Block 1 Practical Quiz

Block 1 Practical Quiz

Ingest the Bloodhound data. What attack is the user ‘white.beard’ vulnerable to?

1: Ingest the Bloodhound data. What attack is the user ‘white.beard’ vulnerable to?

Kerberoast

ASRepRoast

Constrained Delegation

Unconstrained Delegation

Ingest the Bloodhound data. Find a chain from Pedro to htb-svc$. What is the second DACL in this chain?

2: Ingest the Bloodhound data. Find a chain from Pedro to htb-svc$. What is the second DACL in this chain?

GenericAll

GenericWrite

AllExtendedRights

ForceChangePassword

Read the source code of upload.php. Which of the following filenames will bypass the filters AND allow RCE?

3: Read the source code of upload.php. Which of the following filenames will bypass the filters AND allow RCE?

cat.php.jpg

cat.php5

cat.php

cat.jpg.phar

Read the linpeas.1.txt file. How can the user escalate privileges?

4: Read the linpeas.1.txt file. How can the user escalate privileges?

Install a malicious kernel module

Exploit a service

Create a cronjob

Create a new container and mount the root filesystem

Read the vncregistry file. What is the decrypted password?

5: Read the vncregistry file. What is the decrypted password?

VNCPass1

VNCVNC12

Secure!

Passw0rd

Read the lfi.php source code. Which of the following LFI payloads would succeed?

6: Read the lfi.php source code. Which of the following LFI payloads would succeed?

../../../../../etc/passwd

..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

..//..//..//..//..//etc//passwd

....//....//....//....//....//....//etc/passwd

Consider the ldapdomaindump output. Which ASRep-Roastable user is also a domain admin?

7: Consider the ldapdomaindump output. Which ASRep-Roastable user is also a domain admin?

Yolanda Groce

Brian Davis

PROXYAGENT

Matthew Morgan

Consider the ldapdomaindump output. How many computers can each user add to the domain?

8: Consider the ldapdomaindump output. How many computers can each user add to the domain?

10

5

0

8

Consider the crontab file. When is the next time the backup script will run?

9: Consider the crontab file. When is the next time the backup script will run?

10:43 on the 8th of May

10:43 on the 5th of August

6:47 on Sunday

6:52 tomorrow

Consider the linpeas.2.txt file. Which binary can the user use to read privileged files?

10: Consider the linpeas.2.txt file. Which binary can the user use to read privileged files?

vim.basic

perl

python

base64

Extract hashes from lsass.dmp. What is Jordan's SHA1 hash?

11: Extract hashes from lsass.dmp. What is Jordan's SHA1 hash?

369b6cc895433f5534f0a23b3025266ab515a581

9097a5a64cd1d1d79dce421bc5e934c4d2b6f4a7

cba4e545b7ec918129725154b29f055e4cd5aea8

77ba9cd915c8e359d9733edcfe9c61e5aca92afb

Consider the group file. How many users can create containers (not including root)?

12: Consider the group file. How many users can create containers (not including root)?

1

2

3

4

Consider the passwd and shadow files. What is the root user's password?

13: Consider the passwd and shadow files. What is the root user's password?

password

kali

password123

qwertyuiop

Consider the icacls output. What privileges do all users have?