11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services

The rest of PT0-003 4.2 is attacks that use a service as it already stands: default credentials, misconfigured services exploitation, certificate services, share enumeration as an attack rather than the 2.2 inventory, and packet crafting. CompTIA then names nine tools. Exam items mix a printer default, an unbound Redis, an AD CS template, a writable share, and a custom packet, then wait for you to grab the wrong logo. Name the attack type first. Then pick the tool family.

Default credentials: documented factory logins, in scope only

Default credentials are the username and password the vendor shipped: admin/admin on a camera, a documented printer PIN, a switch login printed in the hardware quick-start, an application installer account nobody rotated. What it does: you authenticate as the product, not as a domain user you guessed. When you pick it: enumeration showed a management UI, SNMP, SSH, or HTTP login on an in-scope appliance and the RoE allows a short online guess. Which tool: Hydra is the 4.2 online password-guessing family. Nmap NSE scripts can check a documented default against a service. A vendor default listed in the engagement notes is still "default credentials" even if you type it once without Hydra.

Stay in-scope only. A camera CIDR that is not in the statement of work is not a free Hydra target because "IoT always has defaults." Lockout clauses in the RoE still apply: a three-attempt lockout on a production VPN is not a Hydra job. Exam trap: treating Hydra as a hash cracker. Hashcat and John the Ripper live on 4.3. Trap two: treating a domain password spray as "defaults." Spray is 4.3. Defaults are factory or documented service logins. Trap three: answering Metasploit for every login prompt. Metasploit is the exploit framework; a printer's documented admin/admin is Hydra or the manual default, not a memory-corruption module.

Misconfigured services exploitation

Misconfigured services exploitation uses a service that is running in an unsafe state the vendor did not intend for production. Classic 4.2 pictures: anonymous FTP that lists and serves files, Redis bound on all interfaces with no AUTH, HTTP directory listing on a backup folder, SNMP community public with an informative or writable MIB, an Elasticsearch or MongoDB with no authentication, a Jenkins or Docker API that requires no login from the tester VLAN.

What it does: you exercise the permission the service already grants — read the backup, walk the MIB, retrieve objects the protocol allows — without a memory-corruption exploit. When you pick it: 2.2 or 3.1 already showed the condition; 4.2 is using it. Which tool: Nmap NSE to confirm the misconfig, Netcat to speak a simple TCP or UDP protocol by hand, Metasploit when a module exists for that service state, Impacket or CME when the service is Windows SMB or RPC.

Exam trap: answering with a scanner name when the stem already has anonymous FTP and asks what the attack is. Discovery found it. Exploitation of the misconfig is retrieving or writing with the access the service offered. Another trap: jumping to msfvenom because Redis was open. If the protocol already grants a dangerous command or a config write, you are still on misconfigured-services, not on payload generation. Stay inside RoE: anonymous read of in-scope FTP is not authorization to upload into a production web root the SoW never named.

Certificate services as a network attack surface

Certificate services on 4.2 means the network service that issues or validates certificates, especially Active Directory Certificate Services (AD CS). The attack is the service misconfiguration: a web-enrollment endpoint reachable to low-priv users, a template that lets a normal user enroll a certificate which maps to a privileged account, a CA that still allows NTLM, or clients that will trust a misissued certificate.

When you pick it: the stem shows a CA, a certificate template, enrollment HTTP, or "the workstation accepted a certificate the real identity provider did not issue." Which tool: on this objective, stay on the service idea and on 4.2 names — Nmap or NSE to find enrollment, Impacket-family helpers when NTLM to the CA is in play. Certify is a 4.4 host-based tool. Do not pick Certify as the 4.2 answer just because the letters look like "certificate."

Exam trap: collapsing certificate services into on-path TLS. On-path failed because of a cert warning; certificate-services abuse is the CA or template being too generous. Trap two: treating every HTTPS site as "certificate services." HTTPS is transport. AD CS is an enrollment and issuance service. Trap three: treating a public certificate-transparency lookup as 4.2. CT logs were 2.1 passive recon.

Packet crafting: custom packets, not payloads

Packet crafting is building custom packets — unusual flags, options, VLAN tags, or protocol fields — that a normal client would not send, then watching how a firewall, IDS, or host stack reacts. What it does: it tests filters and parsers, not user passwords. When you pick it: you need to know whether a filter matches on destination port only, on TCP flags, on an 802.1Q tag, or on a payload pattern; or you need a probe a stock connect-scan will not send. Which tool: conceptually Scapy (also listed later under specialized-system and scripting objectives) and Nmap custom packets or NSE. Wireshark and tcpdump confirm what left the NIC.

msfvenom is not packet crafting. msfvenom generates payloads. Metasploit is the exploit framework that launches modules. Crafting a packet to test IDS is 4.2 packet crafting; building a reverse-shell blob is payload generation. Exam trap: "packet crafting" as a synonym for exploit development. Another trap: using packet crafting as the answer for VLAN hopping just because double-tagging involves tags. Hopping is the VLAN attack type; crafting is the technique of building unusual frames. The stem will tell you which one it is scoring. A third trap: picking Netcat as a packet crafter. Netcat speaks a stream; it does not let you set arbitrary IP or TCP fields the way a crafter does.

Share enumeration as a 4.2 attack

Objective 2.2 already scored share enumeration as inventory: list SMB or NFS exports and whether guest versus authenticated access works. On 4.2, the same bullet is the attack/use of those shares. What it does: you treat a writable share as a drop location, or you read confidential files from a share that should not have been guest- or everyone-readable. A conceptual follow-on is the always-install-elevated / software-deployment share pattern: a low-priv user can write a package or script that a privileged installer later executes. You do not need a memory exploit if the share already grants write and a privileged process already consumes it.

When you pick it: 2.2 listed FINANCE$ as guest-readable or DEPLOY$ as authenticated-user writable. 4.2 is opening the payroll spreadsheet or treating the write as the attack path. Which tool: Impacket (SMB client family) and CME (share checks at fleet scale). Netcat is the wrong family for SMB. Exam trap: reprinting the share list and calling it the 4.2 attack. Listing is 2.2. Using the write or the sensitive read is 4.2. Describe the permission and the privileged consumer in the finding; do not author a payload file as if the report were an exploit kit.

Worked services

The same /24 that held FILE01 also has a printer web UI still on the vendor default, an FTP daemon offering anonymous read of backups/, an HTTP directory listing on /old-certs/, SNMP public on a switch, and AD CS web enrollment. Hydra or the documented default is the printer. Anonymous FTP and directory listing are misconfigured-services exploitation — retrieve the files the service already serves. SNMP public is the same class. AD CS web enrollment plus a loose template is certificate services, not Certify-on-4.2 and not on-path TLS. CME showing DEPLOY$ writable by Domain Users is the 4.2 share attack, not another 2.2 inventory screenshot. If the stem instead asks you to build unusual TCP flags against the IDS in front of FTP, that is packet crafting with Nmap or a crafter, confirmed in Wireshark — not msfvenom.

free PenTest+ practice questionsPractice questions with detailed explanations

4.2 tool matching (hard)

Sequence on the exam: name the attack type first (default, misconfig, cert service, share-as-attack, crafted packet), then pick the tool family. If the stem wants a payload, msfvenom. If it wants a module runner, Metasploit. If it wants LLMNR, Responder. If it wants factory logins, Hydra. If it wants Windows network tradecraft, Impacket or CME. If it wants a listener or a file pipe, Netcat.