Examkin

Question

Difficulty: HardHost, Network, and Architecture Vulnerabilities

An enterprise security auditor discovers several vulnerabilities across an organization's internal infrastructure during a comprehensive technical posture assessment. Match each identified host and network vulnerability indicator on the left to its corresponding primary security risk on the right. Which of the following correctly pairs each vulnerability indicator with its primary security risk?

  • Windows system service configured with an unquoted executable path containing spaces under C:\Program Files\Local privilege escalation via executable path hijacking upon service restart
  • Legacy SMB service configured to permit anonymous null sessions over the IPC$ shareUnauthenticated reconnaissance allowing domain user and network share enumeration
  • Internal web application proxy configured to support 3DES and NULL cipher suitesCryptographic downgrade allowing passive interception and session plaintext exposure
  • Embedded network device running firmware susceptible to a stack-based buffer overflowRemote code execution within process memory space yielding shell access

Answer

The correct pairings match each host/network vulnerability to its specific threat impact: the unquoted service path matches local privilege escalation; SMB null sessions match unauthenticated reconnaissance; weak TLS cipher suites match cryptographic downgrade; and stack-based buffer overflow firmware matches remote code execution.
The pairings correctly connect each technical vulnerability mechanism to its operational security impact. Unquoted service paths expose local execution order bugs used for privilege elevation; SMB IPC$ null sessions expose administrative RPC endpoints for network discovery; legacy cipher suites expose TLS handshakes to algorithm downgrade attacks; and stack-based memory bounds failures permit arbitrary code execution.

Step-by-Step Solution

1
Analyze host-level binary execution vulnerabilities.
Unquoted service paths containing spaces cause Windows to search for executables at each space break. This directly maps to local privilege escalation via path hijacking.
Windows process creation attempts to execute the shortest valid path string when spaces are unquoted.
2
Analyze network protocol misconfigurations for information exposure.
Anonymous SMB null sessions over IPC$ enable unauthenticated RPC queries to list domain objects, mapping directly to unauthenticated reconnaissance.
Legacy NetBIOS/SMB behavior allowed unauthenticated connections to inspect system resources.
3
Evaluate transport layer cryptographic weaknesses.
Supporting 3DES or NULL cipher suites allows attackers to force weak or non-existent encryption during negotiation, mapping directly to cryptographic downgrade and eavesdropping.
Permitting weak algorithms enables protocol downgrade attacks such as POODLE or SWEET32.
4
Evaluate memory corruption flaws in network device firmware.
Unchecked memory writes in firmware lead to instruction pointer overwrites, mapping directly to remote code execution.
Buffer overflow conditions alter control flow execution to arbitrary shellcode.

Key Concept

Host, Network, and Architecture Vulnerabilities
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities