Post-exploitation persistence, privilege escalation, and lateral movement techniques tested on the CompTIA PenTest+ exam.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is a web shell?
Show answer
A small script deployed on a compromised web server that provides remote code execution through a web interface, used for persistent backdoor access.- What is a rootkit?
Show answer
Malicious software that hides its presence and gives an attacker privileged access, often by modifying kernel-level code or hooking system calls.- Define a backdoor in post-exploitation context.
Show answer
A hidden access mechanism left on a system that allows an attacker to regain entry and bypass normal authentication.- How can Windows Scheduled Tasks be used for persistence?
Show answer
An attacker can create a scheduled task that executes a malicious payload at specified intervals or system events, running even after reboot.- What do Windows Registry Run keys provide for persistence?
Show answer
Registry keys like HKLM\Software\Microsoft\Windows\CurrentVersion\Run execute programs at startup, allowing malware to persist across reboots.- What is a kernel exploit in privilege escalation?
Show answer
An exploit targeting vulnerabilities in the operating system kernel to elevate privileges from user to administrator or system level.- What is UAC bypass?
Show answer
A technique that circumvents User Account Control protections in Windows to execute code with elevated privileges without user consent.- What does a PAC (Privilege Attribute Certificate) contain in Kerberos?
Show answer
Authorization data that contains a user's group memberships, security identifiers (SIDs), and other privilege information used in Kerberos authentication.- What is a pass-the-hash attack?
Show answer
An attack that uses stolen NTLM password hashes to authenticate to network resources without knowing the plaintext password.- What is a pass-the-ticket attack?
Show answer
An attack that uses stolen Kerberos ticket-granting tickets (TGTs) or service tickets to authenticate to resources without needing the password.- What is Kerberoasting?
Show answer
An attack that requests service tickets for accounts with Service Principal Names (SPNs), then cracks the ticket hashes offline to recover plaintext passwords.- Define lateral movement in post-exploitation.
Show answer
The process of moving through a network from one compromised system to other systems while maintaining access and escalating privileges.- What is Command and Control (C2)?
Show answer
Infrastructure used by an attacker to communicate with and control compromised systems, receiving commands and exfiltrating data.- What is a beacon in C2 communications?
Show answer
A callback mechanism where a compromised system periodically contacts a C2 server to receive commands and report status.- What is an agent in C2 communications?
Show answer
Malware running on a compromised system that communicates with the C2 server to execute commands and maintain persistent access.
FlashKeepers