During an engagement, a penetration tester found some weaknesses that were common
across the customer??s entire environment. The weaknesses included the following:
✑ Weaker password settings than the company standard
✑ Systems without the company's endpoint security software installed
✑ Operating systems that were not updated by the patch management system
Which of the following recommendations should the penetration tester provide to address the root issue?
Correct Answer:
B
✑ Identified Weaknesses:
✑ Configuration Management System:
✑ Other Recommendations:
Pentest References:
✑ System Hardening: Ensuring all systems adhere to security baselines and configurations to reduce attack surfaces.
✑ Automation in Security: Using configuration management tools to automate security practices, ensuring compliance and reducing manual errors.
Implementing a configuration management system addresses the root issue by ensuring consistent security configurations, software deployments, and patch management across the entire environment.
=================
A penetration tester performs a service enumeration process and receives the following result after scanning a server using the Nmap tool:
PORT STATE SERVICE
22/tcp open ssh 25/tcp filtered smtp 111/tcp open rpcbind 2049/tcp open nfs
Based on the output, which of the following services provides the best target for launching an attack?
Correct Answer:
D
Based on the Nmap scan results, the services identified on the target server are as follows:
✑ 22/tcp open ssh:
✑ 25/tcp filtered smtp:
✑ 111/tcp open rpcbind:
✑ 2049/tcp open nfs:
Conclusion: The NFS service (2049/tcp) provides the best target for launching an attack. File sharing services like NFS often contain sensitive data and can be vulnerable to misconfigurations that allow unauthorized access or privilege escalation.
During an assessment, a penetration tester manages to get RDP access via a low-privilege user. The tester attempts to escalate privileges by running the following commands:
Import-Module .PrintNightmare.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Password123!" -DriverName "Print"
The tester attempts to further enumerate the host with the new administrative privileges by using the runas command. However, the access level is still low. Which of the following actions should the penetration tester take next?
Correct Answer:
A
In the scenario where a penetration tester uses the PrintNightmare exploit to create a new user with administrative privileges but still experiences low-privilege access, the tester should log off and log on with the new "hacker" account to escalate privileges correctly.
✑ PrintNightmare Exploit:
✑ Commands Breakdown:
✑ Issue:
✑ Solution:
Pentest References:
✑ Privilege Escalation: After gaining initial access, escalating privileges is crucial to gain full control over the target system.
✑ Session Management: Understanding how user sessions work and ensuring that new privileges are recognized by starting a new session.
✑ The use of the PrintNightmare exploit highlights a specific technique for privilege escalation within Windows environments.
By logging off and logging on with the new "hacker" account, the penetration tester can ensure the new administrative privileges are fully applied, allowing for further enumeration and exploitation of the target system.
=================
A penetration tester gains access to a Windows machine and wants to further enumerate users with native operating system credentials. Which of the following should the tester use?
Correct Answer:
C
The net.exe commands are native to the Windows operating system and are used to manage and enumerate network resources, including user accounts.
✑ Using net.exe Commands:
Step-by-Step Explanationnet user
✑ uk.co.certification.simulator.questionpool.PList@339a6471 net user
✑ Additional net.exe Commands: net localgroup
net localgroup
✑ uk.co.certification.simulator.questionpool.PList@1b7dbef8 net session
✑ Advantages:
✑ References from Pentesting Literature: References:
✑ Penetration Testing - A Hands-on Introduction to Hacking
✑ HTB Official Writeups
=================
A penetration tester needs to evaluate the order in which the next systems will be selected for testing. Given the following output:
Hostname | IP address | CVSS 2.0 | EPSS hrdatabase | 192.168.20.55 | 9.9 | 0.50
financesite | 192.168.15.99 | 8.0 | 0.01
legaldatabase | 192.168.10.2 | 8.2 | 0.60
fileserver | 192.168.125.7 | 7.6 | 0.90
Which of the following targets should the tester select next?
Correct Answer:
A
Given the output, the penetration tester should select the fileserver as the next target for testing, considering both CVSS and EPSS scores. Explanation
✑ CVSS (Common Vulnerability Scoring System):
✑ EPSS (Exploit Prediction Scoring System):
✑ Evaluation:
Pentest References:
✑ Prioritization: Balancing between severity (CVSS) and exploitability (EPSS) is crucial for effective vulnerability management.
✑ Risk Assessment: Evaluating both the impact and the likelihood of exploitation helps in making informed decisions about testing priorities.
By selecting the fileserver, which has a high EPSS score, the penetration tester focuses on a target that is more likely to be exploited, thereby addressing the most immediate risk.
=================
