eJPT System Exploitation & Attack Techniques 3

Question 1

Which Meterpreter command is used to pivot through a compromised host to reach otherwise inaccessible network segments?

Accepted Answer

route add

Answer

The `route add` command in Metasploit adds routes through a Meterpreter session, enabling traffic to be sent through the compromised host to internal networks.

Question 2

What is the primary purpose of the EternalBlue exploit (MS17-010)?

Accepted Answer

Exploiting a vulnerability in the SMBv1 protocol

Answer

EternalBlue exploits a critical buffer overflow vulnerability in the Windows SMBv1 protocol to achieve remote code execution.

Question 3

In Metasploit, what is a 'staged' payload?

Accepted Answer

A small initial stager that downloads and executes the full payload

Answer

A staged payload uses a tiny stager (stage 0) that connects back to the attacker and downloads the larger main payload into memory.

Question 4

Which command in a Meterpreter session dumps credential hashes from the Windows SAM database?

Accepted Answer

hashdump

Answer

The `hashdump` command in Meterpreter extracts NTLM password hashes from the Windows Security Account Manager (SAM) database.

Question 5

What technique does process hollowing use?

Accepted Answer

Creating a legitimate process in suspended state and replacing its code with malicious code

Answer

Process hollowing spawns a legitimate process suspended, unmaps its memory, and replaces it with malicious code before resuming execution.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT System Exploitation & Attack Techniques 3