PenTest+ Post-Exploitation & Pivoting Flashcards

Which Windows registry location is commonly abused to establish persistence after a system compromise?

Answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Registry Run keys cause programs to execute automatically at user login, making them one of the most common persistence mechanisms abused by attackers.

What is 'Pass-the-Hash' (PtH) and how does it enable lateral movement?

Answer: Using captured NTLM hashes directly for authentication without knowing the plaintext password

Pass-the-Hash exploits the NTLM authentication protocol by using a captured password hash directly to authenticate, enabling lateral movement without cracking the hash.

What is 'Kerberoasting' used for in Active Directory environments?

Answer: Requesting service tickets for SPNs and extracting their hashes for offline cracking

Kerberoasting requests Kerberos service tickets for accounts with Service Principal Names (SPNs) and extracts the encrypted ticket portion for offline password cracking.

Which Sysinternals tool is commonly used for lateral movement by executing commands on remote Windows systems via SMB?

Answer: PsExec

PsExec uses SMB and valid credentials to execute commands or launch interactive shells on remote Windows systems, making it a go-to tool for lateral movement.

What is a 'Golden Ticket' attack in Active Directory and what makes it so powerful?

Answer: Forging a Kerberos TGT using the KRBTGT account hash, granting persistent domain-wide access

A Golden Ticket forges a Kerberos TGT signed with the KRBTGT account's hash, providing nearly unrestricted, long-lasting access to any resource in the domain.

Which technique abuses Windows scheduled tasks to maintain persistence after an initial compromise?

Answer: Using schtasks.exe to register a recurring malicious payload

Attackers use schtasks.exe or the Task Scheduler COM API to create scheduled tasks that execute malicious payloads at defined intervals or on specific system events.