Post-exploitation persistence, privilege escalation, and lateral movement techniques tested on the CompTIA PenTest+ exam.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is a web shell?
- A small script deployed on a compromised web server that provides remote code execution through a web interface, used for persistent backdoor access.
- What is a rootkit?
- Malicious software that hides its presence and gives an attacker privileged access, often by modifying kernel-level code or hooking system calls.
- Define a backdoor in post-exploitation context.
- A hidden access mechanism left on a system that allows an attacker to regain entry and bypass normal authentication.
- How can Windows Scheduled Tasks be used for persistence?
- An attacker can create a scheduled task that executes a malicious payload at specified intervals or system events, running even after reboot.
- What do Windows Registry Run keys provide for persistence?
- Registry keys like HKLM\Software\Microsoft\Windows\CurrentVersion\Run execute programs at startup, allowing malware to persist across reboots.
- What is a kernel exploit in privilege escalation?
- An exploit targeting vulnerabilities in the operating system kernel to elevate privileges from user to administrator or system level.
- What is UAC bypass?
- A technique that circumvents User Account Control protections in Windows to execute code with elevated privileges without user consent.
- What does a PAC (Privilege Attribute Certificate) contain in Kerberos?
- Authorization data that contains a user's group memberships, security identifiers (SIDs), and other privilege information used in Kerberos authentication.
- What is a pass-the-hash attack?
- An attack that uses stolen NTLM password hashes to authenticate to network resources without knowing the plaintext password.
- What is a pass-the-ticket attack?
- An attack that uses stolen Kerberos ticket-granting tickets (TGTs) or service tickets to authenticate to resources without needing the password.
- What is Kerberoasting?
- An attack that requests service tickets for accounts with Service Principal Names (SPNs), then cracks the ticket hashes offline to recover plaintext passwords.
- Define lateral movement in post-exploitation.
- The process of moving through a network from one compromised system to other systems while maintaining access and escalating privileges.
- What is Command and Control (C2)?
- Infrastructure used by an attacker to communicate with and control compromised systems, receiving commands and exfiltrating data.
- What is a beacon in C2 communications?
- A callback mechanism where a compromised system periodically contacts a C2 server to receive commands and report status.
- What is an agent in C2 communications?
- Malware running on a compromised system that communicates with the C2 server to execute commands and maintain persistent access.
FlashKeepers