eJPT System Exploitation & Attack Techniques 3 — Questions and Answers
Question 1: Which Meterpreter command is used to pivot through a compromised host to reach otherwise inaccessible network segments?
- route add (Correct answer)
- pivot create
- portfwd add
- arp_sweep
Correct answer: route add
The `route add` command in Metasploit adds routes through a Meterpreter session, enabling traffic to be sent through the compromised host to internal networks.
Question 2: What is the primary purpose of the EternalBlue exploit (MS17-010)?
- Exploiting a flaw in Windows RDP
- Exploiting a vulnerability in the SMBv1 protocol (Correct answer)
- Bypassing Windows Defender
- Exploiting a flaw in Windows IIS
Correct answer: Exploiting a vulnerability in the SMBv1 protocol
EternalBlue exploits a critical buffer overflow vulnerability in the Windows SMBv1 protocol to achieve remote code execution.
Question 3: In Metasploit, what is a 'staged' payload?
- A payload that runs in multiple privilege stages
- A small initial stager that downloads and executes the full payload (Correct answer)
- A payload encoded in multiple stages to evade AV
- A payload that targets multiple operating systems
Correct answer: A small initial stager that downloads and executes the full payload
A staged payload uses a tiny stager (stage 0) that connects back to the attacker and downloads the larger main payload into memory.
Question 4: Which command in a Meterpreter session dumps credential hashes from the Windows SAM database?
- hashdump (Correct answer)
- credump
- getpass
- dump_hashes
Correct answer: hashdump
The `hashdump` command in Meterpreter extracts NTLM password hashes from the Windows Security Account Manager (SAM) database.
Question 5: What technique does process hollowing use?
- Injecting shellcode into a process's heap
- Creating a legitimate process in suspended state and replacing its code with malicious code (Correct answer)
- Hooking system calls to redirect execution
- Overwriting the stack of a running process
Correct answer: Creating a legitimate process in suspended state and replacing its code with malicious code
Process hollowing spawns a legitimate process suspended, unmaps its memory, and replaces it with malicious code before resuming execution.
Question 6: When exploiting a vulnerable service with Metasploit, what does setting `RHOSTS` specify?
- The attacker's listener IP
- The target host(s) to attack (Correct answer)
- The remote port to connect back to
- The routing table for pivoting
Correct answer: The target host(s) to attack
RHOSTS (Remote Hosts) specifies the IP address or range of target systems the exploit module will attempt to attack.
Question 7: Which Metasploit post-exploitation module searches for stored credentials and sensitive files on a Windows target?
- post/windows/gather/credentials/credential_collector (Correct answer)
- post/multi/recon/local_exploit_suggester
- post/windows/manage/migrate
- post/windows/gather/enum_shares
Correct answer: post/windows/gather/credentials/credential_collector
The credential_collector post module searches common locations for stored credentials including browsers, email clients, and credential stores.
eJPT System Exploitation & Attack Techniques 3
Which Meterpreter command is used to pivot through a compromised host to reach otherwise inaccessible network segments?