After compromising a system, a penetration tester wants more information in order to decide what actions to take next. The tester runs the following commands: Which of the following attacks is the…

The correct answer is A. Metadata service attack. In cloud IaaS environments (AWS, GCP, Azure), every compute instance has access to a metadata service, typically at the link-local address 169.254.169.254. This service returns instance configuration, IAM role credentials, SSH keys, and other sensitive data without requiring…

Post-exploitation and lateral movement

Question

After compromising a system, a penetration tester wants more information in order to decide what actions to take next. The tester runs the following commands:

Which of the following attacks is the penetration tester more likely trying to perform?

Options

AMetadata service attack
BContainer escape techniques
CCredential harvesting
DResource exhaustion

How the community answered

(33 responses)

A
73% (24)
B
15% (5)
C
3% (1)
D
9% (3)

Explanation

In cloud IaaS environments (AWS, GCP, Azure), every compute instance has access to a metadata service, typically at the link-local address 169.254.169.254. This service returns instance configuration, IAM role credentials, SSH keys, and other sensitive data without requiring authentication - it is only accessible from within the instance. After compromising a system, a penetration tester running commands like 'curl http://169.254.169.254/latest/meta-data/' is probing this metadata endpoint to harvest temporary cloud credentials (e.g., AWS IAM role tokens) that can be used to pivot to other cloud resources. Container escape, credential harvesting from disk, and resource exhaustion are different techniques with different command patterns.

Topics

#Metadata service attack#Cloud security#Post-exploitation#Information gathering

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice