eJPT System Exploitation & Attack Techniques 5 — Questions and Answers
Question 1: Which vulnerability class does SQL injection primarily exploit?
- Improper memory management
- Insufficient input validation allowing manipulation of database queries (Correct answer)
- Weak cryptographic implementations
- Misconfigured file permissions
Correct answer: Insufficient input validation allowing manipulation of database queries
SQL injection occurs when user-supplied input is not properly sanitized and gets interpreted as SQL code, allowing attackers to manipulate database queries.
Question 2: In Metasploit, what is the `check` command used for before running an exploit?
- To verify the attacker's machine is configured correctly
- To test if the target appears vulnerable without exploiting it (Correct answer)
- To check available payloads for the module
- To validate the RHOSTS IP format
Correct answer: To test if the target appears vulnerable without exploiting it
The `check` command probes the target to determine if it appears vulnerable to the exploit without actually attempting exploitation.
Question 3: What is the purpose of encoding a payload with msfvenom's `-e` option?
- To compress the payload for faster delivery
- To obfuscate the payload and potentially evade signature-based detection (Correct answer)
- To encrypt the payload with a strong cipher
- To convert the payload to a different CPU architecture
Correct answer: To obfuscate the payload and potentially evade signature-based detection
Encoding transforms the payload bytes to evade simple signature-based antivirus detection, though modern AV can often detect common encoders.
Question 4: Which post-exploitation Meterpreter command takes a screenshot of the victim's current desktop?
- capture_screen
- screenshot (Correct answer)
- desktop_grab
- screen_capture
Correct answer: screenshot
The `screenshot` command in Meterpreter captures the current desktop display of the compromised system and saves it locally.
Question 5: When exploiting a Linux system with a buffer overflow, which register typically needs to be controlled to redirect execution?
- EBP
- ESP
- EIP (or RIP on 64-bit) (Correct answer)
- EAX
Correct answer: EIP (or RIP on 64-bit)
Controlling EIP (Instruction Pointer, or RIP on 64-bit systems) allows the attacker to redirect program execution to arbitrary code such as shellcode.
Question 6: What is 'token impersonation' in Windows post-exploitation?
- Forging Kerberos tickets to access services
- Using another user's access token to perform actions with their privileges (Correct answer)
- Bypassing UAC by cloning an admin process
- Stealing saved browser credentials
Correct answer: Using another user's access token to perform actions with their privileges
Token impersonation uses the Windows access token of another logged-in user to execute commands with that user's privileges, enabling lateral movement or privilege escalation.
Question 7: Which Metasploit module category contains tools specifically designed for maintaining access after initial exploitation?
- exploit/
- auxiliary/
- post/ (Correct answer)
- payload/
Correct answer: post/
The `post/` module category in Metasploit contains post-exploitation modules for tasks like persistence, credential gathering, lateral movement, and privilege escalation.
eJPT System Exploitation & Attack Techniques 5
Which vulnerability class does SQL injection primarily exploit?