CompTIA PT0-003 - CompTIA PenTest+ Exam

When Nmap is unavailable on a compromised host, PenTest+ expects testers to adapt by using native scripting (for example, PowerShell) to perform reconnaissance and port checks with built-in .NET classes such as System.Net.Sockets.TcpClient. To scan multiple ports, the script must iterate over two dimensions: the host range and the port list. In PowerShell, supplying a comma-separated list to a variable (for example, $port = 80,443,445) creates an array-like collection. The correct way to use that collection is to add a nested Foreach loop inside the existing loop that iterates through IPs, so each reachable host is tested against every port in the list.

Duplicating the socket block (A) is inefficient, error-prone, and does not scale as the number of ports grows. Option C is not the correct syntax for combining two enumerations in a single Foreach header; PowerShell requires a separate loop (or pipeline) to iterate ports. Therefore, adding a second Foreach directly beneath the current one and enclosing the socket logic within it best achieves the intended multi-port scanning behavior.

If a penetration tester gains access to a host but does not have a shell, the best tool for further enumeration is Netcat. Here’s why:

Netcat:

Versatility: Netcat is known as the " Swiss Army knife " of networking tools. It can be used for port scanning, banner grabbing, and setting up reverse shells.

Enumeration: Without a shell, Netcat can help enumerate open ports and services running on the host, providing insight into the host ' s environment.

Comparison with Other Tools:

ProxyChains: Used to chain proxies together, not directly useful for enumeration without an initial shell.

PowerShell ISE: Requires a shell to execute commands and scripts.

Process IDs: Without a shell, enumerating process IDs directly isn’t possible.

Netcat’s ability to perform multiple network-related tasks without needing a shell makes it the best choice for further enumeration.

======

If a wireless network lacks proper encryption, attackers can inject malicious packets into the traffic stream.

Packet injection (Option A):

Attackers forge and transmit fake packets to manipulate network behavior.

Common in WEP/WPA attacks to force IV collisions or spoof DHCP responses.

A kiosk escape involves breaking out of a restricted environment, such as a kiosk or a single application interface, to access the underlying operating system. Here’s why option A is correct:

Kiosk Escape: This attack targets environments where user access is intentionally limited, such as a kiosk or a dedicated application. The goal is to break out of these restrictions and gain access to the full operating system.

Arbitrary Code Execution: This involves running unauthorized code on the system, but the scenario described is more about escaping a restricted environment.

Process Hollowing: This technique involves injecting code into a legitimate process, making it appear benign while executing malicious activities.

Library Injection: This involves injecting malicious code into a running process by loading a malicious library, which is not the focus in this scenario.

References from Pentest:

Forge HTB: Demonstrates techniques to escape restricted environments and gain broader access to the system​​.

Horizontall HTB: Shows methods to break out of limited access environments, aligning with the concept of kiosk escape​​.

Conclusion:

Option A, Kiosk escape, accurately describes the type of attack where a tester breaks out of a restricted environment to access the underlying operating system.

======

To further enumerate users on a Windows machine using native operating system commands, the tester should use net.exe commands. The net command is a versatile tool that provides various network functionalities, including user enumeration.

net.exe:

net user: This command displays a list of user accounts on the local machine.

net user

net localgroup: This command lists all local groups, and by specifying a group name, it can list the members of that group.

net localgroup administrators

Enumerating Users:

List All Users: The net user command provides a comprehensive list of all user accounts configured on the system.

Group Memberships: The net localgroup command can be used to see which users belong to specific groups, such as administrators.

Pentest References:

Post-Exploitation: After gaining initial access, enumerating user accounts helps understand the structure and potential targets for privilege escalation.

Windows Commands: Leveraging built-in commands like net for enumeration ensures that no additional tools need to be uploaded to the target system, reducing the risk of detection.

Using net.exe commands, the penetration tester can effectively enumerate user accounts and group memberships on the compromised Windows machine, aiding in further exploitation and privilege escalation.

======

By running the command findstr /SIM /C: " pass " *.txt *.cfg *.xml, the penetration tester is trying to enumerate secrets.

Command Analysis:

findstr: A command-line utility in Windows used to search for specific strings in files.

/SIM: Combination of options; /S searches for matching files in the current directory and all subdirectories, /I specifies a case-insensitive search, and /M prints only the filenames with matching content.

/C: " pass " : Searches for the literal string " pass " .

***.txt .cfg .xml: Specifies the file types to search within.

Objective:

The command is searching for the string " pass " within .txt, .cfg, and .xml files, which is indicative of searching for passwords or other sensitive information (secrets).

These file types commonly contain configuration details, credentials, and other sensitive data that might include passwords or secrets.

Other Options:

Configuration files: While .cfg and .xml files can be configuration files, the specific search for " pass " indicates looking for secrets like passwords.

Permissions: This command does not check or enumerate file permissions.

Virtual hosts: This command is not related to enumerating virtual hosts.

Pentest References:

Post-Exploitation: Enumerating sensitive information like passwords is a common post-exploitation activity after gaining initial access.

Credential Discovery: Searching for stored credentials within configuration files and documents to escalate privileges or move laterally within the network.

By running this command, the penetration tester aims to find stored passwords or other secrets that could help in further exploitation of the target system.

======

An HTTP 403 Forbidden response indicates the server understood the request but is refusing to authorize it. In PenTest+ web assessment context, a common cause is an access control requirement at the web server or reverse proxy layer—such as mutual TLS (mTLS) / client certificate authentication, IP allowlisting, or other authorization gates—preventing the tester from reaching the application content. When a site is configured to require a client certificate, the server may return a 403-class error if the request does not include a trusted certificate chain, because the client cannot be authenticated to an approved identity. Therefore, obtaining and presenting a valid X.509 client certificate (issued by a trusted CA for that environment or provided by the client as part of the engagement) is the appropriate step to satisfy the access requirement and proceed with testing.

Resetting server file permissions is an administrative remediation action outside a tester’s role and scope. Spoofing a server MAC address is not meaningful for HTTP access and typically not possible across routed networks. Using a legacy browser addresses client-side compatibility, not server-side authorization decisions that produce 403.

When the objective is to identify hosts while minimizing the chance of triggering an IPS, PenTest+ prioritizes low-noise reconnaissance techniques over active probing. A reverse DNS lookup queries DNS PTR records for IP addresses and can reveal hostnames for systems that are already registered in internal DNS. This often generates traffic that appears similar to normal enterprise name-resolution activity and is typically less suspicious than broad ICMP echo sweeps or repeated port probes.

An Nmap ping sweep is an overt discovery action that sends ICMP (and sometimes ARP/other probes) across a range and is more likely to be detected or rate-limited by monitoring and IPS controls. LLMNR poisoning with Responder is an active interception/credential capture technique that can be highly detectable and is not simply “host identification.” Viewing the local routing table is very quiet, but it primarily reveals networks and routes, not a list of live hosts on the segment. Therefore, reverse DNS lookups are the most logical balance of effectiveness and stealth for identifying hosts.

Windows provides built-in utilities for user enumeration and privilege escalation.

net command (Option C):

The net command is used to list users, groups, and shares on a Windows system:

net user

net localgroup administrators

net group " Domain Admins " /domain

Useful for gathering privilege escalation targets and understanding user permissions.

The correct answer is D. Find the SYSVOL share for hashes with findstr /i and decrypt using the published key.

Group Policy Preferences previously allowed administrators to store local user passwords in Group Policy XML files inside the domain’s SYSVOL share. These passwords were stored as cpassword values. Although encrypted, Microsoft published the AES key used to decrypt them, which means anyone with domain access could potentially retrieve and decrypt those credentials.

Because SYSVOL is commonly readable by authenticated domain users, a compromised domain-joined endpoint can be used to search SYSVOL for Group Policy Preference XML files containing cpassword values. Once decrypted, these credentials may provide local administrator access across multiple domain-joined systems, making this a fast method for pivoting to production servers.

A is incorrect because scanning the domain controller for remote code execution is noisy, risky, and not the fastest or best approach when Group Policy Preferences already expose a known credential-recovery path.

B is incorrect because password spraying with Hydra is slower, noisier, and may trigger account lockouts or detection. The scenario points specifically to Group Policy Preferences, which suggests credential recovery from SYSVOL.

C is incorrect because BloodHound is useful for identifying Active Directory attack paths, but it is not the fastest option when exploitable Group Policy Preference credentials are already known to be present.

In PenTest+ terms, this falls under Attacks and Exploits, specifically Active Directory post-exploitation, credential discovery, Group Policy Preferences abuse, and lateral movement.