You have a Meterpreter session on a Windows host as a local admin. You need to move laterally to a domain controller using a cached Kerberos ticket. Which Metasploit module or command would you use?

use exploit/windows/local/current_user_psexec

use auxiliary/scanner/smb/smb_login

run post/multi/recon/local_exploit_suggester

run post/windows/gather/hashdump

You have a low-privilege shell on a Linux system. You find that the 'sudo' version is vulnerable to CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1. You need to escalate privileges to root. What is the most appropriate action?

Use 'pkexec' to run commands as root

Run 'sudo su' to switch to root

Run 'sudo -u#-1 id' to execute commands as root

Use a kernel exploit to gain root

During a red team engagement, you need to maintain persistence on a Windows host while minimizing the chance of detection by security tools. You have administrative privileges. Which of the following is the most stealthy persistence mechanism?

Use a WMI event subscription to execute a script when a specific event occurs

Create a scheduled task that runs at logon

Add a run key in the registry under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Register a Windows service that runs a payload and is set to start automatically

GIAC Penetration Tester (GPEN)

Domain 2Objective 2

Escalation and Exploitation GPEN Practice Questions (Page 7)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 31–35

31application · medium
You have a Meterpreter session on a Windows host as a local admin. You need to move laterally to a domain controller using a cached Kerberos ticket. Which Metasploit module or command would you use?
Select an answer first
32application · medium
You have a low-privilege shell on a Linux system. You find that the 'sudo' version is vulnerable to CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1. You need to escalate privileges to root. What is the most appropriate action?
Select an answer first
33foundation · easy
Which lateral movement technique involves using Kerberos tickets to authenticate to remote systems?
Select an answer first
34application · medium
During a red team engagement, you need to maintain persistence on a Windows host while minimizing the chance of detection by security tools. You have administrative privileges. Which of the following is the most stealthy persistence mechanism?
Select an answer first
35foundation · easy
Which of the following is a basic anti-forensics technique used to avoid detection by obscuring malicious code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Escalation and Exploitation GPEN Practice Questions (Page 7)

Questions 31–35

You have a Meterpreter session on a Windows host as a local admin. You need to move laterally to a domain controller using a cached Kerberos ticket. Which Metasploit module or command would you use?

You have a low-privilege shell on a Linux system. You find that the 'sudo' version is vulnerable to CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1. You need to escalate privileges to root. What is the most appropriate action?

Which lateral movement technique involves using Kerberos tickets to authenticate to remote systems?

During a red team engagement, you need to maintain persistence on a Windows host while minimizing the chance of detection by security tools. You have administrative privileges. Which of the following is the most stealthy persistence mechanism?

Which of the following is a basic anti-forensics technique used to avoid detection by obscuring malicious code?

Keep studying — Exploitation and Post-Exploitation