Pass the CompTIA PenTest+ PT0-003 Questions and answers with CertsForce

Windows provides built-in utilities for user enumeration and privilege escalation.

net command (Option C):

The net command is used to list users, groups, and shares on a Windows system:

net user

net localgroup administrators

net group " Domain Admins " /domain

Useful for gathering privilege escalation targets and understanding user permissions.

Responder es una herramienta especializada para capturar tráfico LLMNR, NBNS y MDNS, y realizar ataques de spoofing y captura de hashes. Es ampliamente utilizada en entornos Windows para capturar credenciales cuando se resuelven nombres que no existen en el DNS.

Netcat y Burp Suite no están diseñados para este propósito. Nmap sirve para escaneo de redes, pero no para captura ni explotación de LLMNR.

Referencia: PT0-003 Objective 4.2 – Explain lateral movement techniques and privilege escalation tools (Responder is explicitly listed).

Debugging Mode:

Purpose: Debugging mode provides detailed error messages and debugging information, useful during development.

Risk: In a production environment, it exposes sensitive information and vulnerabilities, making the system more susceptible to attacks.

Common Causes:

Configuration Changes: During testing or penetration testing, configurations might be altered to facilitate debugging. If not reverted, these changes can leave the system in a vulnerable state.

Oversight: Configuration changes might be overlooked during deployment.

Best Practices:

Deployment Checklist: Ensure a checklist is followed that includes reverting any debug configurations before moving to production.

Configuration Management: Use configuration management tools to track and manage changes.

References from Pentesting Literature:

The importance of reverting configuration changes is highlighted in penetration testing guides to prevent leaving systems in a vulnerable state post-testing.

HTB write-ups often mention checking and ensuring debugging modes are disabled in production environments.

Using dig with a wordlist to identify subdomains is an effective method for subdomain enumeration. The command cat wordlist.txt | xargs -n 1 -I ' X ' dig X.mydomain.com reads each line from wordlist.txt and performs a DNS lookup for each potential subdomain.

Command Breakdown:

cat wordlist.txt: Reads the contents of wordlist.txt, which contains a list of potential subdomains.

xargs -n 1 -I ' X ' : Takes each line from wordlist.txt and passes it to dig one at a time.

dig X.mydomain.com: Performs a DNS lookup for each subdomain.

Why This is the Best Choice:

Efficiency: xargs efficiently processes each line from the wordlist and passes it to dig for DNS resolution.

Automation: Automates the enumeration of subdomains, making it a practical choice for large lists.

Benefits:

Automates the process of subdomain enumeration using a wordlist.

Efficiently handles a large number of subdomains.

References from Pentesting Literature:

Subdomain enumeration is a critical part of the reconnaissance phase in penetration testing. Tools like dig and techniques involving wordlists are commonly discussed in penetration testing guides.

HTB write-ups often detail the use of similar commands for efficient subdomain enumeration.

Step-by-Step ExplanationReferences:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

======

1. Reflected XSS - Input sanitization ( < > ...)

2. Sql Injection Stacked - Parameterized Queries

3. DOM XSS - Input Sanitization ( < > ...)

4. Local File Inclusion - sandbox req

5. Command Injection - sandbox req

6. SQLi union - paramtrized queries

7. SQLi error - paramtrized queries

8. Remote File Inclusion - sandbox

9. Command Injection - input saniti $

10. URL redirect - prevent external calls

The correct answer is B. Provide the customer with a list of the changes made.

At the end of a penetration test, the tester must support post-engagement cleanup and restoration. To verify that exploited systems have been returned to their original state, the tester should provide the customer with a complete list of changes made during the engagement. This allows the client to confirm that all modifications, deployed tools, payloads, accounts, configuration changes, scripts, files, and other artifacts have been removed or restored appropriately.

A is incorrect because terminating a command-and-control payload addresses only one possible artifact. It does not verify that all exploited systems have been restored to preengagement conditions.

C is incorrect because restoring environment variables may be part of cleanup, but it is too narrow and only applies if environment variables were changed.

D is incorrect because reimaging a system is disruptive and may not be necessary. It should only be done if required by the client’s recovery process or if restoration cannot be otherwise verified.

In PenTest+ terms, this falls under Reporting and Communication, specifically post-engagement cleanup, restoration validation, documentation of changes, and client handoff.

A peer review ensures the accuracy, completeness, and objectivity of a penetration test report.

Option A (Risk analysis) ❌: Helps prioritize vulnerabilities but does not validate report accuracy.

Option B (Peer review) ✅: Correct.

Ensures report accuracy and consistency.

Identifies misinterpretations or missing details.

Option C (Root cause analysis) ❌: Helps in remediation but does not verify report quality.

Option D (Client acceptance) ❌: A client review is final verification, but peer review happens earlier to ensure accuracy.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Reporting & Quality Assurance

RFID cloning involves copying data from an existing access card to create a duplicate badge. Attackers use tools like Proxmark3 or Flipper Zero to capture and replicate RFID signals.

Option A (Smurfing) ❌: A DDoS attack technique, unrelated to physical security.

Option B (Credential stuffing) ❌: Uses compromised usernames/passwords, not RFID badges.

Option C (RFID cloning) ✅: Correct. Creates a duplicate access badge using RFID technology.

Option D (Card skimming) ❌: Steals credit card data, but does not duplicate RFID badges.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Physical Security Testing & RFID Cloning

Scapy is a powerful interactive Python-based packet manipulation tool used by penetration testers to create, modify, send, and analyze custom packets. It supports many protocols and allows you to set TCP flags, sequence numbers, and more.

tcprelay is used to redirect TCP traffic, not to craft packets.

Bluecrack is used for cracking Bluetooth encryption, irrelevant in this context.

tcpdump is a packet capture tool, not suitable for crafting or injecting packets.

Web shells provide remote access and persistence for attackers. The best mitigation is to remove persistence mechanisms.

Remove the persistence mechanisms (Option A):

Attackers often modify startup scripts, cron jobs, or registry keys to maintain access.

If persistence is not removed, even after the web shell is deleted, attackers can reinstall or reaccess it.