eJPT System Exploitation & Attack Techniques 2 — Questions and Answers
Question 1: Which Metasploit command upgrades a standard shell session to a Meterpreter session?
- sessions -u <id> (Correct answer)
- use post/multi/manage/upgrade
- shell -m
- meterpreter -s <id>
Correct answer: sessions -u <id>
The `sessions -u <id>` command in Metasploit automatically upgrades a command shell to a Meterpreter session.
Question 2: When exploiting a buffer overflow, what is the purpose of a NOP sled?
- To increase the size of the payload
- To provide a landing zone so execution slides into the shellcode (Correct answer)
- To bypass ASLR by randomizing addresses
- To encode the shellcode to avoid detection
Correct answer: To provide a landing zone so execution slides into the shellcode
A NOP sled is a sequence of NOP instructions that allows imprecise jumps to still reach and execute the shellcode.
Question 3: Which tool is used within Metasploit to generate custom shellcode payloads?
- msfvenom (Correct answer)
- msfconsole
- msfdump
- msfpayload (standalone)
Correct answer: msfvenom
msfvenom combines payload generation and encoding, replacing the older msfpayload and msfencode tools.
Question 4: In a pass-the-hash attack, what credential material is used to authenticate without knowing the plaintext password?
- Kerberos ticket
- NTLM hash (Correct answer)
- MD5 digest
- SSL certificate
Correct answer: NTLM hash
Pass-the-hash exploits Windows NTLM authentication by using the captured NTLM hash directly, bypassing the need for the plaintext password.
Question 5: What does the Metasploit `getsystem` command attempt to do?
- Retrieve system information
- Escalate privileges to SYSTEM level (Correct answer)
- Get a list of running system processes
- Download the SAM database
Correct answer: Escalate privileges to SYSTEM level
The `getsystem` command in Meterpreter attempts multiple privilege escalation techniques to obtain SYSTEM-level access.
Question 6: Which attack technique involves injecting malicious DLLs into a running process to execute code in its context?
- Process hollowing
- DLL injection (Correct answer)
- Heap spraying
- Return-oriented programming
Correct answer: DLL injection
DLL injection forces a running process to load a malicious DLL, allowing code execution within that process's security context.
Question 7: When using Metasploit's `exploit/multi/handler`, what must match between the handler and the payload delivered to the target?
- The LPORT and LHOST only
- The payload type and connection parameters (Correct answer)
- Only the LPORT value
- The target OS version
Correct answer: The payload type and connection parameters
The handler's payload type and all connection parameters (LHOST, LPORT, payload name) must exactly match what was delivered to the target.
eJPT System Exploitation & Attack Techniques 2
Which Metasploit command upgrades a standard shell session to a Meterpreter session?