eJPT Post-Exploitation Techniques 4 — Questions and Answers
Question 1: What does token impersonation allow an attacker to do in a Windows post-exploitation context?
- Capture network traffic
- Assume the identity and privileges of another logged-in user (Correct answer)
- Dump the NTDS.dit file
- Escalate via a kernel exploit
Correct answer: Assume the identity and privileges of another logged-in user
Token impersonation lets an attacker steal an access token from a higher-privileged process and use it to act as that user, gaining their permissions.
Question 2: Which Meterpreter command is used to migrate to another running process?
- inject
- migrate (Correct answer)
- pivot
- spawn
Correct answer: migrate
The `migrate` command moves the Meterpreter session into another running process, which can provide stability or elevated privileges if the target process runs as SYSTEM.
Question 3: What is the NTDS.dit file and why is it targeted in post-exploitation?
- A Windows firewall configuration file
- The Active Directory database containing all domain user hashes (Correct answer)
- A file storing browser saved passwords
- The Windows event log database
Correct answer: The Active Directory database containing all domain user hashes
NTDS.dit is the Active Directory database on a Domain Controller that contains password hashes for all domain accounts, making it a high-value target.
Question 4: Which command in a Windows shell would an attacker use to add a new local administrator account for persistence?
- net user /add hacker Pass123! && net localgroup administrators hacker /add (Correct answer)
- whoami /priv
- reg add HKLM\Run /v backdoor
- tasklist /svc
Correct answer: net user /add hacker Pass123! && net localgroup administrators hacker /add
The `net user /add` command creates a new account, and `net localgroup administrators /add` grants it local administrator privileges for persistent access.
Question 5: What is the purpose of clearing Windows event logs during post-exploitation?
- To speed up the compromised system
- To remove evidence of attacker activity and avoid detection (Correct answer)
- To free up disk space on the target
- To disable Windows Defender
Correct answer: To remove evidence of attacker activity and avoid detection
Clearing event logs removes records of attacker activity such as failed logins, process creation, and privilege escalation, helping evade forensic investigation.
Question 6: Which Metasploit post module can be used to gather comprehensive system information on a Windows target?
- post/multi/manage/shell_to_meterpreter
- post/windows/gather/enum_system (Correct answer)
- post/windows/escalate/getsystem
- post/multi/recon/local_exploit_suggester
Correct answer: post/windows/gather/enum_system
The `post/windows/gather/enum_system` module collects detailed information about the Windows target including OS version, installed patches, and running services.
Question 7: What is a scheduled task in Windows and how can it be abused for persistence?
- A process that runs in real-time, abused by injecting DLLs
- An automated job that can be configured to run malicious executables at set times or events (Correct answer)
- A Windows feature that caches credentials, abused via memory scraping
- A firewall rule, abused by adding exceptions for reverse shells
Correct answer: An automated job that can be configured to run malicious executables at set times or events
Windows scheduled tasks (via `schtasks`) can be created or modified by attackers to execute malware at boot, login, or regular intervals for persistence.
eJPT Post-Exploitation Techniques 4
What does token impersonation allow an attacker to do in a Windows post-exploitation context?