Chap 6 - Exploiting and Pivoting Flashcards
Alice discovers a rating that her vulnerability scanner lists as 9.3 out of 10 on its severity scale. The service that is identified runs on TCP 445. What type of exploit is Alice most likely to use on this service?
A. SQL injection
B. SMB exploit
C. CGI exploit
D. MIB exploit
SMB exploit
TCP 445 is a service port typically associated with SMB services.
Charles has recently completed a vulnerability scan of a system and needs to select the best vulnerability to exploit from the following listing:
- Ruby on Rails Action Pack Remote Code Execution Vulnerability (Windows), 7.5 (high), 80 percent, 10.0.2.7, 3000/tcp
- Open SSH Denial of Service And User Enumeration Vulnerabilities (Windows) , 7.8 (High), 80 percent, 10.0.2.7, 22/tcp
- MySQL/MariaDB weak password, 9.0 (High), 95 percent, 10.0.2.7, 3306/ tcp
A. The Ruby on Rails vulnerability
B. The OpenSSH vulnerability
C. The MySQL vulnerability
D. None of these; he should find another target
The Ruby on Rails vulnerability
The Ruby on Rails vulnerability is the only vulnerability that specifically mentions remote code execution, which is most likely to allow Charles to gain access to the system.
Charles has recently completed a vulnerability scan of a system and needs to select the best vulnerability to exploit from the following listing:
- Ruby on Rails Action Pack Remote Code Execution Vulnerability (Windows), 7.5 (high), 80 percent, 10.0.2.7, 3000/tcp
- Open SSH Denial of Service And User Enumeration Vulnerabilities (Windows) , 7.8 (High), 80 percent, 10.0.2.7, 22/tcp
- MySQL/MariaDB weak password, 9.0 (High), 95 percent, 10.0.2.7, 3306/ tcp
If Charles selects the Ruby on Rails vulnerability, which of the following methods cannot be used to search for an existing Metasploit vulnerability?
A. CVE
B. BID
C. MSF
D. EDB
MSF
Metasploit searching supports multiple common vulnerability identifier systems, including CVE, BID, and EDB, but MSF was made up for this question. It may sound familiar, as the Metasploit console command is msfconsole.
BID
BID (Bugtraq ID) is a unique identifier assigned to vulnerabilities listed in the Bugtraq vulnerability database, maintained by Symantec. It is used to categorize and reference vulnerabilities, often in conjunction with CVE IDs, for efficient tracking and remediation
EDB
EDB (Exploit Database) is a comprehensive, public resource for information about vulnerabilities and exploits. It includes exploit code, shellcode, security research papers, and even a “Google Hacking Database” for advanced search techniques useful in penetration testing. This resource is widely used to identify and study potential vulnerabilities and their practical exploitation methods
Matt wants to pivot from a Linux host to other hosts in the network but is unable to install additional tools beyond those found on a typical Linux server. How can he leverage the system he is on to allow vulnerability scans of those remote hosts if they are firewalled against inbound connections and protected from direct access from his penetration testing workstation?
A. SSH tunneling
B. Netcat port forwarding
C. Enable IPv6
D. Modify browser plug‐ins
SSH tunneling
Matt can safely assume that almost any modern Linux system will have SSH, making SSH tunneling a legitimate option. If he connects outbound from the compromised system to his and creates a tunnel allowing traffic in, he can use his own vulnerability scanner through the tunnel to access the remote systems.
After gaining access to a Windows system, Fred uses the following command:
SchTasks /create /SC Weekly /TN “Antivirus” /TR “C:\Users\SSmith\av.exe” /ST 09:00
What has he accomplished?
A. He has set up a weekly antivirus scan.
B. He has set up a job called “weekly.”
C. He has scheduled his own executable to run weekly.
D. Nothing; this command will only run on Linux.
He has scheduled his own executable to run weekly.
Fred has used the scheduled tasks tool to set up a weekly run of av.exe from a user directory at 9 a.m. It is fair to assume in this example that Fred has gained access to SSmith’s user directory and has placed his own av.exe file there and is attempting to make it look innocuous if administrators find it.
After gaining access to a Linux system through a vulnerable service, Cassandra wants to list all of the user accounts on the system and their home directories. Which of the following locations will provide this list?
A. /etc/shadow
B. /etc/passwd
C. /var/usr
D. /home
/etc/passwd
On most Linux systems, the /etc/passwd file will contain a list of users as well as their home directories. Capturing both /etc/passwd and /etc/shadow are important for password cracking, making both desirable targets for penetration testers.
/etc/passwd
The /etc/passwd file is a fundamental configuration file on Linux systems that contains information about user accounts.
It typically includes
* username
* user ID (UID)
* group ID (GID)
* home directory
* shell
* other details
it does not store passwords directly; hashed passwords are kept in the more secure /etc/shadow file
/etc/shadow
The /etc/shadow file on Linux systems contains hashed passwords and associated account details for user authentication. It is protected by permissions to restrict access to non-privileged users, and gaining access typically requires root privileges
A few days after exploiting a target with the Metasploit Meterpreter payload, Robert loses access to the remote host. A vulnerability scan shows that the vulnerability that he used to exploit the system originally is still open. What has most likely happened?
A. A malware scan discovered Meterpreter and removed it.
B. The system was patched.
C. The system was rebooted.
D. Meterpreter crashed.
The system was rebooted.
Meterpreter is a memory‐resident tool that injects itself into another process. The most likely answer is that the system was rebooted, thus removing the memory‐resident Meterpreter process. Robert can simply repeat his exploit to regain access, but he may want to take additional steps to ensure continued access.
Meterpreter
Meterpreter is a powerful payload used in the Metasploit framework, operating as a memory-resident tool via DLL injection to avoid leaving traces on disk. It provides advanced capabilities like privilege escalation, file system access, network pivoting, and executing additional scripts, all while maintaining stealth by running entirely in memory
It will be removed if the system is rebooted!
Angela wants to exfiltrate data from a Windows system she has gained access to during a penetration test. Which of the following exfiltration techniques is least likely to be detected?
A. Send it via outbound HTTP as plaintext to a system she controls.
B. Hash the data, then send the hash via outbound HTTPS.
C. Use PowerShell to base64‐encode the data, then post to a public HTTPS‐accessible code repository.
D. Use PowerShell to base64‐encode the data, then use an SSH tunnel to transfer the data to a system she controls.
Use PowerShell to base64‐encode the data, then post to a public HTTPS‐accessible code repository.
Encoding data will make it less likely that intrusion prevent and data loss prevention systems will identify acquired data, meaning that encoding is a useful technique. Sending the data to a public repository like GitHub is less likely to look unusual than an internal system opening a SSH tunnel to a previously unknown system. Sending via HTTP instead of HTTPS will make inspection of the outbound, unencoded data trivial for defenders, and hashing the data will not leave it in a recoverable state when it arrives.
Ian’s penetration test rules of engagement specify that he cannot add tools to the systems he compromises in a specific target environment. What techniques will he have to use to meet this requirement?
A. Compromise using a fileless malware package, then cover his tracks and clean up any files he uses.
B. Compromise using a known exploit and dropper from Metasploit, then use living‐off‐the‐land techniques.
C. Compromise using a fileless malware package, then use living‐off‐the‐land techniques.
D. Compromise using a known exploit and dropper from Metasploit, then clean up the dropped files and only use system utilities for further work.
Compromise using a fileless malware package, then use living‐off‐the‐land techniques.
A combination of fileless malware and living‐off‐the‐land techniques that use native tools and utilities will help Ian to ensure that he meets the rules of engagement of the penetration test he is conducting. Even cleaning up files will violate those rules, meaning that Ian should not add tools even if he is confident in his ability to clean them up after he is done. A Metasploit dropper leaves files behind, which means both answers that use this do not meet the requirements.
What built‐in Windows server administration tool can allow command‐line PowerShell access from other systems?
A. VNC
B. PowerSSHell
C. PSRemote
D. RDP
PSRemote
PSRemote, or PowerShell Remote, provides command‐line access from remote systems. Once you have established a remote trust relationship using valid credentials, you can use PowerShell commands for a variety of exploit and information gathering activities, including use of dedicated PowerShell exploit tools.
