PenTest+ Post-Exploitation & Pivoting Flashcards

Which tool is commonly used for maintaining persistent access and post-exploitation activities after initial compromise?

Answer: Metasploit Meterpreter

Metasploit Meterpreter provides a powerful in-memory post-exploitation shell with built-in features for persistence, pivoting, and lateral movement.

Which command finds SUID binaries on Linux that can be abused for privilege escalation?

Answer: find / -perm -4000 2>/dev/null

The find command with -perm -4000 locates SUID binaries that run with elevated privileges and are commonly abused to escalate to root.

What does token impersonation allow an attacker to do in a Windows post-exploitation scenario?

Answer: Assume the identity and privileges of another logged-in user

Token impersonation steals authentication tokens from other logged-in users to assume their privileges without needing their plaintext password.

Which tool is widely used to extract plaintext passwords and NTLM hashes from Windows LSASS memory?

Answer: Mimikatz

Mimikatz is the standard tool for dumping plaintext credentials, NTLM hashes, and Kerberos tickets directly from Windows LSASS process memory.

What does 'living off the land' (LotL) mean in a post-exploitation context?

Answer: Using built-in OS tools like PowerShell and WMI to avoid detection

Living off the land uses legitimate, built-in OS utilities (PowerShell, WMI, certutil) for malicious purposes to blend in and evade security tools.

What is the primary goal of post-exploitation activities during a penetration test?

Answer: Maintaining access, escalating privileges, and gathering further intelligence

Post-exploitation focuses on maintaining persistent access, escalating privileges, and gathering additional intelligence to demonstrate the full impact of a breach.