A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?

• A.Run nmap with the -o, -p22, and -sC options set against the target
• B.Run nmap with the -sA option set against the target
• C.Run nmap with the -sV and -p22 options set against the target
• D.Run nmap with the --script vulners option set against the target

Comment: *

Name: *

Email: *

Verification: *

A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant.
The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?

• A.Supervisory systems will detect a malicious injection of code/commands.
• B.PLCs will not act upon commands injected over the network.
• C.Supervisors and controllers are on a separate virtual network by default.
• D.Controllers will not validate the origin of commands.

Comment: *

Name: *

Email: *

Verification: *

A penetration tester writes the following script:

Which of the following objectives is the tester attempting to achieve?

• A.Determine active hosts on the network.
• B.Fill the ARP table of the networked devices.
• C.Scan the system on the most used ports.
• D.Set the TTL of ping packets for stealth.

Comment: *

Name: *

Email: *

Verification: *

A penetration tester runs a scan against a server and obtains the following output:
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-12-20 09:23AM 331 index.aspx
| ftp-syst:
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2012 Std
3389/tcp open ssl/ms-wbt-server
| rdp-ntlm-info:
| Target Name: WEB3
| NetBIOS_Computer_Name: WEB3
| Product_Version: 6.3.9600
|_ System_Time: 2021-01-15T11:32:06+00:00
8443/tcp open http Microsoft IIS httpd 8.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
Which of the following command sequences should the penetration tester try NEXT?

• A.nmap --script vuln -sV 192.168.53.23
• B.ftp 192.168.53.23
• C.curl -X TRACE https://192.168.53.23:8443/index.aspx
• D.ncrack -u Administrator -P 15worst_passwords.txt -p rdp 192.168.53.23
• E.smbclient \\\\WEB3\\IPC$ -I 192.168.53.23 -U guest

Comment: *

Name: *

Email: *

Verification: *

A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?

• A.MP4 steganography
• B.Alternate data streams
• C.PsExec
• D.PowerShell modules

Comment: *

Name: *

Email: *

Verification: *