Chapter 7 - System hacking Flashcards
What are the three times that are typically stored as part of file metadata?
A. Moves, adds, changes
B. Modified, accessed, deleted
C. Moved, accessed, changed
D. Modified, accessed, created
D.
There are three date and time stamps commonly used in file metadata. When the file
is created, that moment is stored. When a file is accessed by a user, that moment is stored. When a file is modified, that moment is stored. Accessed is not the same as modified since accessing a file could be read-only. You could open a file expecting to modify it, but not end up doing the modification. The access time still changes. While moves, adds, and changes may sometimes be referred to as MAC, like modified, accessed, and created, those are not tasks associated with file times.
What is it called when you obtain administrative privileges from a normal user account?
A. Privilege escalation
B. Account migration
C. Privilege migration
D. Account escalation
A.
Account migration, privilege migration, and account escalation are vague and don’t have clearly defined definitions, even if they may exist. Privilege escalation, on the other hand, is used to gain elevated privileges when you only have the permissions of a normal user.
What does John the Ripper’s single crack mode, the default mode, do?
A. Checks every possible password
B. Uses known information and mangling rules
C. Uses a built-in wordlist
D. Uses wordlist and mangling rules
B.
Incremental mode in John will run an attack in which it will try every possible pass- word within specified parameters, meaning John will generate the passwords. The default mode in John is single crack mode, which uses information including the username and the home directory to generate a password using mangling rules. Incremental mode does not use wordlists, though John does support the use of wordlists.
What is the trade-off for using rainbow tables?
A. Disk space prioritized over speed
B. Accuracy prioritized over disk space
C. Speed prioritized over accuracy
D. Speed prioritized over disk space
D. Rainbow tables use precomputed hashes that are mapped to plaintext passwords in order to speed up the process of obtaining the passwords from stored hashes. Rainbow tables, though, are very expensive when it comes to disk space. Hashes and passwords are stored in the rainbow tables. Accuracy is neither sacrificed nor prioritized using rainbow tables. You will give up disk space to get faster cracking times using rainbow tables.
Which of these is a reason to use an exploit against a local vulnerability?
A. Pivoting
B. Log manipulation
C. Privilege escalation
D. Password collection
C. Local vulnerabilities are used against applications that are not listening on the network. This means they require you to be “local” to the machine and not remote. In other words, you have to be logged in somehow. A local vulnerability would not be used to collect pass- words; you don’t need a vulnerability to do that. Similarly, you don’t need to make use of a vulnerability to manipulate logs or to pivot. Most of those would require you to have ele- vated permissions, though. A local vulnerability may be exploited to get you those elevated permissions.
What is it called when you manipulate the time stamps on files?
A. Time stamping
B. Timestomping
C. Meta stomping
D. Meta manipulation
B. Manipulating time stamps on files is called timestomping. It is used to set file times, which may be used to throw off investigations or identify intrusions. None of the other answers is a real thing.
What would an attacker use an alternate data stream on a Windows system for?
A. Hiding files
B. Running programs
C. Storing PowerShell scripts
D. Blocking files
A.
Alternate data streams are a function of the New Technology File System (NTFS), created to support the resource forks of Apple’s file system in Windows NT. Since many of the util- ities and programs in Windows don’t natively understand alternate data streams, they can’t make use of them and won’t show them. The file can be accessed if the user knows how to
display and manipulate the alternate data streams.
Which of these techniques might be used to maintain access to a system?
A. Run key in the Windows Registry
B. Alternate data stream
C. .vimrc file on Linux
D. PowerShell
A.
You may use a PowerShell script to perform functions that could support persistence on
a system, but the PowerShell script alone won’t be used to maintain access. Alternate data streams won’t be of any use for maintaining access, and a .vimrc file is a startup file for the Vi editor. The run key in the Windows Registry, though, could be used to put an entry in that would run a program automatically that could make sure an attacker could get access even after a reboot.
If you were looking for reliable exploits you could use against known vulnerabilities, what
would you use?
A. Tor network
B. Meterpreter
C. msfvenom
D. Exploit-DB
D.
While the Tor network may be used to obtain an exploit against a vulnerability, there
is some question as to how reliable that exploit may be. The Tor network may contain malicious content, even in the case of source code. Meterpreter and msfvenom are elements of Metasploit that don’t have anything to do with locating vulnerabilities. Exploit-DB is
a website and repository of exploits that could be searched to locate an exploit targeting specific and known vulnerabilities.
What might an attacker be trying to do by using the clearev command in Meterpreter?
A. Run an exploit
B. Manipulate time stamps
C. Manipulate log files
D. Remote login
C. The clearev command is a Meterpreter command used to clear the Windows Event Viewer logs. While you may be able to manipulate time stamps and log files in Meterpreter, you wouldn’t use the clearev command for that. The clearev command does not allow an attacker to log in remotely.
You find after you get access to a system that you are the user www-data. What might you
try to do shortly after getting access to the system?
A. Pivot to another network
B. Elevate privileges
C. Wipe logs
D. Exploit the web browser
B.
When the Apache web server runs on a Linux system, it will commonly run as the user www-data. This is a privilege-restricted account that would prevent an attacker from doing much on the system. To do anything, like wiping log files or pivoting to another network, you would need to elevate privileges to administrative/root level. Exploiting the web browser wouldn’t be done in this context. A web server more than likely wouldn’t even have a web browser installed.
You’ve installed multiple files and processes on the compromised system. What should you
also look at installing?
A. Registry keys
B. Alternate data streams
C. Rootkit
D. Root login
C.
Attackers often install extra files and run extra processes on systems. These could easily be detected by manual investigation or, certainly, by automated detection tools. The way around that is to install a rootkit, which may include kernel-mode drivers or replacement system utilities that would hide the existence of these files and processes. Alternate data streams may be used to hide files but not processes. Registry keys could also hide files but not processes.
What does pivoting on a compromised system get you?
A. Database access
B. A route to extra networks
C. Higher level of privileges
D. Persistent access
B.
Pivoting is the process of using a compromised system to move onto other systems and networks within the target environment. Pivoting does not get you higher-level permissions or persistent access. You may ultimately get to a database server by pivoting, but that’s not what pivoting does or is specifically used for. It would be a nice side effect of pivoting.
What would you use the program rtgen for?
A. Generating wordlists
B. Generating rainbow tables
C. Generating firewall rules
D. Persistent acces
B. The program rtgen is a program that is part of the rcrack suite. rcrack is used to crack passwords with rainbow tables. It is used to generate the rainbow tables that rcrack will use to crack passwords. Rainbow tables are not wordlists but mappings of plaintext passwords to hashes, which makes it much easier to get passwords from hashes.
Which of these would be a way to exploit a client-side vulnerability?
A. Sending malformed packets to a web server
B. Sending large ICMP packets
C. Sending a crafted URL
D. Brute-force password attack
C. Malformed packets could potentially cause a failure or trigger a vulnerability on the server side. Large ICMP packets aren’t likely to do anything and certainly wouldn’t exploit a client-side vulnerability. A brute-force password attack isn’t exploiting a vulnerability, even if it is an attack technique. Sending a crafted URL could potentially exploit a client-side vulner- ability in a web browser.
