Exploitation with Metasploit Flashcards
6 cards from real EJPT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Exploitation with Metasploit flashcards as text
A penetration tester has identified a vulnerable service on a target at 192.168.10.100. They select an appropriate exploit in Metasploit and need to configure a reverse TCP payload to connect back to their attacking machine at 192.168.10.5. Which Metasploit option must be set to the IP address of the tester's machine?
Answer: LHOST
LHOST (Local Host) is the Metasploit variable used to specify the IP address of the attacking machine. When a reverse payload is used, it tells the compromised target where to connect back to. RHOSTS (Remote Hosts) is used to specify the target's IP address.
Which of the following Metasploit module types is specifically designed to perform actions such as gathering evidence, escalating privileges, or pivoting on a target system *after* an initial exploit has already succeeded and a session has been established?
Answer: post
Post-exploitation (post) modules are used after a system has been successfully compromised. They are not used for the initial exploit but for subsequent actions like data exfiltration, maintaining access, and lateral movement within the network.
A penetration tester is attacking a target that is located behind a restrictive firewall. The firewall blocks all incoming connections but allows outbound connections to the internet on common ports like 80 and 443. Which type of payload would be most effective for establishing a session?
Answer: Reverse
A reverse shell (or payload) makes the compromised target initiate an outbound connection back to the attacker's listening machine. This is highly effective at bypassing firewalls that prevent inbound connections, as most firewalls permit outbound traffic. A bind shell would open a port on the target, which the firewall would block.
After loading an exploit module in `msfconsole` using the `use` command, a junior tester needs to determine which parameters, such as RHOSTS and LHOST, are required and what their current values are. Which command should they run next?
Answer: show options
The `show options` command displays all the configurable parameters for the currently selected module. It clearly lists each option, whether it is required, and its current setting, allowing the tester to configure the exploit correctly before execution.
After gaining a Meterpreter session on a Windows machine, a penetration tester notices the session is running within an unstable process that the user might close. To ensure the session's stability and persistence, they want to move it to a more stable system process, like `explorer.exe`. Which Meterpreter command should be used to accomplish this?
Answer: migrate
The `migrate` command is used within a Meterpreter session to inject the session into a different running process on the target host. This is a crucial post-exploitation step for maintaining access and evading detection by moving out of a potentially short-lived process into a more stable one.
What is a key characteristic of a stageless payload (e.g., `windows/meterpreter_reverse_tcp`) when compared to a staged payload (e.g., `windows/meterpreter/reverse_tcp`) in Metasploit?
Answer: It sends the entire payload in one connection, making it more reliable on unstable networks.
Stageless (or inline) payloads are self-contained and include the full exploit and shellcode in a single unit. This makes them larger but more reliable, as they do not need to establish a second connection to download the main 'stage' from the attacker, which could fail on a latent or unstable network. Staged payloads are smaller initially but rely on this second connection.