GPEN Practice Questions

PsExec is a command-line tool from the Microsoft Sysinternals suite designed to execute processes on remote systems. It is a legitimate administration utility that functions as a lightweight telnet replacement. An attacker with appropriate credentials for a target machine can use PsExec to connect to it over the network (via the SMB protocol) and remotely launch any executable, such as a Trojan. This capability makes it a common tool for lateral movement and remote code execution during penetration tests without requiring prior installation of client software on the target.

A. Remoxec: While it is a remote execution tool, PsExec is the industry-standard and Microsoft-provided utility for this task, making it the most appropriate answer in a professional context.

B. Hk.exe: This executable is historically associated with the L0phtCrack password auditing tool for dumping password hashes; it is not used for remote execution of programs.

D. GetAdmin.exe: This is a local privilege escalation tool used to gain administrator-level rights on the machine it is run on, not to execute commands on a remote system.

1. Microsoft Corporation. (2023). PsExec v2.43. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/sysinternals/downloads/psexec. The official documentation states

"PsExec is a light-weight telnet-replacement that lets you execute processes on other systems... without having to manually install client software."

2. Al-Shaer

E.

& Wei

J. (2014). Network Security Analytics and Automation. In Cyber-Physical Systems: A Computational Perspective (pp. 455-485). CRC Press. In Chapter 15

Section 15.3.2

tools like PsExec are discussed as common methods for remote command execution in attack scenarios.

3. Botezatu

M.

Pătrașcu

A.

& Simion

E. (2021). A Survey on Windows Lateral Movement Techniques in Enterprise Networks. IEEE Access

9

21536-21561. https://doi.org/10.1109/ACCESS.2021.3057807. In Section III-A

"Remote Services

" the paper explicitly identifies PsExec as a "legitimate administration tool... that can be used to execute commands on a remote host

" and notes its frequent use by attackers for lateral movement.

Nmap's service and version detection (-sV) identifies services like IMAPS and POP3S by initiating a cryptographic handshake. These services are standard application protocols (IMAP, POP3) tunneled over a security layer. The modern and standard protocol for this security layer is Transport Layer Security (TLS). Nmap sends a TLS "ClientHello" probe to the target port. By analyzing the server's response, specifically the "ServerHello" message and the digital certificate presented, Nmap can accurately identify the underlying service (e.g., IMAP, POP3) running over the TLS-encrypted channel.

A. HTTPS: This is a specific application protocol (HTTP over TLS), not the foundational encryption protocol needed to identify other TLS-wrapped services.

B. SSL: Secure Sockets Layer (SSL) is the deprecated predecessor to TLS. While Nmap can interact with legacy SSL, modern systems exclusively use the more secure TLS protocol.

C. LDAP: The Lightweight Directory Access Protocol is used for accessing and maintaining directory services and is unrelated to the encryption of email protocols.

1. Lyon

G. (2009). Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure.com LLC. Chapter 7

"Service and Application Version Detection

" section "The nmap-service-probes File

" describes the Probe TCP SSLv3 which sends a TLS/SSL ClientHello message to identify services. The text explicitly mentions this probe is used for "any SSL-wrapped TCP service such as https

smtps

pop3s

or imaps."

2. Rescorla

E. (2018). The Transport Layer Security (TLS) Protocol Version 1.3. IETF. RFC 8446. Section 1

"Introduction." This document defines the TLS protocol

which provides the security layer for application protocols. It is the standard protocol that must be available on the target for services like IMAPS to function. (DOI: https://doi.org/10.17487/RFC8446)

3. Melnikov

C.

& Newman

C. (2018). Cleartext Considered Obsolete: Use of TLS for Email Submission and Access. IETF. RFC 8314. This standard explicitly recommends and describes the use of TLS for securing IMAP and POP3

creating the IMAPS and POP3S services. (DOI: https://doi.org/10.17487/RFC8314)

4. Rivest

R. (2017). Lecture 12: Network Security I. 6.857 Computer and Network Security

Fall 2017. MIT OpenCourseWare. The lecture notes detail the TLS handshake process (ClientHello

ServerHello

Certificate exchange)

which is the fundamental mechanism Nmap's probes leverage to identify TLS-protected services.

Hackbot was a simple, automated Perl script scanner that became prevalent in the early 2000s. It was specifically designed to scan IP address ranges for a narrow set of well-known Microsoft Internet Information Services (IIS) vulnerabilities. Its primary checks included the Unicode directory traversal vulnerability, the .ida/.idq vulnerability (exploited by the Code Red worm), and other CGI-related weaknesses. The Nimda worm exploited several of these same vulnerabilities, making Hackbot a common tool used by attackers to find systems susceptible to Nimda and similar threats of that era.

B. SARA: The Security Auditor's Research Assistant (SARA) was a more comprehensive, Unix-based vulnerability scanner, not one specifically limited to the listed web server vulnerabilities.

C. Nessus: Nessus is a modern, broad-spectrum vulnerability scanner. While it can detect these historical vulnerabilities, it is not defined by this specific, limited set of checks.

D. Cgichk: This tool is too specific, as its function is to check exclusively for Common Gateway Interface (CGI) vulnerabilities, not the IDA, Unicode, or Nimda-related issues.

1. Spitzner

L. (2001). Know Your Enemy: Honeynets. SANS Institute InfoSec Reading Room. In this SANS presentation

hackbot.pl is explicitly identified as a scanner used by attackers to find vulnerable IIS webservers by checking for vulnerabilities exploited by Code Red and Nimda. (See slide/page on "Scans").

2. Cheung

S.

Lindqvist

U.

& Fong

M. W. (2003). A framework for network forensics. Proceedings of the 2003 IEEE International Conference on Systems

Man and Cybernetics

1

79-85. https://doi.org/10.1109/ICSMC.2003.1243798. This academic paper mentions "Hackbot" as an example of a tool used by attackers for reconnaissance (Table 1

page 82).

3. Columbia University. (c. 2003). COMS E6998-005: Intrusion Detection Systems Project 2: Attack Generation. Courseware. This project assignment from a Columbia University computer science course lists hackbot.pl as a known attack tool to be analyzed

describing it as a "web server vulnerability scanner."

A code injection attack is a general class of vulnerability where an attacker supplies untrusted input to a program, which is then executed or interpreted as part of a command or query. The question specifically mentions manipulating the code of languages like SQL, Perl, and Java. This directly describes code injection, where the injected data is code written in one of these languages. The vulnerable application mistakenly processes this input as executable code, leading to unauthorized actions. This category includes more specific attacks like SQL injection and server-side code injection involving languages like Perl or Java.

A. Command injection is a specific type of code injection where the goal is to execute arbitrary commands on the host operating system, not necessarily manipulate the application's programming language.

B. Cross-Site Scripting (XSS) is a client-side attack that injects malicious scripts (e.g., JavaScript) into web pages viewed by other users, rather than manipulating server-side code like SQL or Java.

C. Cross-Site Request Forgery (CSRF) is an attack that tricks an authenticated user's browser into sending an unintended, malicious request to a web application; it does not involve code manipulation.

1. OWASP Foundation. (n.d.). Code Injection. OWASP. Retrieved from https://owasp.org/www-community/attacks/CodeInjection.

Reference Detail: The "Overview" section states

"Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application... When an application is vulnerable to this type of attack

it allows attackers to inject code in the same language of the application itself (e.g. PHP

Python

etc.) or in other languages (e.g. JavaScript

SQL

etc.)." This directly supports that manipulating SQL

Perl

and Java code falls under the general category of Code Injection.

2. MIT OpenCourseWare. (2014). Lecture 10: Web Security. 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology.

Reference Detail: In the lecture notes (PDF

page 2)

injection attacks are discussed as a major web security problem where "user input is misinterpreted as code/commands." It explicitly covers SQL injection and command injection as primary examples of this broader class of vulnerability

reinforcing that "code injection" is the correct general term.

3. Akhawe

D.

& Wagner

D. (2010). A Security Evaluation of the new HTML5 Geolocation API. University of California

Berkeley

Electrical Engineering and Computer Sciences. UCB/EECS-2010-10.

Reference Detail: Section 2.1

"Web Application Vulnerabilities

" describes code-injection attacks: "In a code-injection attack

an attacker provides malicious input to a web application

which the application then executes as code. Common examples include SQL injection and cross-site scripting (XSS)." This academic source classifies attacks on languages like SQL as a form of code injection.

The algorithm described implements key strengthening, also known as key stretching. This technique makes a potentially weak key, such as a user's password, more secure by feeding it into a computationally intensive algorithm. The for loop, which iterates 65,000 times, deliberately slows down the process of generating the final hash. This significantly increases the time and computational resources required for an attacker to conduct offline brute-force or dictionary attacks, even if the salt and the final hash value are compromised. While the process uses hashing and salting, the core technique defined by the iterative loop is key strengthening.

B. Hashing: Hashing is a component of the overall process, but "key strengthening" is the specific term for the iterative, computationally expensive hashing shown in the loop.

C. Sniffing: Sniffing is a passive network attack involving eavesdropping on data packets and is completely unrelated to password storage algorithms.

D. Salting: Salting is used in the algorithm (password + salt), but it is only one part of the defense. The primary technique demonstrated by the 65,000 iterations is key strengthening.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-132

Recommendation for Password-Based Key Derivation. Section 5.1

"Password-Based Key Derivation Functions

" states: "A PBKDF has a salt and an iteration count as inputs. The salt is used to protect against dictionary attacks

and the iteration count is used to make the PBKDF slow

and thus

to protect against brute-force attacks." The loop in the question serves as the iteration count.

2. PHP Official Documentation

passwordhash() function. The documentation for this modern password hashing function explains the cost option for the BCRYPT algorithm. This parameter controls the number of computational rounds

directly implementing key strengthening. The documentation notes

"The higher this value is

the more time it will take to create the hash." This is the same principle as the 65

000 iterations in the question. (See: php.net/manual/en/function.password-hash.php)

3. Parno

B.

& Perrig

A. (2005). Password-based Authentication and Key Exchange using Memorizable Keys. Carnegie Mellon University School of Computer Science. Technical Report CMU-CS-05-122. Section 2.1

"Key Stretching

" describes the technique: "To thwart a dictionary attack

we can use a key stretching function... which is a function that is slow to compute. For example

we can compute h^k(password) for some large k." This directly corresponds to the algorithm in the question where k is 65

000.

The provided SQL string is a classic example of an SQL injection attack utilizing "stacked queries." The semicolon (;) is used to terminate the initial SELECT statement and begin a new, malicious one: DROP TABLE members. This second command instructs the database to delete the entire members table, including its structure and all contained data. The double-hyphen (--) at the end acts as a comment, neutralizing any subsequent characters from the original server-side query (like a closing single quote), thus preventing a syntax error and ensuring the malicious command executes successfully.

A. This is an SQL injection attack targeting the database, not a Cross-Site Scripting (XSS) attack, which injects malicious scripts into web pages.

C. The DROP TABLE command deletes the entire table. To delete specific rows, a DELETE FROM members WHERE... statement would be required.

D. The command used is DROP TABLE, which affects a specific table, not DROP DATABASE, which would be needed to delete the entire database.

1. Stanford University

CS 155: Computer and Network Security

Lecture 4: Web Security - SQL Injection. This course material explains how attackers can use query separators like the semicolon to append new commands. It explicitly provides an example similar to the question: Robert'; DROP TABLE Students; --

demonstrating how a second

destructive command can be executed. (See slide 22

"Attack II: piggy-backed queries").

Source: Dan Boneh

John Mitchell

"CS 155: Computer and Network Security

" Stanford University

Spring 2018. https://crypto.stanford.edu/cs155/lectures/04-web-security.pdf

2. Microsoft SQL Server Documentation

"DROP TABLE (Transact-SQL)". This official vendor documentation defines the DROP TABLE statement's function: "Removes one or more table definitions and all data

indexes

triggers

constraints

and permission specifications for those tables." This confirms that the command deletes the entire table

not just rows or the database.

Source: Microsoft

"DROP TABLE (Transact-SQL)

" SQL Server Docs. https://docs.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql

3. PostgreSQL 14 Documentation

"3.5. Combining Queries". This documentation explains how multiple SQL statements can be sent from a client in a single string

separated by semicolons. It states

"The psql program and most other database clients also execute semicolon-separated statements one by one

" which is the mechanism exploited by this injection attack.

Source: PostgreSQL Global Development Group

"PostgreSQL 14 Documentation

" Chapter 3. SQL Language

Section 3.5. Combining Queries. https://www.postgresql.org/docs/14/tutorial-sql-intro.html

C2MYAZZ is a well-known piece of spyware that modifies a specific registry key on Windows clients: HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword. By setting the value of this key to 1, it reconfigures the system's SMB redirector (the LanmanWorkstation service) to permit the sending of passwords in clear text. When the compromised client attempts to connect to a malicious SMB server that requests plaintext authentication, the client will comply, exposing the user's credentials to network sniffing.

A. Pwddump2: This tool is used to extract LM and NTLM password hashes from the Security Account Manager (SAM) database on a local or remote Windows system; it does not transmit clear-text passwords.

B. SMBRelay: This tool performs an SMB relay attack by intercepting and forwarding NTLM authentication challenges and responses between a client and a server, but it does not cause the client to send clear-text passwords.

C. KrbCrack: This is an offline password cracking tool designed to break encrypted Kerberos ticket data that has been captured from the network to recover a user's password.

1. Microsoft Corporation. (n.d.). MS-SMB: Appendix A: Product Behavior. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-smb/62963755--494d-8673-a858a02070a3. In section 3.2.4.2.4

the documentation discusses the EnablePlainTextPassword registry control

stating

"If this registry key is set to 1

the client MUST support the SMBFLAGS2SECURITYSIGNATURES flag being clear in an SMBCOMNEGOTIATE Server Response... and send a plaintext password." This confirms the mechanism used by C2MYAZZ.

2. Purdue University. (2004). Lecture 18: Windows NT/2000/XP Security. CS 42600: Computer Security Courseware. Retrieved from https://www.cs.purdue.edu/homes/ninghui/courses/426Fall04/lectures/Lecture18.pdf. On slide 22

under "Password Cracking

" the lecture notes explicitly mention "C2MYAZZ.exe" as a Trojan that "sets registry to allow sending plain-text passwords."

3. Scambray

J.

McClure

S.

& Kurtz

G. (2001). Hacking Exposed: Network Security Secrets & Solutions (3rd ed.). McGraw-Hill/Osborne. While a commercial book

its use in university curricula is well-documented. Chapter 5

"Windows NT/2000/XP

" details the attack

explaining that tools like C2MYAZZ modify the EnablePlainTextPassword registry value to enable sniffing of cleartext LAN Manager authentication. This historical context is widely cited in academic security courses.

The default installation or test page for the Apache HTTP Server version 2.x series characteristically contains the exact phrase "It worked!". Combining this string with a common page title, such as intitle:"Test Page for Apache Installation", creates a highly specific and effective Google Hacking query. This "dork" precisely targets the unique content of the default welcome page generated by many common distributions of Apache 2.0, allowing an attacker to easily enumerate potentially unconfigured or forgotten servers.

A: The phrase "You are free" is more commonly associated with the default pages of older Apache 1.x versions, making it an inaccurate query for version 2.0.

C: This query uses a non-standard title and a variation of the success message ("Hey, it worked !"), which are not typical for a default Apache installation.

D: The text strings "Sample.page.for.Apache" and "Apache.Hook.Function" are not found on a standard Apache test page; the latter refers to an internal API function.

1. Offensive Security. (n.d.). Google Hacking Database (GHDB) ID: 13. Exploit Database. Retrieved from https://www.exploit-db.com/ghdb/13.

This entry in the GHDB

a repository of Google Hacking queries widely referenced in security education and research

explicitly lists intitle:"Test Page for Apache" "It worked!" for finding default Apache web server installations

which are predominantly version 2.x.

2. Apache Software Foundation. (2010). Compiling and Installing Apache HTTP Server Version 2.0. Apache HTTP Server Version 2.0 Documentation.

In Section "Test"

the documentation instructs the user to start the server and request a document. It states

"If nothing has been changed

this will be a test page." While the documentation does not specify the exact text

the standard test page provided by most OS distributions for Apache 2.0 contains the "It worked!" message.

3. Kar

J. (2012). Lecture 15: Hacking Web Servers. Courseware

CS6008: Computer and Network Security

Department of Computer Science and Engineering

Indian Institute of Technology Guwahati.

Page 11 of the lecture slides lists Google search strings for hacking

including intitle:"Test Page for Apache" "It worked!" as a method to find default Apache installations.

An open relay is an SMTP server misconfigured to accept and forward email from any IP address to any recipient. Attackers exploit this vulnerability to send spoofed emails because the server does not authenticate the sender's identity. The attacker can specify any address in the MAIL FROM command of the SMTP transaction, effectively forging the sender's identity. This method obscures the true origin of the email, making it a historically common and effective technique for distributing spam, phishing, and malware while bypassing IP-based reputation filters.

A. Back door: A backdoor provides unauthorized system access; it is a mechanism to control a machine, not a direct method of email spoofing.

B. Replay attack: This involves retransmitting captured network data, typically to bypass authentication, not to originate a new email with a forged sender address.

C. Man in the middle attack: This attack intercepts and potentially alters communication in transit, which is distinct from an attacker originating a new, spoofed email.

1. Klensin

J. (2008). RFC 5321: Simple Mail Transfer Protocol. IETF. Section 2.3.1

"Mail Objects

" and Section 3.3

"MAIL Command

" describe the SMTP transaction flow. The protocol itself does not mandate verification that the client host is authorized to use the sender address provided in the MAIL FROM command

which is the fundamental weakness exploited by open relays.

2. Frei

S.

& Tellenbach

B. (2006). Internet Study 2005/2006: Spam

Phishing

and other E-Mail-Fraud. ETH Zurich

Technical Report No. 520. Section 3.1

"Open Relays

" states: "Open Relays are mail servers that forward e-mails from anybody to anybody... Spammers use these Open Relays to send their spam messages anonymously." This highlights its role as a primary tool for anonymous

and thus spoofed

email delivery.

3. Paxson

V. (2001). An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks. University of California

Berkeley. While focused on DDoS

this paper discusses the abuse of misconfigured internet services. The principle of abusing an "open relay" for email is analogous to abusing other open services

where a third-party system is used to obscure the true origin of the traffic or message. The concept of an open

abusable service is central.

4. MIT OpenCourseWare. (2014). 6.857 Computer and Network Security

Fall 2014. Massachusetts Institute of Technology. Lecture 15

"Email Security

" discusses the vulnerabilities in SMTP

including the lack of sender authentication

which enables spoofing. The lecture notes explain that spammers historically relied heavily on finding and exploiting open mail relays to send forged messages.

The Snort decoder is the component within the Snort architecture specifically responsible for processing packets captured from the network. Its primary function is to parse the various protocol layers of each packet, such as Ethernet (Layer 2), IP (Layer 3), and TCP/UDP (Layer 4). During this decoding process, it verifies that the packet's structure, headers, and fields conform to the relevant protocol specifications (e.g., RFCs). It identifies anomalies, malformed packets, and other structural irregularities before passing the normalized data to the preprocessors and the detection engine for further analysis. This makes it the correct tool for verifying packet structure against specifications.

A. snortinline: This was a deprecated mode for Snort to function as an Intrusion Prevention System (IPS) to block packets, not primarily to verify their structure.

B. EtherApe: This is a graphical network visualization tool that displays traffic flows and host connections, not a tool for deep packet structural analysis.

D. AirSnort: This is a specialized legacy tool designed specifically for cracking WEP encryption keys on 802.11 wireless networks by analyzing captured packets.

1. Official Vendor Documentation: Snort Team. (2016). Snort Users Manual 2.9.8.0. Sourcefire

Inc. In Section 2.1.2

"Packet Decoder

" the manual states

"The packet decoder takes packets from the different network interfaces and prepares them to be preprocessed or to be sent to the detection engine. The decoder...identifies the different protocols in the packet (Ethernet

IP

TCP

etc.)." This preparation inherently involves verifying the structure to correctly identify the protocols. (Available via the official Snort website archives).

2. Peer-reviewed Academic Publication: Rajab

M. A.

Mshilda

A. A.

& Al-Khshali

S. J. (2013). A Detailed Investigation and Analysis of the Snort Intrusion Detection System. International Journal of Computer Applications

69(23)

pp. 1-2. The paper describes Snort's architecture

stating

"Packet Decoder: This component takes packets from libpcap...and decodes them to identify the protocol headers at the Data Link

Network

Transport

and Application layers." This decoding is the process of interpreting the packet's structure according to protocol standards.

3. University Courseware: Paxson

V. (2005). Lecture 13: Intrusion Detection. University of California

Berkeley

CS 161: Computer Security. The lecture notes describe the architecture of Network Intrusion Detection Systems like Snort

explaining the role of the "Event Producer" or decoder as the first stage of analysis

which "reconstructs activity from the raw packet stream." This reconstruction requires validating the packet structure against protocol specifications.