CompTIA CompTIA Certifications PT0-003 Questions & Answers

• Question 211:

  A penetration tester gains access to a Windows machine and wants to further enumerate users with native operating system credentials. Which of the following should the tester use?

  A. route.exe print

  B. netstat.exe -ntp

  C. net.exe commands

  D. strings.exe -a

  Correct Answer: C

  The net.exe commands are native to the Windows operating system and are used to manage and enumerate network resources, including user accounts.

  Using net.exe Commands:

  Step-by-Step Explanationnet user

  uk.co.certification.simulator.questionpool.PList@432e421f net user

  Additional net.exe Commands:

  net localgroup

  net localgroup

  uk.co.certification.simulator.questionpool.PList@71e0e60b net session

  Advantages:

  References from Pentesting Literature:

  References:

  Penetration Testing - A Hands-on Introduction to Hacking HTB Official Writeups

• Question 212:

  During an assessment, a penetration tester manages to get RDP access via a low-privilege user. The tester attempts to escalate privileges by running the following commands:

  Import-Module .\PrintNightmare.ps1

  Invoke-Nightmare -NewUser "hacker" -NewPassword "Password123!" -DriverName "Print" The tester attempts to further enumerate the host with the new administrative privileges by using the runas command. However, the access level is

  still low.

  Which of the following actions should the penetration tester take next?

  A. Log off and log on with "hacker".

  B. Attempt to add another user.

  C. Bypass the execution policy.

  D. Add a malicious printer driver.

  Correct Answer: A

  In the scenario where a penetration tester uses the PrintNightmare exploit to create a new user with administrative privileges but still experiences low-privilege access, the tester should log off and log on with the new "hacker" account to

  escalate privileges correctly.

  PrintNightmare Exploit:

  Commands Breakdown:

  Issue:

  Solution:

  Pentest References:

  Privilege Escalation: After gaining initial access, escalating privileges is crucial to gain full control over the target system. Session Management: Understanding how user sessions work and ensuring that new privileges are recognized by

  starting a new session. The use of the PrintNightmare exploit highlights a specific technique for privilege escalation within Windows environments.

  By logging off and logging on with the new "hacker" account, the penetration tester can ensure the new administrative privileges are fully applied, allowing for further enumeration and exploitation of the target system.

• Question 213:

  A penetration tester is evaluating a SCADA system. The tester receives local access to a workstation that is running a single application. While navigating through the application, the tester opens a terminal window and gains access to the

  underlying operating system.

  Which of the following attacks is the tester performing?

  A. Kiosk escape

  B. Arbitrary code execution

  C. Process hollowing

  D. Library injection

  Correct Answer: A

  A kiosk escape involves breaking out of a restricted environment, such as a kiosk or a single application interface, to access the underlying operating system. Here's why option A is correct:

  Kiosk Escape: This attack targets environments where user access is intentionally limited, such as a kiosk or a dedicated application. The goal is to break out of these restrictions and gain access to the full operating system. Arbitrary Code

  Execution: This involves running unauthorized code on the system, but the scenario described is more about escaping a restricted environment. Process Hollowing: This technique involves injecting code into a legitimate process, making it

  appear benign while executing malicious activities. Library Injection: This involves injecting malicious code into a running process by loading a malicious library, which is not the focus in this scenario.

  References from Pentest:

  Forge HTB: Demonstrates techniques to escape restricted environments and gain broader access to the system.

  Horizontall HTB: Shows methods to break out of limited access environments, aligning with the concept of kiosk escape.

  Conclusion:

  Option A, Kiosk escape, accurately describes the type of attack where a tester breaks out of a restricted environment to access the underlying operating system.

• Question 214:

  Which of the following is the most efficient way to infiltrate a file containing data that could be sensitive?

  A. Use steganography and send the file over FTP

  B. Compress the file and send it using TFTP

  C. Split the file in tiny pieces and send it over dnscat

  D. Encrypt and send the file over HTTPS

  Correct Answer: D

  When considering efficiency and security for exfiltrating sensitive data, the chosen method must ensure data confidentiality and minimize the risk of detection. Here's an analysis of each option:

  Use steganography and send the file over FTP (Option A):

  Compress the file and send it using TFTP (Option B):

  Split the file in tiny pieces and send it over dnscat (Option C):

  Encrypt and send the file over HTTPS (Answer: D):

  Conclusion: Encrypting the file and sending it over HTTPS is the most efficient and secure method for exfiltrating sensitive data, ensuring both confidentiality and reducing the risk of detection.

• Question 215:

  In a file stored in an unprotected source code repository, a penetration tester discovers the following line of code:

  sshpass -p donotchange ssh [email protected]

  Which of the following should the tester attempt to do next to take advantage of this information? (Select two).

  A. Use Nmap to identify all the SSH systems active on the network.

  B. Take a screen capture of the source code repository for documentation purposes.

  C. Investigate to find whether other files containing embedded passwords are in the code repository.

  D. Confirm whether the server 192.168.6.14 is up by sending ICMP probes.

  E. Run a password-spraying attack with Hydra against all the SSH servers.

  F. Use an external exploit through Metasploit to compromise host 192.168.6.14.

  Correct Answer: BC

  When a penetration tester discovers hard-coded credentials in a file within an unprotected source code repository, the next steps should focus on documentation and further investigation to identify additional security issues.

  Taking a Screen Capture (Option B):

  Investigating for Other Embedded Passwords (Option C):

  Pentest References:

  Initial Discovery: Discovering hard-coded credentials often occurs during source code review or automated scanning of repositories. Documentation: Keeping detailed records of all findings is a critical part of the penetration testing process.

  This ensures that all discovered vulnerabilities are reported accurately and comprehensively.

  Further Investigation: After finding a hard-coded credential, it is best practice to look for other security issues within the same repository. This might include other credentials, API keys, or sensitive information.

  Steps to Perform:

  Take a Screen Capture:

  Investigate Further:

  grep -r 'password' /path/to/repository

  uk.co.certification.simulator.questionpool.PList@2fe88cb7 trufflehog --regex --entropy=True /path/to/repository By documenting the finding and investigating further, the penetration tester ensures a comprehensive assessment of the

  repository, identifying and mitigating potential security risks effectively.

• Question 216:

  A penetration tester is working on a security assessment of a mobile application that was developed in-house for local use by a hospital. The hospital and its customers are very concerned about disclosure of information. Which of the following tasks should the penetration tester do first?

  A. Set up Drozer in order to manipulate and scan the application.

  B. Run the application through the mobile application security framework.

  C. Connect Frida to analyze the application at runtime to look for data leaks.

  D. Load the application on client-owned devices for testing.

  Correct Answer: B

  When performing a security assessment on a mobile application, especially one concerned with information disclosure, it is crucial to follow a structured approach to identify vulnerabilities comprehensively. Here's why option B is correct:

  Mobile Application Security Framework: This framework provides a structured methodology for assessing the security of mobile applications. It includes various tests such as static analysis, dynamic analysis, and reverse engineering, which

  are essential for identifying vulnerabilities related to information disclosure. Initial Steps: Running the application through a security framework allows the tester to identify a broad range of potential issues systematically. This initial step

  ensures that all aspects of the application's security are covered before delving into more specific tools like Drozer or Frida.

  References from Pentest:

  Writeup HTB: Demonstrates the use of structured methodologies to ensure comprehensive coverage of security assessments.

  Horizontall HTB: Emphasizes the importance of following a structured approach to identify and address security issues.

• Question 217:

  A penetration tester is performing an authorized physical assessment. During the test, the tester observes an access control vestibule and on-site security guards near the entry door in the lobby. Which of the following is the best attack plan for the tester to use in order to gain access to the facility?

  A. Clone badge information in public areas of the facility to gain access to restricted areas.

  B. Tailgate into the facility during a very busy time to gain initial access.

  C. Pick the lock on the rear entrance to gain access to the facility and try to gain access.

  D. Drop USB devices with malware outside of the facility in order to gain access to internal machines.

  Correct Answer: B

  In an authorized physical assessment, the goal is to test physical security controls. Tailgating is a common and effective technique in such scenarios. Here's why option B is correct:

  Tailgating: This involves following an authorized person into a secure area without proper credentials. During busy times, it's easier to blend in and gain access without being noticed. It tests the effectiveness of physical access controls and

  security personnel.

  Cloning Badge Information: This can be effective but requires proximity to employees and specialized equipment, making it more complex and time- consuming.

  Picking Locks: This is a more invasive technique that carries higher risk and is less stealthy compared to tailgating.

  Dropping USB Devices: This tests employee awareness and response to malicious devices but does not directly test physical access controls.

  References from Pentest:

  Writeup HTB: Demonstrates the effectiveness of social engineering and tailgating techniques in bypassing physical security measures. Forge HTB: Highlights the use of non-invasive methods like tailgating to test physical security without

  causing damage or raising alarms.

  Conclusion:

  Option B, tailgating into the facility during a busy time, is the best attack plan to gain access to the facility in an authorized physical assessment.

• Question 218:

  In a cloud environment, a security team discovers that an attacker accessed confidential information that was used to configure virtual machines during their initialization. Through which of the following features could this information have been accessed?

  A. IAM

  B. Block storage

  C. Virtual private cloud

  D. Metadata services

  Correct Answer: D

  In a cloud environment, the information used to configure virtual machines during their initialization could have been accessed through metadata services.

  Metadata Services:

  Other Features:

  Pentest References:

  Cloud Security: Understanding how metadata services work and the potential risks associated with them is crucial for securing cloud environments. Exploitation: Metadata services can be exploited to retrieve sensitive data if not properly

  secured.

  By accessing metadata services, an attacker can retrieve sensitive configuration information used during VM initialization, which can lead to further exploitation.

• Question 219:

  A penetration tester wants to use the following Bash script to identify active servers on a network:

  1 network_addr="192.168.1"

  2 for h in {1..254}; do

  3 ping -c 1 -W 1 $network_addr.$h > /dev/null

  4 if [ $? -eq 0 ]; then

  5 echo "Host $h is up" 6 else

  7 echo "Host $h is down"

  8 fi

  9 done

  Which of the following should the tester do to modify the script?

  A. Change the condition on line 4.

  B. Add 2>and1 at the end of line 3.

  C. Use seq on the loop on line 2.

  D. Replace $h with ${h} on line 3.

  Correct Answer: C

  The provided Bash script is used to ping a range of IP addresses to identify active hosts in a network. Here's a detailed breakdown of the script and the necessary modification: Original Script: 1 network_addr="192.168.1" 2 for h in {1..254}; do 3 ping -c 1 -W 1 $network_addr.$h > /dev/null 4 if [ $? -eq 0 ]; then 5 echo "Host $h is up" 6 else 7 echo "Host $h is down" 8 fi 9 done Analysis: Using seq for Better Compatibility: for h in $(seq 1 254); do uk.co.certification.simulator.questionpool.PList@2101d72c Modified Script: 1 network_addr="192.168.1" 2 for h in $(seq 1 254); do 3 ping -c 1 -W 1 $network_addr.$h > /dev/null 4 if [ $? -eq 0 ]; then 5 echo "Host $h is up" 6 else 7 echo "Host $h is down" 8 fi 9 done

• Question 220:

  SIMULATION

  You are a penetration tester running port scans on a server.

  INSTRUCTIONS

  Part 1: Given the output, construct the command that was used to generate this output from the available options.

  Part 2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  A.

  Correct Answer: See explanation below.