eJPT Exploitation with Metasploit 5 — Questions and Answers
Question 1: Which Meterpreter command lists all running processes on the compromised Windows host?
- tasklist
- ps (Correct answer)
- proclist
- getproc
Correct answer: ps
The 'ps' command in Meterpreter displays a list of all running processes including PID, name, and user.
Question 2: What is process migration in Meterpreter used for?
- Moving the exploit payload to a remote host
- Moving the Meterpreter session into a different running process (Correct answer)
- Changing the listening port of the handler
- Upgrading a shell session to Meterpreter
Correct answer: Moving the Meterpreter session into a different running process
Process migration moves the Meterpreter agent into another PID, helping stabilize the session or avoid process death.
Question 3: Which msfvenom flag is used to specify the number of times an encoder is applied to a payload?
- -t
- -i (Correct answer)
- -r
- -c
Correct answer: -i
The -i flag specifies the number of encoding iterations, applying the encoder multiple times to increase obfuscation.
Question 4: In Metasploit, what does the 'info' command display about a selected module?
- Current session information
- Detailed description, options, targets, and references for the module (Correct answer)
- Network information from the target
- A list of related modules
Correct answer: Detailed description, options, targets, and references for the module
'info' shows the full module description including author, CVE references, all options, and supported targets.
Question 5: Which Metasploit auxiliary module can brute-force SSH login credentials?
- auxiliary/scanner/ssh/brute
- auxiliary/scanner/ssh/ssh_login (Correct answer)
- auxiliary/attack/ssh/credential_force
- auxiliary/bruteforce/ssh/login
Correct answer: auxiliary/scanner/ssh/ssh_login
auxiliary/scanner/ssh/ssh_login performs credential brute-forcing against SSH services using wordlists.
Question 6: What does the 'route add' command do within the Metasploit framework?
- Adds a static route on the target host
- Routes traffic through a Meterpreter session to reach internal networks (Correct answer)
- Adds a new network interface to the attacker machine
- Configures the exploit's network path
Correct answer: Routes traffic through a Meterpreter session to reach internal networks
'route add' tells Metasploit to send traffic to a subnet through an existing session, enabling pivoting into internal networks.
Question 7: What Meterpreter command retrieves the target's hostname, OS version, and architecture in one output?
- getuid
- sysinfo (Correct answer)
- uname
- osinfo
Correct answer: sysinfo
'sysinfo' returns the computer name, OS version, architecture, system language, and Meterpreter version in a single command.
eJPT Exploitation with Metasploit 5
Which Meterpreter command lists all running processes on the compromised Windows host?