PenTest+ Attacks & Exploits 5 — Questions and Answers
Question 1: A penetration tester abuses GenericWrite permissions on an Active Directory user account to set a Service Principal Name (SPN) and then request a TGS ticket. What attack is this?
- AS-REP roasting
- Kerberoasting via targeted SPN setting (Correct answer)
- Silver ticket attack
- Golden ticket attack
Correct answer: Kerberoasting via targeted SPN setting
Targeted Kerberoasting involves using GenericWrite or similar permissions to set an SPN on a target account, then requesting and cracking the resulting TGS ticket.
Question 2: An attacker sends crafted ICMP packets with a source IP of the victim's address to a large number of hosts that reply to the victim. What DoS technique is this?
- SYN flood
- Smurf attack (Correct answer)
- Ping of death
- Teardrop attack
Correct answer: Smurf attack
A Smurf attack sends ICMP echo requests with a spoofed source IP to broadcast addresses, causing all hosts to reply to the victim and overwhelming it.
Question 3: A tester uploads a file named 'shell.php%00.jpg' to bypass a file extension whitelist. What technique is being used?
- MIME type spoofing
- Null byte injection (Correct answer)
- Double extension bypass
- Content-Type manipulation
Correct answer: Null byte injection
Null byte injection (%00) terminates string processing in older PHP versions or C-based functions, causing the server to treat the filename as 'shell.php' and ignore '.jpg'.
Question 4: During a cloud pentest on AWS, a tester queries 169.254.169.254 from a compromised EC2 instance. What is the tester attempting to retrieve?
- The VPC routing table
- IAM instance profile credentials (Correct answer)
- The EC2 security group rules
- S3 bucket ACLs
Correct answer: IAM instance profile credentials
The AWS Instance Metadata Service (IMDS) at 169.254.169.254 exposes IAM role credentials attached to the EC2 instance, which can be used for privilege escalation.
Question 5: A tester exploits a web application by injecting template syntax like {{7*7}} into a user-supplied input field and receives '49' in the response. What vulnerability was discovered?
- XSS
- Server-Side Template Injection (SSTI) (Correct answer)
- Code injection
- LDAP injection
Correct answer: Server-Side Template Injection (SSTI)
Server-Side Template Injection (SSTI) occurs when user input is embedded in a server-side template, allowing code execution within the template engine's context.
Question 6: A red team operator uses a signed binary (living off the land) to download and execute a payload, evading application whitelisting. Which category of technique does this represent?
- Process injection
- LOLBin (Living Off the Land Binary) abuse (Correct answer)
- DLL sideloading
- Reflective DLL injection
Correct answer: LOLBin (Living Off the Land Binary) abuse
LOLBin abuse leverages trusted, pre-installed system binaries like certutil, mshta, or regsvr32 to execute malicious code while evading whitelisting controls.
Question 7: A tester discovers that a web application constructs an OS command using unsanitized user input and executes it via shell_exec(). The tester appends '; cat /etc/passwd' to the input. What is this attack?
- Code injection
- OS command injection (Correct answer)
- Shell escape
- Argument injection
Correct answer: OS command injection
OS command injection occurs when unsanitized user input is passed to a shell command, allowing attackers to append additional commands using shell metacharacters.
PenTest+ Attacks & Exploits 5
A penetration tester abuses GenericWrite permissions on an Active Directory user account to set a Service Principal Name (SPN) and then request a TGS ticket.
What attack is this?