral Movement 5
A pentester has a shell on a Windows pivot host and wants to enumerate all network interfaces to identify additional subnets.
Which command shows this information?