eJPT System Exploitation & Attack Techniques 4 — Questions and Answers
Question 1: What is the primary risk of running exploits against production systems during a penetration test?
- It may alert the blue team
- It can cause system crashes or data corruption (Correct answer)
- It generates too many log entries
- It may exhaust the attacker's payload options
Correct answer: It can cause system crashes or data corruption
Exploits, especially those targeting memory corruption vulnerabilities, can crash services or corrupt data, causing unintended denial of service on production systems.
Question 2: Which type of shell binding method has the target machine connect outward to the attacker (useful for bypassing inbound firewall rules)?
- Bind shell
- Reverse shell (Correct answer)
- Web shell
- Named pipe shell
Correct answer: Reverse shell
A reverse shell has the victim initiate an outbound connection to the attacker's listener, bypassing inbound firewall rules that block incoming connections.
Question 3: What does the Metasploit option `PAYLOAD` set?
- The exploit module to use
- The code to execute on the target after successful exploitation (Correct answer)
- The target's operating system
- The encoding scheme for evasion
Correct answer: The code to execute on the target after successful exploitation
The PAYLOAD option specifies what code will be executed on the target system after the exploit successfully gains code execution.
Question 4: In the context of eJPT, which command-line tool is commonly used for transferring files to/from a Windows target when a Meterpreter session is unavailable?
- wget
- certutil (Correct answer)
- curl
- scp
Correct answer: certutil
Certutil.exe is a native Windows tool often abused to download files from the internet, making it useful for file transfer when no other agent is present.
Question 5: What is 'living off the land' in the context of post-exploitation?
- Exploiting agricultural sector targets
- Using built-in OS tools and features to avoid dropping new malware (Correct answer)
- Staying persistent on a target for a long period
- Exploiting local network services only
Correct answer: Using built-in OS tools and features to avoid dropping new malware
Living off the land means using legitimate, pre-installed OS utilities (like PowerShell, certutil, wmic) for malicious purposes to blend in and avoid detection.
Question 6: Which Meterpreter command allows an attacker to record keystrokes on a compromised Windows system?
- keylogger start
- keyscan_start (Correct answer)
- input_capture
- record_keys
Correct answer: keyscan_start
The `keyscan_start` command begins Meterpreter's keylogger, which captures keystrokes that can later be retrieved with `keyscan_dump`.
Question 7: When using msfvenom, what flag specifies the output format of the generated payload?
- -p
- -f (Correct answer)
- -o
- -e
Correct answer: -f
The `-f` flag in msfvenom specifies the output format (e.g., exe, elf, raw, python, powershell) for the generated payload.
eJPT System Exploitation & Attack Techniques 4
What is the primary risk of running exploits against production systems during a penetration test?