PenTest+ PenTest+ Post-Exploitation & Pivoting 1 — Questions and Answers
Question 1: Which tool is commonly used for maintaining persistent access and post-exploitation activities after initial compromise?
- Nmap
- Metasploit Meterpreter (Correct answer)
- Wireshark
- Nikto
Correct answer: Metasploit Meterpreter
Metasploit Meterpreter provides a powerful in-memory post-exploitation shell with built-in features for persistence, pivoting, and lateral movement.
Question 2: Which command finds SUID binaries on Linux that can be abused for privilege escalation?
- ls -la /bin
- find / -perm -4000 2>/dev/null (Correct answer)
- netstat -tulpn
- ps aux --forest
Correct answer: find / -perm -4000 2>/dev/null
The find command with -perm -4000 locates SUID binaries that run with elevated privileges and are commonly abused to escalate to root.
Question 3: What does token impersonation allow an attacker to do in a Windows post-exploitation scenario?
- Crash the target system
- Assume the identity and privileges of another logged-in user (Correct answer)
- Modify Windows Firewall rules
- Encrypt files for ransom
Correct answer: Assume the identity and privileges of another logged-in user
Token impersonation steals authentication tokens from other logged-in users to assume their privileges without needing their plaintext password.
Question 4: Which tool is widely used to extract plaintext passwords and NTLM hashes from Windows LSASS memory?
- John the Ripper
- Mimikatz (Correct answer)
- Hashcat
- Responder
Correct answer: Mimikatz
Mimikatz is the standard tool for dumping plaintext credentials, NTLM hashes, and Kerberos tickets directly from Windows LSASS process memory.
Question 5: What does 'living off the land' (LotL) mean in a post-exploitation context?
- Deploying custom malware payloads
- Using built-in OS tools like PowerShell and WMI to avoid detection (Correct answer)
- Exfiltrating data via DNS queries
- Using zero-day exploits exclusively
Correct answer: Using built-in OS tools like PowerShell and WMI to avoid detection
Living off the land uses legitimate, built-in OS utilities (PowerShell, WMI, certutil) for malicious purposes to blend in and evade security tools.
Question 6: What is the primary goal of post-exploitation activities during a penetration test?
- Scanning for additional open ports
- Maintaining access, escalating privileges, and gathering further intelligence (Correct answer)
- Running automated vulnerability scans
- Performing password spraying attacks
Correct answer: Maintaining access, escalating privileges, and gathering further intelligence
Post-exploitation focuses on maintaining persistent access, escalating privileges, and gathering additional intelligence to demonstrate the full impact of a breach.
PenTest+ PenTest+ Post-Exploitation & Pivoting 1
Which tool is commonly used for maintaining persistent access and post-exploitation activities after initial compromise?