nerdexam
CompTIA

PT0-001 · Question #5

A penetration tester has gained access to a marketing employee's device. The penetration tester wants to ensure that if the access is discovered, control of the device can be regained. Which of the…

The correct answer is A. Place an entry in HKLM\Software\Microsoft\CurrentVersion\Run to call au57d.ps1. E. Place an entry for RTAudio in HKLM\CurrentControlSet\Services\RTAudio. Maintaining persistence on a compromised Windows device requires mechanisms that automatically re-execute a payload on reboot or system event. Registry Run keys and auto-starting services are two classic methods for achieving this.

Post-exploitation and lateral movement

Question

A penetration tester has gained access to a marketing employee's device. The penetration tester wants to ensure that if the access is discovered, control of the device can be regained. Which of the following actions should the penetration tester use to maintain persistence to the device? (Select TWO.)

Options

  • APlace an entry in HKLM\Software\Microsoft\CurrentVersion\Run to call au57d.ps1.
  • BPlace an entry in C:\windows\system32\drivers\etc\hosts for 12.17.20.10 badcomptia.com.
  • CPlace a script in C:\users%username\local\appdata\roaming\temp\au57d.ps1.
  • DCreate a fake service in Windows called RTAudio to execute manually.
  • EPlace an entry for RTAudio in HKLM\CurrentControlSet\Services\RTAudio.
  • FCreate a schedule task to call C:\windows\system32\drivers\etc\hosts.

How the community answered

(42 responses)
  • A
    71% (30)
  • B
    14% (6)
  • C
    2% (1)
  • D
    2% (1)
  • F
    10% (4)

Why each option

Maintaining persistence on a compromised Windows device requires mechanisms that automatically re-execute a payload on reboot or system event. Registry Run keys and auto-starting services are two classic methods for achieving this.

APlace an entry in HKLM\Software\Microsoft\CurrentVersion\Run to call au57d.ps1.Correct

The HKLM\Software\Microsoft\CurrentVersion\Run registry key causes any listed executable or script to run automatically each time the system starts, ensuring the payload (au57d.ps1) is re-executed after reboots without user interaction.

BPlace an entry in C:\windows\system32\drivers\etc\hosts for 12.17.20.10 badcomptia.com.

Modifying the hosts file maps a hostname to a specific IP address for DNS spoofing or traffic redirection, which is not a persistence mechanism and does not re-establish access to the device.

CPlace a script in C:\users\%username\local\appdata\roaming\temp\au57d.ps1.

Placing a script file in the AppData\Roaming\Temp directory merely stores the file on disk - without a trigger such as a registry key, scheduled task, or service, the script will never execute automatically.

DCreate a fake service in Windows called RTAudio to execute manually.

Creating a service configured for manual execution means it only runs when explicitly started by a user or process, providing no automatic re-establishment of access after a reboot or after the session is discovered.

EPlace an entry for RTAudio in HKLM\CurrentControlSet\Services\RTAudio.Correct

Adding an entry under HKLM\CurrentControlSet\Services\RTAudio configures a Windows service that can be set to start automatically at boot, providing persistent execution while blending in with legitimate audio service names to avoid detection.

FCreate a schedule task to call C:\windows\system32\drivers\etc\hosts.

The hosts file is a static text configuration file and cannot be invoked as an executable; scheduling a task to call it would fail because the file contains no executable instructions.

Concept tested: Windows persistence via registry run keys and services

Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Topics

#Windows persistence#registry run key#services persistence#post-exploitation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-001 Practice