eJPT Post-Exploitation Techniques 5

Question 1

Which tool can be used to perform port forwarding through a Meterpreter session to reach internal services?

Accepted Answer

portfwd

Answer

The `portfwd` command in Meterpreter creates local TCP port forwarding rules, allowing the attacker to connect to internal services via the compromised host.

Question 2

What is the difference between `autoroute` and `portfwd` in Metasploit pivoting?

Accepted Answer

autoroute adds routes for Metasploit traffic to internal subnets; portfwd forwards specific local ports to target ports

Answer

Autoroute injects routing rules into Metasploit so all modules can reach internal subnets, while portfwd maps a single local port to a specific host/port on the internal network.

Question 3

Which Meterpreter command starts a keylogger on the compromised system?

Accepted Answer

keyscan_start

Answer

`keyscan_start` begins capturing keystrokes on the target, which can be retrieved later with `keyscan_dump` to harvest credentials or sensitive input.

Question 4

What is data exfiltration in post-exploitation?

Accepted Answer

Transferring stolen data from the compromised system to an attacker-controlled location

Answer

Data exfiltration is the unauthorized transfer of sensitive files or information from a victim's system to infrastructure controlled by the attacker.

Question 5

Which Windows built-in tool can attackers use to exfiltrate files using HTTP/S without installing additional software?

Accepted Answer

certutil

Answer

Certutil can encode/decode files and download content over HTTP/S using its `-urlcache -split -f` flags, making it a living-off-the-land exfiltration tool.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Post-Exploitation Techniques 5