eJPT Post-Exploitation Techniques 2 — Questions and Answers
Question 1: Which Meterpreter command is used to dump password hashes from a compromised Windows system?
- hashdump (Correct answer)
- getuid
- sysinfo
- getsystem
Correct answer: hashdump
The `hashdump` command in Meterpreter extracts NTLM password hashes from the SAM database on Windows systems.
Question 2: What is the primary purpose of pivoting in a post-exploitation scenario?
- Escalating privileges on the current host
- Using a compromised host to attack other internal network segments (Correct answer)
- Dumping credentials from memory
- Establishing persistence via a backdoor
Correct answer: Using a compromised host to attack other internal network segments
Pivoting uses a compromised machine as a relay to reach and attack otherwise inaccessible internal network segments.
Question 3: Which tool is commonly used to perform Pass-the-Hash attacks on Windows networks?
- Hydra
- Mimikatz (Correct answer)
- Netcat
- Nmap
Correct answer: Mimikatz
Mimikatz can perform Pass-the-Hash by injecting NTLM hashes directly into authentication sessions without needing the plaintext password.
Question 4: What does the Meterpreter command `run post/multi/recon/local_exploit_suggester` do?
- Lists all network interfaces on the target
- Suggests local privilege escalation exploits based on system info (Correct answer)
- Dumps the SAM database
- Installs a keylogger on the target
Correct answer: Suggests local privilege escalation exploits based on system info
The local_exploit_suggester module analyzes the target's OS version and patch level to suggest applicable local privilege escalation exploits.
Question 5: Which technique involves injecting malicious code into a legitimate running process to hide from defenders?
- Process hollowing (Correct answer)
- Port scanning
- Banner grabbing
- ARP poisoning
Correct answer: Process hollowing
Process hollowing replaces the memory of a legitimate process with malicious code, making detection harder since the process appears normal.
Question 6: After gaining a Meterpreter shell, which command would you run first to check your current user context?
- sysinfo
- getuid (Correct answer)
- ps
- hashdump
Correct answer: getuid
`getuid` returns the username and domain of the account running the Meterpreter session, confirming your current privilege level.
Question 7: What is the purpose of running `getsystem` in a Meterpreter session?
- Retrieve basic OS information
- Attempt to escalate privileges to SYSTEM level (Correct answer)
- List running processes
- Open an interactive shell
Correct answer: Attempt to escalate privileges to SYSTEM level
`getsystem` attempts several techniques to elevate the current Meterpreter session to NT AUTHORITY\SYSTEM on Windows.
eJPT Post-Exploitation Techniques 2
Which Meterpreter command is used to dump password hashes from a compromised Windows system?