Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

PNPT > PNPT > Flashcards

PNPT Flashcards

1
Q

Linux File System: what is the /bin directory used for in Linux ?

A

bin is a directory which contains important executable programs and core OS commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Linux File System: what is the /boot directory used for in Linux ?

A

this directory contains the files needed by the boot loader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Linux File System: what is the /dev directory used for in Linux ?

A

the /dev directory contains your device files

this directory will give you valuable info about whats connected to your system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Linux file system: what is the /etc directory used for ?

A

this contains the critical configuration files and startup scripts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Linux File system: what is the purpose of the /home directory ?

A

this is where users home files are stored similar to the documents folder in windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

where are the users stored on a linux system ?

A

the directory where the users are stored on a linux machine is the /etc/passwd directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

where are the passwords stored on a linux machine?

A

/etc/shadow is where all the passwords are stored in linux

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what command can we use to pull users from the sudoers files who can use sudo ?

A

grep ‘sudo’ /etc/group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what are two ways we can list the IP’s on a linux system ?

A

ip -a
or
ifconfig

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

how do we see the wireless connections on a linux machine ?

A

iwconfig

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

how can we see the arp connections on a machine ?

A

arp -a
or
IP n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

how do we see the routing table on our PC ?

A

route

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what command do we use to see open ports and services on a linux machine ?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

where are the apache files that can be stored on the web server found ?

A

/var/www/html

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

how can we spin up a webserver on the fly with python ?

A

Python3 -m http.server 80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what are the 5 stages of ethical hacking ?

A
  1. Recon
  2. Scanning and Enumeration
  3. gaining access
  4. maintaining access
  5. covering tracks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

how can we use the netdiscover command to discover other hosts on the network ?

A

netdiscover -r 192.168.57.0/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what are some ways we can enumerate SMB?

A

Smb is a file share

We want to figure out the version of smb running

The metasploit module /auxiliary/scanner/smb/smb_version is a good way of discovering the version of smb running

Sometimes smb will allow anonymous access, this will allow us to see files in the file share. We always want to check if there is anonymous access

We can check for anonymous smb access with the smbclient command:
Smbclient –L \192.168.57.134\

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what is a reverse shell ?

A

A reverse shell is when a victim connects to us, target is connecting attack box is listening

Most of the time we use reverse shells

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is a bind shell?

A

Bind shell we open up a port on our attack box that connects to the victim
Bind shell we connect to the target

Most of the time we use reverse shells
Bind shells are usually used on an external assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

how do we create a reverse shell with netcat ?

A

Attacker: nc –nlvp 4444
Victim: nc <ip> 4444</ip>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

how do we create a bind shell with netcat ?

A

Victim: Nc –nvlp 4444 –e /bin/bash
Attacker: nc <ip> 4444</ip>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what are non staged payloads ?

A
  • Sends exploit shellcode all at once
    Larger in size and wont always work
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what are staged payloads ?

A
  • Sends payload in stages
    Can be less stable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
what is credential stuffing ?
injecting breached account credentials in hopes of account takeover
26
what is active directory ?
- Directory service developed by Microsoft to manage windows domain networks - Stores information related to objects, such as Computers, Users, Printers etc Think about it as a phone book for windows
27
what does AD use for authentication ?
○ Non windows devices such as Linux machines, firewalls, etc can also authenticate to Active Directory via RADIUS or LDAP
28
what is a domain controller ?
Domain controller - a domain controller is a server with the AD DS server role installed that has specifically been promoted to a domain controller
29
what are some of the features of domain controllers ?
- Host a copy of the AD DS directory store - Provide authentication and authorization services - Replicate updates to other domain controllers in the domain and forest - Allow administrative access to manage user accounts and network resources
30
what is the AD DS data store ?
the AD DS data store contains the database files and processes that store and manage directory information for users, services and applications
31
what are some attributes of the AD DS data store ?
- Consists of the NTDS.dit file - Is stored by default in the %SystemRoot%\NTDS folder on all domain controllers Is accessible only through the domain controller processes and protocols
32
what is the AD DS Schema ?
- defines every type of object that can be stored in the directory - Enforces rules regarding object creating and configuration Blueprint
33
what are some features of active directory domains ?
- Domains are used to group and manage objects in the organization - An administrative boundary for applying policies to groups of objects - A replication boundary for replicating data between domain controllers - An authentication and authorization boundary that provides a way to limit the scope of access to resources
34
what are some characteristics of AD trees ?
- A domain tree is a hierarchy of domains in AD DS - All domains in the tree ○ Share a contiguous namespace with the parent domain ○ Can have additional child domains ○ By default create a two way transitive trust with other domains - Parent domains and children domains they look like sub domains
35
what are some characteristics of AD OU's?
- OU's are active directory containers that contain users, groups, computers and other OU's - Represent your organization hierarchically and logically - Manage a collection of objects in a consistent way - Delegate permissions to administer groups of objects - Apply polices
36
what are some characteristics of AD trusts ?
Types of trusts - Directional - the trust direction flows from trusting domain to the trusted domain - Transitive, the trust relationship is extended beyond a two domain trust to include other trusted domains , these can go tree to tree or forest to forest - All domains in a forest trust all other domains in the forest Trusts can extend outside the forest
37
what are some examples of AD objects ?
User - enables network resource access for a user InetOrgPerson - similar to a user account / used for compatibility with other directory services Contacts - used primarily to assign e-mail addresses to external users / Does not enable network access Groups - used to simplify the administration of access control Computers - enables authentication and auditing of computer access to resources Printers - used to simplify the process of locating and connecting printers Shared Folders - enables users to search for shared folders based on properties
38
what is LLMNR ?
- used to identify hosts when DNS fails to do so - previously NBT-NS - the key flaw with LLMNR is that the service utilizes a users username and NTLMv2 has when appropriately responded to
39
what are some of the mitigations for LLMNR poisoning ?
- The best defense in this case it to disable LLMNR and NBT-NS - To disable LLMNR select turn off multicast name resolution ○ Under local computer policy > computer configuration > administrative templates > network > DNS client in the group policy editor - If a company must use or cant disable LLMNR/NBT-NS the best course of action is to ○ Require network access control Require strong user passwords the more complex and long the harder it is to crack the hash
40
what is an smb relay attack ?
- Instead of cracking hashes gathered with responder, we can instead relay those hashes to specific machines and potentially gain access
41
what are the requirements for SMB signing ?
- smb signing must be disabled or not enforced on the target - relayed user credentials must be admin on a machine for any real value
42
What are some of the SMB relay attack mitigations ?
- Enable smb signing on all devices ○ Pro / completely stops the attack ○ Con / can cause performance issues with file copies - Disable NTLM authentication on the network ○ Pro / completely stops the attack ○ Con / if Kerberos stops working, Windows defaults back to NTLM - Account tiering ○ Pro / Limits domain admins to specific tasks ○ Con / Enforcing the policy may be difficult - Local Admin Restrictions ○ Pro / Can prevent a lot of lateral movement ○ Con / potential increase in the amount of service desk tickets
43
what are some ways we can get shells with user credentials
We can gain a shell through metasploit if we have the password: Use exploit/windows/smb/psexec Gaining shell access with psexec.py with a password: Psexec.py domain/user:'Password'@IP Through psexec with a hash: Psexec.py administrator@10.0.0.24 -hashes LM:NT
44
explain IPv6 poisoning
Ipv6 posioning abuses the fact that windows queries for an ipv6 address even in ipv4 only environments. If you do not use ipv6 internally the safest way to prevent mitm6 is to block DHCPv6 traffic and incoming router advertisements in windows firewall via group policy. Disabling ipv6 entirely may have unintended consequences
45
what are some mitigations against IPv6 attacks ?
if wpad is not in use internally disable it via group policy and by disabling the WinHttpautopProxySvc service Relaying to ldap and ldaps can only be mitigated by enabling both ldap signing and ldap channel binding Consider administrative user to the protected user group or making them as account is sensitve and cannot be delegated, which will prevent of the impersonation of that user via delegation
46
what would our internal attack strategy be on an internal pentest
begin the day with mitm6 and responder run scans to generate traffic, Nessus scans, Vulnerability Scans, Look for websites in scopes look for default credentials on web logins
47
what are pass attacks ?
if we crack a password and or can dump the SAM hashes we can leverage both for lateral movements in our network We can do pass attacks with hashes not just passwords
48
what hashes do pass the has attacks work with ?
pass the hash attacks only work with NTLMv1 not NTLMv2
49
what is the point of lsass in a windows environment ?
lsass is responsible for enforcing the security policy on a system it also stores credentials
50
if we compromise an account and get a login somewhere what is one of the first things we want to do ?
if you get an account and get a login somewhere you want to dump the secrets of that machine secrets dump can be run with a password or a hash
51
what are some of the juicy details we want to capture with secrets dump ?
you want to capture SAM hashes of administrators and users we want to do a secrets dump on every machine we get access to
52
what are some pass attacks mitigations ?
Limit account re-use - avoid re using local admin password - disable guest and administrator accounts - limit who is a local admin Utilize stronger passwords - avoid using common words Pam solution
53
what are some mitigations for kerborasting ?
strong passwords least privilege make sure service accounts are not domain admins
54
what are tokens ?
temporary keys that allow you access to a system/network without having to provide credentials each time you access a file think cookies for computers
55
what are the two types of tokens ?
delegate and impersonate
56
what are delegate tokens ?
created for logging into a machine or using remote desktop / this is the most common type of token
57
what are impersonate tokens ?
impersonate - non interactive such as attaching a network drive or domain logon script
58
what are the mitigations for token attacks ?
limit user / group token creation permission account tearing local admin restriction
59
what is the mimikatz tool used for ?
Tool used to view and steal credentials, generate kerberos tickets, and leverage attacks
60
what attacks can mimikatz be used for ?
- credential dumping - pass the hash - over pass the hash -Pass the ticket - silver ticket - Golden ticket
61
what should we do after compromising a user account ?
search for quick wins - kerberoasting - secrets dump - pass the hash pass the password ○ Enumerate bloodhound etc ○ Where do your account have access Old vulnerabilities die hard
62
what should we do after we own the domain?
- Provide as much value to your client as possible ○ Put your blinders on and do it again ○ Dump the NTDS.dit and crack passwords ○ Enumerate shares for sensitive info - Persistence can be important ○ What happens if our DA account is lost ○ Creating a DA account can be useful Creating a golden ticket can be useful
63
what is the NTDS.dit ?
- A database used to store AD data this data includes ○ User information ○ Group information ○ Security descriptors - And password hashes
64
what tool can we use to dump the NTDS.dit ?
Secretsdump.py /: ''@ -just-dc-ntlm
65
what is a golden ticket account ?
What is it ? - When we compromise the krbtgt account we own the domain - We can request access to any resource or system on the domain - Golden ticket = complete access to every machine Step 1. We can use mimikatz to carry out a golden ticket account Step 2. once we have the SID and krbtgt hash, we can generate the golden ticket Step 3. With a golden ticket we can now access other machines from the command line

PNPT (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions