eJPT Post-Exploitation Techniques 2

Question 1

Which Meterpreter command is used to dump password hashes from a compromised Windows system?

Accepted Answer

hashdump

Answer

The `hashdump` command in Meterpreter extracts NTLM password hashes from the SAM database on Windows systems.

Question 2

What is the primary purpose of pivoting in a post-exploitation scenario?

Accepted Answer

Using a compromised host to attack other internal network segments

Answer

Pivoting uses a compromised machine as a relay to reach and attack otherwise inaccessible internal network segments.

Question 3

Which tool is commonly used to perform Pass-the-Hash attacks on Windows networks?

Accepted Answer

Mimikatz

Answer

Mimikatz can perform Pass-the-Hash by injecting NTLM hashes directly into authentication sessions without needing the plaintext password.

Question 4

What does the Meterpreter command `run post/multi/recon/local_exploit_suggester` do?

Accepted Answer

Suggests local privilege escalation exploits based on system info

Answer

The local_exploit_suggester module analyzes the target's OS version and patch level to suggest applicable local privilege escalation exploits.

Question 5

Which technique involves injecting malicious code into a legitimate running process to hide from defenders?

Accepted Answer

Process hollowing

Answer

Process hollowing replaces the memory of a legitimate process with malicious code, making detection harder since the process appears normal.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test