System Hacking & Malware

Which framework is most commonly used by ethical hackers to develop, test, and execute exploit code against a target?

• A Wireshark
• B Metasploit Framework ✓
• C Nikto
• D Maltego

Answer: The Metasploit Framework provides a modular platform of exploits, payloads, and post-exploitation tools widely used to validate vulnerabilities.

After gaining a low-privileged shell, an attacker exploits a kernel flaw to gain administrative rights. What is this stage called?

• A Lateral movement
• B Privilege escalation ✓
• C Footprinting
• D Covering tracks

Answer: Privilege escalation is the act of moving from a lower-privileged account to higher (e.g., root or SYSTEM) privileges, often by abusing a vulnerability or misconfiguration.

Which technique attempts to recover plaintext passwords by hashing every possible character combination until a match is found?

• A Dictionary attack
• B Brute-force attack ✓
• C Rainbow-table attack
• D Pass-the-hash attack

Answer: A brute-force attack systematically tries every possible combination of characters, guaranteeing success eventually but at high computational cost.

In a pass-the-hash attack, what does the attacker actually use to authenticate?

• A The user's plaintext password
• B The captured NTLM password hash, without ever cracking it ✓
• C A valid Kerberos TGT only
• D The user's biometric data

Answer: Pass-the-hash reuses a captured NTLM hash directly for authentication, so the attacker never needs to recover the plaintext password.

Which type of malware disguises itself as legitimate software but delivers a malicious payload when executed?

• A Trojan horse ✓
• B Logic bomb
• C Rootkit
• D Worm

Answer: A Trojan horse appears to be a benign or useful program but conceals malicious functionality that activates once the user runs it.

What distinguishes a worm from a virus?

• A A worm self-replicates and spreads across networks without needing a host file or user action ✓
• B A worm can only run on Linux systems
• C A worm always encrypts files for ransom
• D A worm requires a user to open an email attachment to spread

Answer: A worm is self-propagating malware that spreads across networks on its own, whereas a virus must attach to a host file and typically relies on user action to execute.