Host and Network Auditing Flashcards
6 cards from real EJPT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Host and Network Auditing flashcards as text
After gaining initial access to a Windows host, a penetration tester wants to audit the system for missing security patches that could be leveraged for privilege escalation. Which of the following native Windows commands is most suitable for quickly listing the installed hotfixes?
Answer: wmic qfe list
The `wmic qfe list` command is the most direct and suitable method for this task. It uses the Windows Management Instrumentation Command-line (WMIC) to query the Quick Fix Engineering (QFE) database, providing a clear list of all installed patches and hotfixes. `systeminfo` provides general system information but the patch data is less structured. `netstat` lists network connections, and `tasklist` shows running processes.
During a network audit, a junior penetration tester captures network traffic using Wireshark. They apply the display filter `http.request.method == "POST"`. What is the primary purpose of using this specific filter?
Answer: To identify potential login attempts or data submissions over HTTP.
The `http.request.method == "POST"` filter in Wireshark specifically isolates HTTP requests that use the POST method. This method is commonly used to send data from a client to a server, such as submitting login credentials, filling out forms, or uploading files. Analyzing this traffic is crucial for finding sensitive information being transmitted in cleartext.
A penetration tester is auditing a Linux server and wants to review which commands a specific user, 'jdoe', has executed. Assuming the user's command history is being saved, which file should the tester examine?
Answer: ~jdoe/.bash_history
The `.bash_history` file, located in a user's home directory (represented by `~`), stores a log of the commands entered into the Bash shell. By examining `~jdoe/.bash_history`, a tester can see the command history for the user 'jdoe'. `/etc/passwd` contains user account information, `/var/log/auth.log` tracks authentication events, and `/root/.profile` is a configuration file for the root user's shell.
While auditing a network, you identify a device responding on UDP port 161. You suspect it might be running the Simple Network Management Protocol (SNMP) with a default community string. Which of the following actions would be the most effective next step to confirm this and enumerate information?
Answer: Use a tool like `snmp-check` or `onesixtyone` with a list of common community strings.
Tools like `snmp-check` and `onesixtyone` are specifically designed to query SNMP services. They can be used with a wordlist of common community strings (like 'public' and 'private') to test for access and, if successful, automatically dump a large amount of system and network information. This is far more effective than just confirming the port is open.
A penetration tester is performing an internal network audit and needs to check for null sessions on a Windows host at 192.168.1.50. A null session vulnerability could allow an unauthenticated user to enumerate information. Which of the following commands would be used to attempt to establish a null session?
Answer: rpcclient -U "" -N 192.168.1.50
The `rpcclient` tool is designed to execute client-side MS-RPC functions. The command `rpcclient -U "" -N 192.168.1.50` attempts to connect to the target's RPC service using an anonymous username (`-U ""`) and no password (`-N`), which is the definition of a null session. `smbclient` is for SMB shares, `net view` lists shares but doesn't explicitly test the null session in this manner, and the Nmap command specified is for UDP scanning.
During a host audit of a Linux machine, you need to find all files that have the Set User ID (SUID) permission bit set, as these could be potential vectors for privilege escalation. Which of the following commands would accomplish this?
Answer: find / -perm -u=s -type f 2>/dev/null
The command `find / -perm -u=s -type f 2>/dev/null` is the standard and most accurate way to locate SUID files. `find /` starts the search from the root directory. `-perm -u=s` specifies the permission to look for (SUID bit for the user). `-type f` limits the search to files only. `2>/dev/null` redirects any permission-denied errors to null, cleaning up the output.