eJPT Post-Exploitation Techniques 3 — Questions and Answers
Question 1: Which Metasploit module type is used for post-exploitation tasks after a session is established?
- Auxiliary
- Exploit
- Post (Correct answer)
- Payload
Correct answer: Post
Post modules in Metasploit are designed to run against existing sessions to gather information, escalate privileges, or maintain persistence.
Question 2: What is credential harvesting in post-exploitation?
- Scanning for open ports on the target
- Collecting usernames, passwords, and hashes from a compromised system (Correct answer)
- Creating new user accounts on the target
- Exfiltrating files from the target's desktop
Correct answer: Collecting usernames, passwords, and hashes from a compromised system
Credential harvesting involves extracting stored credentials—such as passwords, hashes, and tokens—from memory, files, or the registry of a compromised system.
Question 3: Which Windows registry hive stores user account password hashes locally?
- HKEY_LOCAL_MACHINE\SOFTWARE
- HKEY_LOCAL_MACHINE\SAM (Correct answer)
- HKEY_CURRENT_USER\Credentials
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
Correct answer: HKEY_LOCAL_MACHINE\SAM
The SAM (Security Account Manager) hive under HKEY_LOCAL_MACHINE stores NTLM hashes for local Windows user accounts.
Question 4: What is lateral movement in the context of post-exploitation?
- Escalating privileges on the initially compromised host
- Moving from one compromised system to other systems in the same network (Correct answer)
- Deleting logs to remove evidence of compromise
- Installing a rootkit to maintain access
Correct answer: Moving from one compromised system to other systems in the same network
Lateral movement refers to techniques attackers use to progressively move through a network, compromising additional systems using harvested credentials or exploits.
Question 5: Which Meterpreter command allows you to search for files on the target system?
- ls
- search (Correct answer)
- find
- dir
Correct answer: search
The `search` command in Meterpreter lets you search for files by name or pattern across the target filesystem, useful for finding sensitive data.
Question 6: What is the main advantage of using a bind shell over a reverse shell in some scenarios?
- It bypasses firewall rules that block outbound connections
- It works when the attacker cannot receive inbound connections from the target (Correct answer)
- It is always more stable than a reverse shell
- It does not require any listener on the target
Correct answer: It works when the attacker cannot receive inbound connections from the target
A bind shell opens a port on the target that the attacker connects to, which is useful when the attacker's IP is behind NAT or a firewall blocking inbound connections.
Question 7: Which technique is used to maintain persistence on a Windows system by adding entries to the registry Run keys?
- DLL hijacking
- Registry persistence (Correct answer)
- Token impersonation
- ARP spoofing
Correct answer: Registry persistence
Adding malicious executables to HKCU or HKLM Run keys causes them to execute automatically each time the system starts or a user logs in.
eJPT Post-Exploitation Techniques 3
Which Metasploit module type is used for post-exploitation tasks after a session is established?