14.2 test review

Question 1

win xp exploit

uses port 135

Answer 1

Meterpreter command:
expoit/windows/dcerpc/ms03_026_dcom
allows exec of staged payload on xp with system payload

Question 2

win 2k3 exploit

uses port 445

Answer 2

Meterpreter command:
exploit/windows/smb/ms08_067_netapi
does not create logs, creates a buffer overflow

Question 3

win 2k8 exploit

uses port 445

Answer 3

Meterpreter command:

exploit/windows/smb/ms09_050_smb2_negotiate_func_index

Question 4

meterpreter piv esc commands

5 of them

Answer 4

getsystem: Elevate privileges to system
getprivs: get privs from current process owner
steal_token: impersonates priv of running proces
drop_token: releases impersonated priviliges
migrate: Injects meterpreter session into another proc

Question 5

windows scheduled jobs commands

2 of them

Answer 5

at: lists commands and jobs scheduled

schtasks :lists jobs scheduled

Question 6

windows network services commands

5 of them

Answer 6

netstat -ano: displays all connections, ports, and pid
net use: displays remote shares & connection
net start: lists services
arp -a: prints arp table
route: manipulates routing table

Question 7

windows system and hardware info commands

4 of them

Answer 7

systeminfo: displays config and processor info
driverquery: lists device drivers and properties
ver: displays windows version
set: displays windows environment variables

Question 8

windows user and group command

2 of them

Answer 8

net user: displays local user accounts

net localgroup: displays local groups

Question 9

windows software registry keys

4 of them

Answer 9

reg query hklm\software
reg query hklm\software\microsoft\windows nt\currentversion\winlogon
reg query hklm\software\microsoft\windows\currentversion\run
reg query hklm\software\microsoft\windows\currentversion\runonce

Question 10

windows powershell commands

4 of them

Answer 10

get-process: lists running processes
get-WmiObject -class win32_useraccount
get-WmiObject -class win32_group
get-ChildItem HKLM:\software

Question 11

host based security products

3 of them

Answer 11

McAfee
Symantec
Kaspersky

Question 12

Processes associated with McAfee

5 of them

Answer 12

McScript.exe
UpdaterUI.exe/UdateUI.exe
FrameworkService.exe
CmdAgent.exe
McShield.exe

Question 13

McAfee directory structure

Answer 13

c:\program files\McAfee

Question 14

McAfee listening ports

Answer 14

Port 6646 (McAfee Network Agent)
Port 8081 (open if sending logs to ePO server)

Question 15

Symantec processes

6 of them

Answer 15

Semsvc.exe 
ccSvcHst.exe
ccApp.exe
SMC.exe
SMCgui.exe
Rtvscan.exe

Question 16

Kaspersky processes

just one

Answer 16

avp.exe

Question 17

Symantec directory structure

Answer 17

c:\program files\Symantec

Question 18

Symantec registry key

Answer 18

HKLM\SOFTWARE\Symantec

Question 19

Kaspersky registry key

Answer 19

HKLM\SOFTWARE\Kasperskylab

Question 20

Kaspersky directory structure

Answer 20

C:\program files\kaspersky lab

Question 21

Kaspersky ports

Answer 21

port 1110

Question 22

windows logging policy commands

just one

Answer 22

auditpol

Question 23

meterpreter log cleaning command

2 of them

Answer 23

run event_manager

clearev

Question 24

meterpreter timestamp manipulation

just one

Answer 24

syntax: timestomp file_to_modify -f file_to_match

Question 25

manual execution in meterpreter | 2 of them

Answer 25

execute -c -f | channel -r

Question 26

meterpreter collection commands | 3 of them

Answer 26

search -d 'path_to_search' -f *search_term* cat (path_to_file) download (path_to_file)

Question 27

cisco ios router exploit

Answer 27

http://(target_ip)/level/16/exec/sh conf | show conf file for cisco routers using ios 11.3 through 12.2

Question 28

cisco router recon | 4 commands

Answer 28

sh users sh ver sh process cpu sh arp

Question 29

Remote logging tools | 2 of them

Answer 29

Splunk | ELSA

Question 30

Net View Error codes | 2 of them

Answer 30

System Error 5, Access is Denied | System Error 53, Network Path Not Found

Question 31

nbtstat function and options | 3 options

Answer 31

nbtstat: Displays Hostname, MAC, Domain, and user info for remote hosts Options: -a Lists remote host's hostname -A lists remote host's IP Address -n Lists local NetBIOS names

Question 32

nbtstat entry types | 5 of them

Answer 32

``` Hostname: 00, 03, 20 UNIQUE Domain\Workbook: 00 GROUP Username: 03 UNIQUE Server Service: 20 UNIQUE Domain Controllers: 1c GROUP ```

Question 33

arp cache poisoning tool

Answer 33

Brian aka Brian.c

Question 34

Brian 2 modes of operation

Answer 34

List | Preach

Question 35

Three phases of Brian Preach mode

Answer 35

Identify Congregation Start Preaching Relay Packets

Question 36

Cisco SNMP strings | 2 of them

Answer 36

public - default string, read only | private - default string, read/write priv

Question 37

What is SNMPWalk and how does it work

Answer 37

SNMPWalk sends GETNEXT requests to get a tree of information. this is displayed through Abstract Syntax Notation numbers to describe a Management Information Base.

Question 38

Which digit in an ASN is important/displays the group?

Answer 38

The 7th digit, .iso counts as the first digit

Question 39

What is ASN 1?

Answer 39

System

Question 40

what is ASN 2?

Answer 40

Interfaces

Question 41

What is ASN 3?

Answer 41

AT (Address Translation)

Question 42

What is ASN 4?

Answer 42

IP (IP Packet Statistics)

Question 43

What is ASN 5?

Answer 43

ICMP (ICMP Messages recieved)

Question 44

What is ASN 6?

Answer 44

TCP

Question 45

What is ASN 7?

Answer 45

UDP

Question 46

What is ASN 8?

Answer 46

EGP (Exterior Gateway Protocol)

Question 47

What is ASN 10?

Answer 47

Transmission (reserves for media specific MIB's)

Question 48

What is ASN 11?

Answer 48

SNMP

Question 49

What port does SNMP/SNMPWalk use?

Answer 49

port 161

Question 50

What versions of cisco IOS are vulnerable to hhtp exploit?

Answer 50

IOS 11.3-12.2

Question 51

Router Recon Commands | 5 of them

Answer 51

``` sh users sh ver sh conf sh arp sh process cpu ```

Question 52

Intrusion Detection System (IDS) Evasion Attacks | 5 of them

Answer 52

``` Fragmentation Established Pattern Change Out-of-Order Sequencing Obfuscation ```

Question 53

Intrusion Detection System (IDS) Insertion Attacks | 4 OF THEM

Answer 53

Bad Tcp Checksum Desynchronizing TCP sessions False Positive Invalid RST

Question 54

Basic SQL command | 5 of them

Answer 54

``` SELECT INSERT UPDATE DELETE UNION ```

Question 55

What OS goes with Each SQL Database type? MySQL MSSQL Oracle Net Listener

Answer 55

1,) Linux 2,)Windows 3,)UNIX

Question 56

2 SQL injection methods

Answer 56

In-Band | Blind

Question 57

In-Band SQL Injection Modes | 2 of them

Answer 57

Union | Error-Based

Question 58

Blind SQL injection Mode | 1 of them

Answer 58

Boolean-Based

Question 59

What is an iFrame?

Answer 59

HTML tag enbedded in other html docs

Question 60

What is Cross site scripting (XSS)

Answer 60

Malicious code embedded into a web application

Question 61

What are the 2 kinds of Cross Site Scripting (XSS)?

Answer 61

Reflected XSS | Stored XSS