PenTest+ PT0-003 Syllabus Exam Questions Answers

To reenter the system remotely after the patch for the recently exploited RCE vulnerability has been deployed, the penetration tester can use schtasks.exe and sc.exe.

schtasks.exe:

Purpose: Used to create, delete, and manage scheduled tasks on Windows systems.

Persistence: By creating a scheduled task, the tester can ensure a script or program runs at a specified time, providing a persistent backdoor.

Example:

schtasks /create /tn "Backdoor" /tr "C:\path\to\backdoor.exe" /sc daily /ru SYSTEM

sc.exe:

Purpose: Service Control Manager command-line tool used to manage Windows services.

Persistence: By creating or modifying a service to run a malicious executable, the tester can maintain persistent access.

Example:

sc create backdoor binPath= "C:\path\to\backdoor.exe" start= auto

Other Utilities:

rundll.exe: Used to run DLLs as applications, not typically used for persistence.

cmd.exe: General command prompt, not specifically used for creating persistence mechanisms.

chgusr.exe: Used to change install mode for Remote Desktop Session Host, not relevant for persistence.

netsh.exe: Used for network configuration, not typically used for persistence.

Pentest References:

Post-Exploitation: Establishing persistence is crucial to maintaining access after initial exploitation.

Windows Tools: Understanding how to leverage built-in Windows tools like schtasks.exe and sc.exe to create backdoors that persist through reboots and patches.

By using schtasks.exe and sc.exe, the penetration tester can set up persistent mechanisms that will allow reentry into the system even after the patch is applied.

=================

For electronic locking mechanisms, traditional lock picking is ineffective. Instead, bypassing techniques are often used, such as:

Triggering the emergency release.

Using a shim or bypass tool.

Exploiting wiring faults or RFID vulnerabilities.

This method doesn’t involve human deception (impersonation), social engineering (tailgating), or causing interference (jamming). It focuses on exploiting the electronic door system without needing to "unlock" it traditionally.

CompTIA PenTest+ Reference:

PT0-003 Objective 1.3: Given a scenario, perform a physical assessment.

CompTIA emphasizes the distinction between bypassing and other physical intrusion methods.

Shoulder surfing es el método más efectivo en este contexto. Cuando los ejecutivos trabajan en lugares públicos como trenes, un atacante puede visualizar sus pantallas sin ser detectado para recopilar datos confidenciales.

Credential harvesting requiere phishing o explotación directa. Bluetooth spamming y MFA fatigue no aplican directamente en un entorno de observación física.

Referencia: PT0-003 Objective 2.1 – Social engineering and physical observation methods.

Command Explanation:

The sc config command is used to configure service startup settings in Windows. Using start=disabled will permanently disable a specific service, effectively turning off protections such as antivirus or other monitoring services.

Why Not Other Options?

B (sc query state= all): This command lists all services and their states but does not disable or modify any service.

C (pskill): This command is used to terminate a process temporarily, but it does not permanently disable the service.

D (net config): This command is used for configuring network settings, not for managing services.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Windows Service Exploitation Guidelines