CEH Enumeration and System Hacking Practice Test 10 — 15 Questions

Question 1

During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk. The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.

Answer

NFS enumeration; it indicates that NFS shares are world-readable

Answer

SNMP enumeration; it indicates that the community string is weak

Answer

SMTP enumeration; it indicates that the mail server is misconfigured

Question 2

A penetration tester gains access to a Linux server and attempts to escalate privileges. They run `sudo -l` and see that the user can run `/usr/bin/vim` as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

Use vim's shell escape via `:!bash` to get a root shell. The `sudo -l` output shows that the user can run `/usr/bin/vim` as root without a password. Vim has a built-in shell escape feature: from within vim, typing `:!bash` (or `:!sh`) executes a shell with the privileges of the user running vim. Since vim is run via sudo as root, the spawned shell will be a root shell, directly escalating privileges without needing additional exploits.

Answer

Perform token impersonation using SeImpersonatePrivilege

Answer

Exploit a kernel vulnerability (CVE-2023-xxxx)

Answer

Abuse the SUID bit on vim

Question 3

Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)

Accepted Answer

Installing a rootkit to hide files and processes. Installing a rootkit is a classic method for covering tracks because it operates at the kernel or user level to intercept system calls (e.g., NtQuerySystemInformation on Windows) and hide malicious files, processes, registry keys, and network connections from standard enumeration tools like Task Manager or netstat. This prevents the victim from detecting the compromise during routine monitoring.

Answer

Escalating privileges to SYSTEM

Answer

Disabling antivirus software

Question 4

Which TWO of the following are password cracking techniques? (Select 2)

Accepted Answer

Rainbow table attack. A rainbow table attack (B) is a password cracking technique that uses precomputed hash chains to reverse cryptographic hash functions and recover plaintext passwords quickly, trading computation time for storage space. A dictionary attack (E) is also a password cracking technique that systematically tries words from a predefined wordlist, often with mutations, against a password hash or login to guess the correct password. The other options are not password cracking techniques: SQL injection (A) is a web application injection attack that manipulates database queries, phishing (C) is a social engineering attack that tricks users into revealing credentials, and ARP spoofing (D) is a network attack that poisons ARP caches to intercept traffic.

Answer

SQL injection

Answer

Phishing

Answer

ARP spoofing

Question 5

A security analyst runs `nbtstat -A 192.168.1.10` and receives a response with the computer name, logged-in user, and domain. Which protocol is being queried?

Accepted Answer

NetBIOS. The `nbtstat -A` command performs a NetBIOS name service query (NBNS) against the target IP address using UDP port 137. It retrieves the NetBIOS name table, which includes the computer name, logged-in user, and domain membership, directly from the NetBIOS over TCP/IP (NetBT) protocol stack.

Answer

SNMP

Answer

LDAP

Answer

SMTP

Question 6

A penetration tester wants to enumerate user accounts on a Linux system running SMTP service. Which commands are commonly used for this purpose?

Accepted Answer

VRFY, EXPN, RCPT TO. The VRFY command verifies whether a user mailbox exists on the SMTP server, EXPN expands a mailing list or alias to reveal individual member addresses, and RCPT TO specifies the recipient for a mail message and can be used to validate addresses during the SMTP conversation. These three commands are the standard SMTP enumeration techniques for discovering valid user accounts on a Linux system running an SMTP service.

Answer

USER, PASS, QUIT

Answer

AUTH LOGIN, STARTTLS, EHLO

Answer

HELO, MAIL FROM, DATA

Question 7

During a penetration test, the tester runs `enum4linux -U 192.168.1.20` and obtains a list of usernames. What service is being enumerated, and what is the primary risk associated with this information disclosure?

Accepted Answer

SMB; it can facilitate password spraying or brute‑force attacks. enum4linux is a tool that queries SMB (Server Message Block) services on a target, typically over TCP ports 139 or 445. The `-U` flag specifically enumerates users from the SAM database via the SMB protocol. The primary risk of obtaining a valid username list is that it enables password spraying or brute-force attacks against SMB authentication, which can lead to unauthorized access.

Answer

NFS; it can lead to unauthorized file access

Answer

SNMP; it can reveal community strings

Answer

LDAP; it can expose directory structure

Question 8

An analyst observes the following SNMP walk output on a network device: `SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.5.1 = STRING: "cisco"`. Which finding is most significant?

Accepted Answer

The SNMP community string is "cisco" and likely weak. The SNMP walk output reveals the community string 'cisco' in the OID `enterprises.9.9.23.1.2.1.1.5.1`, which corresponds to the SNMP community string (ciscoSnmpCommunityString) in Cisco's private MIB. A default or easily guessable community string like 'cisco' is a critical security weakness because it allows unauthorized read or read-write access to the device, enabling enumeration of system information or configuration changes. This finding is the most significant because it directly indicates a weak authentication mechanism that can be exploited for further enumeration or system compromise.

Answer

The SNMP service is using version 2c

Answer

The device is running Cisco IOS version 12.0

Answer

The device is configured for read-write access

Question 9

Which tool is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where rainbow tables allow rapid reversal of hashes without brute-forcing each password individually. This makes it the correct choice for the scenario described.

Answer

John the Ripper

Answer

RainbowCrack

Answer

Hashcat

Question 10

During a penetration test, a tester gains a low-privilege shell on a Linux server. The command `sudo -l` reveals that the user can run `/usr/bin/find` as root. Which technique can the tester use to escalate privileges?

Accepted Answer

Use find with the -exec flag to spawn a shell. The `sudo -l` output shows the user can run `/usr/bin/find` as root without a password. The `find` command has a built-in `-exec` flag that allows executing arbitrary commands on each found file. By running `sudo find / -exec /bin/sh \;`, the tester can spawn a root shell, escalating privileges because the command runs with sudo (root) privileges.

Answer

Abuse the SUID bit on find

Answer

Exploit a kernel vulnerability

Answer

Run a buffer overflow on the find binary

Question 11

A security engineer notices repeated log entries showing a user account logging in at odd hours and then clearing event logs. The engineer suspects credential theft. Which phase of the CHPSET methodology involves erasing tracks?

Accepted Answer

Erasing tracks. The CHPSET methodology (Cracking passwords, Hiding files, Planting backdoors, Spying, Erasing tracks, and Transferring files) defines the phases of system hacking. Erasing tracks is the phase where attackers clear event logs, modify log files, or use tools like `wevtutil` or `clearlogs.exe` to remove evidence of their activities, matching the engineer's observation of cleared logs after suspicious logins.

Answer

Hiding files

Answer

Spying

Answer

Cracking passwords

Question 12

A penetration tester uses `smbclient -L //192.168.1.30 -N` and receives a list of shares including a hidden administrative share (C$) and a user share named "Backup". What is the most immediate security concern?

Accepted Answer

Null session enumeration is possible, allowing information gathering. The `-N` flag in the `smbclient` command suppresses password prompts, enabling a null session connection. The fact that the command successfully lists shares without authentication indicates that null session enumeration is permitted, which is a critical security flaw. This allows an attacker to gather sensitive information (share names, user lists, etc.) without any credentials, often serving as the first step in a targeted attack.

Answer

The Backup share may contain sensitive data

Answer

SMB signing is not enabled

Answer

The C$ share is a default administrative share

Question 13

Which type of password cracking attack uses a precomputed table of hash chains to reverse hashes quickly?

Accepted Answer

Rainbow table attack. A rainbow table attack is correct because it uses a precomputed table of hash chains to reverse hashes quickly. Rainbow tables reduce the time needed for cracking by storing chains of hash values that allow for efficient lookup, trading off storage space for computational speed. This technique is specifically designed to reverse cryptographic hash functions like LM, NTLM, or MD5 without performing brute-force or dictionary lookups for each attempt.

Answer

Dictionary attack

Answer

Brute-force attack

Answer

Hybrid attack

Question 14

An attacker modifies system logs to remove entries related to their activities. Which technique is being used to cover tracks?

Accepted Answer

Log manipulation. Log manipulation is the correct answer because it directly involves altering or deleting log entries to hide evidence of unauthorized activities. Attackers often use this technique to remove traces of their actions from system logs, such as event logs in Windows or syslog files in Linux, thereby covering their tracks and avoiding detection.

Answer

Token impersonation

Answer

Steganography

Answer

Rootkit installation

Question 15

A forensic analyst finds a system where the user's password hash was obtained and cracked offline. The attacker then used stolen credentials to log in and run `wevtutil cl system`. What is the purpose of this command?

Accepted Answer

Clear the System event log. The `wevtutil cl system` command clears the System event log on Windows. After cracking the user's password hash offline, the attacker logs in with stolen credentials and runs this command to erase forensic evidence of their activities, such as logon events or service failures, from the System log. This is a common post-exploitation step to hinder incident response.

Answer

Remove scheduled tasks

Answer

Delete the SAM database

Answer

Disable Windows Defender