CEH Enumeration and System Hacking — 30 Questions

Question 1

During a penetration test, you gain access to a target system as a low-privileged user. Which of the following is the BEST next step according to the CEH system hacking methodology (CHPSET)?

Accepted Answer

Escalate privileges to gain higher-level access. The CEH methodology includes phases such as Cracking passwords, Privilege escalation, Hiding files, Executing applications, Spying, and Erasing tracks. After gaining initial access as a low-privileged user, the next logical step is to escalate privileges to gain higher access (e.g., administrator or root).

Answer

Execute applications to extract data

Answer

Hide files to conceal tools and data

Answer

Erase event logs to avoid detection

Question 2

During a penetration test, you successfully execute a privilege escalation attack by abusing a service running with SYSTEM privileges on a Windows machine. Which of the following techniques is MOST likely being used?

Accepted Answer

DLL hijacking. DLL hijacking is the most likely technique because it involves placing a malicious DLL where a service that runs with SYSTEM privileges will load it, causing the attacker's code to execute with SYSTEM privileges. Token impersonation relies on stealing or duplicating access tokens and typically requires SeImpersonate/SeAssignPrimaryToken privileges; it does not require modifying what a service loads. Pass-the-hash is primarily credential-based lateral movement, and SUID abuse is a Unix/Linux privilege escalation method.

Answer

Pass-the-hash

Answer

SUID abuse

Answer

Token impersonation

Question 3

Which TWO of the following are valid SMTP enumeration commands that can be used to discover valid email addresses? (Select 2)

Accepted Answer

EXPN. EXPN is a valid SMTP command that requests the server to expand a mailing list or alias, revealing the individual email addresses that belong to it. VRFY is another valid SMTP command that requests the server to verify if a mailbox exists for a given user. Both commands are useful for discovering valid email addresses without sending a message, as defined in RFC 821.

Answer

HELO

Answer

RCPT TO

Answer

ATRN

Question 4

Which THREE of the following are password cracking techniques that can be used with Hashcat? (Select 3)

Accepted Answer

Brute-force attack. Hashcat is a GPU-accelerated password recovery tool that supports multiple attack modes.
A **Brute-force attack** (option B) systematically tries every possible combination of characters from a defined keyspace until the correct password is found. Hashcat implements this via its '?a' mask or direct brute-force mode, making it a core technique for cracking hashes when no prior knowledge of the password exists.
A **Dictionary attack** (option D) attempts to crack passwords by trying words from a predefined list (dictionary). Hashcat supports this mode, allowing users to specify wordlists for efficient cracking of common or weak passwords.
A **Hybrid attack** (option E) combines elements of dictionary and brute-force attacks. For example, it might append or prepend numbers/symbols to dictionary words, or use a mask with a dictionary word, significantly increasing the chances of cracking passwords that are variations of common words.

Answer

Token impersonation

Answer

Rainbow table attack

Question 5

A system administrator wants to enumerate all users in an Active Directory domain. Which protocol and query technique should they use?

Accepted Answer

LDAP anonymous query. LDAP anonymous queries allow unauthenticated users to query an Active Directory domain for directory information, including user enumeration. While modern Active Directory configurations often restrict anonymous LDAP binds by default for security reasons, if enabled or misconfigured, it becomes a highly effective technique for enumerating users without credentials.

Answer

SNMP with public community string

Answer

SMB null session

Answer

SMTP VRFY

Question 6

Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)

Accepted Answer

smbclient. smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Windows file shares. It can list available shares with the `-L` option and, with valid credentials, enumerate users via the `-U` flag or by browsing the IPC$ share. enum4linux is a wrapper script that automates the enumeration of information from Windows and Samba hosts, including users, groups, shares, and more, by leveraging tools like smbclient and rpcclient. Both are direct tools for SMB enumeration.

Answer

nslookup

Answer

snmpwalk

Answer

ldapsearch

Question 7

Which THREE of the following are valid techniques in the system hacking methodology (CHPSET)? (Choose three.)

Accepted Answer

Privilege escalation. The CEH system hacking methodology, often remembered by the acronym CHPSET, includes Cracking Passwords, Hacking, Privilege Escalation, System Hacking, Erasing Tracks, and Tunneling. Therefore, Privilege Escalation (P), Erasing Tracks (E), and Cracking Passwords (C) are all explicit and valid techniques within this methodology. Privilege escalation involves gaining higher-level access (e.g., from a standard user to root or SYSTEM) to gain full control over the target system. Erasing tracks aims to remove evidence of the attack to maintain anonymity and prevent detection. Cracking passwords is a fundamental step often used for initial access or privilege escalation by gaining credentials.

Answer

Social engineering

Answer

Network sniffing

Question 8

Which TWO tools are commonly used for enumerating NFS exports on a target system? (Select 2 correct answers)

Accepted Answer

nmap (with script nfs-ls). B is correct because nmap's nfs-ls script is specifically designed to enumerate NFS exports by querying the NFS service (port 2049) and listing the available shares. It works by sending MOUNT protocol requests to the target, which reveals the exported file systems and their access permissions, making it a standard tool for NFS enumeration in penetration testing. D is also correct because showmount is a standard command-line utility used to query the mount daemon on a remote host for a list of exported directories. The 'showmount -e <target_ip>' command is commonly used to display the NFS exports available from a server.

Answer

enum4linux

Answer

smbclient

Answer

ldapsearch

Question 9

Which of the following is the correct order of phases in the system hacking methodology known as CHPSET?

Accepted Answer

Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing. The CHPSET methodology in system hacking stands for Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing. Option D correctly lists these phases in order: Cracking (password cracking), Hiding (covering tracks), Privilege escalation (gaining higher access), Executing (running malicious code), Spying (monitoring activity), and Erasing (removing evidence). This sequence follows the logical progression from initial access to maintaining access and finally covering tracks.

Answer

Spying, Erasing, Cracking, Hiding, Privilege escalation, Executing

Answer

Privilege escalation, Cracking, Hiding, Executing, Spying, Erasing

Answer

Executing, Cracking, Spying, Hiding, Privilege escalation, Erasing

Question 10

Which TWO tools are commonly used for password cracking against hashed passwords? (Select two.)

Accepted Answer

John the Ripper. John the Ripper (B) is a widely used offline password cracking tool that supports various hash algorithms (e.g., MD5, SHA-1, bcrypt) and modes like dictionary, brute-force, and incremental attacks. It is specifically designed to recover passwords from hashed password files. Hashcat (D) is another extremely powerful and popular password cracking utility, known for its high performance, especially with GPU acceleration, and its ability to crack a vast array of hash types and attack modes (e.g., dictionary, brute-force, hybrid, mask attacks). Both are standard tools for cracking stored hashed passwords.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 11

During a system hacking phase, a tester successfully gains access to a Windows machine and wants to hide a malicious executable. Which of the following techniques is MOST effective for hiding files from standard directory listings without using third-party tools?

Accepted Answer

Store the executable in an Alternate Data Stream (ADS). Storing the executable in an Alternate Data Stream (ADS) is a highly effective method for hiding files on NTFS file systems. Files stored in ADS are not visible in standard directory listings (e.g., `dir` command or Windows Explorer) and require specific knowledge or commands to discover. This technique can be implemented using built-in Windows commands like `type` or `echo` for creation, and `start` or PowerShell for execution, thus adhering to the 'no third-party tools' constraint. It offers a greater degree of concealment than simply setting hidden and system attributes, which can be easily revealed by changing folder options.

Answer

Use the `attrib +h +s` command to set hidden and system attributes

Answer

Rename the file to a system filename like svchost.exe and place it in C:\Windows\System32

Answer

Encrypt the file using EFS

Question 12

Which THREE of the following are indicators that a system has been compromised by a rootkit? (Select 3)

Accepted Answer

Anti-virus software is disabled and cannot be restarted. Rootkits are designed for stealth and persistence. They often disable or interfere with security software (like anti-virus) to avoid detection and maintain control, preventing it from restarting by modifying service entries or hooking system APIs (Option A). A primary characteristic of rootkits is their ability to hide their own presence, including processes, files, and network connections, from standard system utilities (Option B). Furthermore, rootkits are frequently used to facilitate malicious activities such as establishing covert communication channels to command-and-control (C2) servers. If unexplained network connections to known C2 infrastructure are detected (e.g., by network monitoring tools that bypass the rootkit's hooks), it's a strong indicator of a rootkit-enabled compromise (Option C).

Answer

Event logs show repeated successful logins from unknown IPs

Answer

Increased disk space usage without explanation

Question 13

Which TWO of the following are valid enumeration techniques used to identify user accounts on a system? (Select 2)

Accepted Answer

SMTP VRFY command. The SMTP VRFY command (RFC 821) is used to verify whether a user account exists on a mail server. By sending VRFY <username>, an attacker can enumerate valid usernames based on the server's response (e.g., 250 OK vs. 550 No such user). This is a classic enumeration technique because it directly reveals account existence without authentication. Similarly, SMB enumeration, often performed using tools like enum4linux, leverages the Server Message Block (SMB) protocol to extract information such as user lists, group lists, and share details from Windows or Samba systems. These techniques directly aim to identify user accounts.

Answer

Port scanning with nmap

Answer

DNS zone transfer

Answer

SNMPwalk of the entire MIB

Question 14

A penetration tester is tasked with performing privilege escalation on a Windows system. Which THREE of the following methods are commonly used for Windows privilege escalation? (Select 3)

Accepted Answer

Token impersonation (e.g., SeImpersonatePrivilege). Token impersonation, specifically leveraging privileges like SeImpersonatePrivilege, is a well-known Windows privilege escalation technique. Tools like JuicyPotato or RoguePotato exploit this privilege to impersonate a high-integrity token (e.g., SYSTEM) by forcing a privileged process to authenticate to a malicious COM server, allowing the attacker to execute code with elevated privileges. Exploiting unquoted service paths is another common method where a service path containing spaces, if not enclosed in quotes, can allow an attacker to place a malicious executable in an earlier part of the path that Windows attempts to execute. Additionally, exploiting weak service permissions, such as misconfigurations that allow an attacker to modify a service's executable path or configuration, can lead to privilege escalation if the service runs with elevated privileges (e.g., SYSTEM).

Answer

SUID bit abuse

Answer

Pass-the-hash attack

Question 15

An attacker gains access to a Linux web server as the 'www-data' user. They run `find / -perm -4000 -type f 2>/dev/null` and see that `/usr/bin/passwd` has the SUID bit set. Which privilege escalation technique is this command checking for?

Accepted Answer

SUID abuse. The command `find / -perm -4000 -type f 2>/dev/null` searches for files with the SUID (Set User ID) permission bit set (octal 4000). The SUID bit allows a file to be executed with the privileges of the file owner (typically root). Finding `/usr/bin/passwd` with SUID set indicates that an attacker can potentially exploit misconfigured SUID binaries to execute commands with elevated privileges, a classic privilege escalation technique known as SUID abuse.

Answer

Password cracking

Answer

Kernel exploit

Answer

Token impersonation

Question 16

Which TWO of the following are enumeration techniques used to gather information from Windows systems? (Select 2)

Accepted Answer

SMB enumeration using enum4linux. SMB enumeration using enum4linux is correct because enum4linux is a tool that queries Windows SMB shares, user lists, and OS information via the SMB protocol (ports 139/445). It leverages SMB null sessions to extract data like user accounts, group memberships, and share permissions, making it a standard enumeration technique for Windows systems. NetBIOS enumeration using nbtstat is also correct as NetBIOS is a legacy but still relevant naming service on Windows networks, and `nbtstat` is a built-in Windows command-line utility used to display NetBIOS over TCP/IP protocol statistics, including remote NetBIOS name tables, which can reveal hostnames, workgroup/domain names, and MAC addresses.

Answer

SMTP enumeration using VRFY

Answer

LDAP enumeration using ldapsearch

Answer

NFS enumeration using showmount

Question 17

Which TWO of the following are password cracking techniques? (Select 2)

Accepted Answer

Rainbow table attack. A rainbow table attack is a password cracking technique that uses precomputed hash chains to reverse cryptographic hash functions. Instead of computing hashes on the fly, the attacker matches captured password hashes against a precomputed table of hash values, drastically reducing the time needed to recover plaintext passwords. This is a classic offline attack against hashed passwords, especially effective when salts are not used.

A dictionary attack is another password cracking technique where an attacker attempts to guess a password by trying every word in a pre-compiled list (a dictionary). This can be used against live login forms or, more commonly, against captured password hashes by hashing each dictionary word and comparing it to the target hash. It's effective against weak passwords that are common words or phrases.

Answer

SQL injection

Answer

Phishing

Answer

ARP spoofing

Question 18

In the context of privilege escalation on Windows, what is token impersonation, and which tool is commonly used to exploit it?

Accepted Answer

A technique to assume another user's security context; Incognito. Token impersonation is a privilege escalation technique where an attacker assumes the security context (including privileges and identity) of another user by duplicating or manipulating an existing access token. The Incognito tool is specifically designed to enumerate available tokens on a Windows system and impersonate them, allowing an attacker to escalate privileges to that of a higher-privileged user (e.g., SYSTEM). This is a core technique in post-exploitation after gaining initial access.

Answer

A technique to dump hashes; Hashcat

Answer

A technique to steal session cookies; Mimikatz

Answer

A technique to bypass UAC; Metasploit

Question 19

Which TWO of the following are common methods used to hide files on a compromised system? (Select two.)

Accepted Answer

NTFS Alternate Data Streams. NTFS Alternate Data Streams (ADS) allow files to be hidden within other files by appending a stream name after a colon (e.g., `legit.txt:hidden.exe`). This is a native NTFS feature that does not show the hidden data in standard directory listings (like `dir`), making it a common method for attackers to conceal malicious payloads on a compromised Windows system.

Answer

Rootkits

Answer

Token impersonation

Answer

Log manipulation

Question 20

A security team is investigating a compromised Linux server. They suspect the attacker used privilege escalation via SUID binaries. Which THREE techniques should the team check as potential attack vectors? (Choose THREE.)

Accepted Answer

Injecting a malicious shared library via LD_PRELOAD into a SUID binary. LD_PRELOAD can be used to inject a malicious shared library into a SUID binary if the binary is dynamically linked and the environment is not sanitized. When the SUID binary runs, the loader loads the attacker's library, executing arbitrary code with the binary's elevated privileges. This bypasses normal permission checks and allows privilege escalation.

Exploiting a vulnerable SUID binary (like 'nmap' or 'find') involves using specific functionalities or flaws within these programs (e.g., 'find -exec' or older 'nmap --interactive' modes) to execute arbitrary commands with the elevated privileges of the SUID binary.

Leveraging a SUID shell script that calls a user-controlled command, while SUID on shell scripts is generally ignored by the kernel, refers to scenarios where a SUID *binary* executes a shell script, or a script is part of a SUID context, and that script then calls a command with user-controlled input or path, leading to privilege escalation.

Answer

Using token impersonation with SeDebugPrivilege

Answer

Performing a DDoS attack on the server