eJPT Post-Exploitation Techniques 4

Question 1

What does token impersonation allow an attacker to do in a Windows post-exploitation context?

Accepted Answer

Assume the identity and privileges of another logged-in user

Answer

Token impersonation lets an attacker steal an access token from a higher-privileged process and use it to act as that user, gaining their permissions.

Question 2

Which Meterpreter command is used to migrate to another running process?

Accepted Answer

migrate

Answer

The `migrate` command moves the Meterpreter session into another running process, which can provide stability or elevated privileges if the target process runs as SYSTEM.

Question 3

What is the NTDS.dit file and why is it targeted in post-exploitation?

Accepted Answer

The Active Directory database containing all domain user hashes

Answer

NTDS.dit is the Active Directory database on a Domain Controller that contains password hashes for all domain accounts, making it a high-value target.

Question 4

Which command in a Windows shell would an attacker use to add a new local administrator account for persistence?

Accepted Answer

net user /add hacker Pass123! && net localgroup administrators hacker /add

Answer

The `net user /add` command creates a new account, and `net localgroup administrators /add` grants it local administrator privileges for persistent access.

Question 5

What is the purpose of clearing Windows event logs during post-exploitation?

Accepted Answer

To remove evidence of attacker activity and avoid detection

Answer

Clearing event logs removes records of attacker activity such as failed logins, process creation, and privilege escalation, helping evade forensic investigation.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Post-Exploitation Techniques 4