CEH Enumeration and System Hacking Practice Test 10 — 15 Questions

Question 1

After compromising a system, an attacker wants to erase their tracks. They clear the Windows Event Logs using `wevtutil cl` commands. However, the logs are forwarded to a remote SIEM. Which covering tracks technique would be MOST effective to avoid detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify specific event log entries to remove evidence of their actions. Modifying specific event log entries directly removes the incriminating evidence without disrupting the logging pipeline. Since logs are forwarded to a remote SIEM, simply clearing or disabling local logs would trigger an alert due to a gap in log forwarding. By surgically editing only the relevant entries (e.g., using PowerShell or API calls to alter Event Log records), the attacker avoids detection while the SIEM continues to receive logs, maintaining the appearance of normal operation.

Answer

Disable Windows Event Log service (EventLog)

Answer

Use a rootkit to hide files and processes

Answer

Encrypt the log files

Question 2

A penetration tester discovers a service running on UDP port 161 with a default community string 'public'. They use `snmpwalk -v2c -c public 192.168.1.10` and retrieve extensive system information. Which enumeration technique is being performed?

Accepted Answer

SNMP enumeration. The question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.

Answer

SMB enumeration

Answer

LDAP enumeration

Answer

SMTP enumeration

Question 3

In the context of system hacking methodology (CHPSET), which phase involves hiding malicious files from the operating system and security tools using techniques such as NTFS alternate data streams (ADS) or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Erasing tracks, Hiding files) methodology specifically involves concealing malicious files from the OS and security tools. Techniques like NTFS alternate data streams (ADS) allow data to be stored in a file's metadata stream (e.g., type echo payload > file.txt:stream) without affecting the visible file size, while steganography hides data within images or audio files. This phase occurs after gaining access and before covering tracks.

Answer

Privilege escalation

Answer

Erasing tracks

Answer

Cracking passwords

Question 4

Which password cracking method uses a precomputed table of hash chains to reverse password hashes quickly?

Accepted Answer

Rainbow table attack. A rainbow table attack is correct because it uses precomputed tables of hash chains to reverse password hashes quickly. Instead of computing the hash for every possible password in real time, the attacker looks up the hash in the table to find the corresponding plaintext, drastically reducing the time needed for cracking.

Answer

Hybrid attack

Answer

Dictionary attack

Answer

Brute-force attack

Question 5

A security analyst notices that an attacker has gained SYSTEM privileges on a Windows server after compromising a service running as LOCAL SYSTEM. The attacker then uses `whoami /priv` and finds the SeTcbPrivilege (Act as part of the operating system) is enabled. Which privilege escalation technique might the attacker use next?

Accepted Answer

Token impersonation. With SeTcbPrivilege enabled, the attacker can call the `CreateProcessAsUser` or `DuplicateTokenEx` API to impersonate any user token, including SYSTEM. This is a classic token impersonation attack, allowing the attacker to elevate from LOCAL SYSTEM to a higher-integrity context or move laterally by creating processes with arbitrary identities.

Answer

Sticky keys exploit

Answer

DLL injection

Answer

Pass-the-hash

Question 6

During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?

Accepted Answer

LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk. The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.

Answer

NFS enumeration; it indicates that NFS shares are world-readable

Answer

SNMP enumeration; it indicates that the community string is weak

Answer

SMTP enumeration; it indicates that the mail server is misconfigured

Question 7

A penetration tester gains access to a Linux server and attempts to escalate privileges. They run `sudo -l` and see that the user can run `/usr/bin/vim` as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

Use vim's shell escape via `:!bash` to get a root shell. The `sudo -l` output shows that the user can run `/usr/bin/vim` as root without a password. Vim has a built-in shell escape feature: from within vim, typing `:!bash` (or `:!sh`) executes a shell with the privileges of the user running vim. Since vim is run via sudo as root, the spawned shell will be a root shell, directly escalating privileges without needing additional exploits.

Answer

Perform token impersonation using SeImpersonatePrivilege

Answer

Exploit a kernel vulnerability (CVE-2023-xxxx)

Answer

Abuse the SUID bit on vim

Question 8

Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)

Accepted Answer

Installing a rootkit to hide files and processes. Installing a rootkit is a classic method for covering tracks because it operates at the kernel or user level to intercept system calls (e.g., NtQuerySystemInformation on Windows) and hide malicious files, processes, registry keys, and network connections from standard enumeration tools like Task Manager or netstat. This prevents the victim from detecting the compromise during routine monitoring.

Answer

Escalating privileges to SYSTEM

Answer

Disabling antivirus software

Question 9

A security analyst runs `nbtstat -A 192.168.1.10` and receives a response with the computer name, logged-in user, and domain. Which protocol is being queried?

Accepted Answer

NetBIOS. The `nbtstat -A` command performs a NetBIOS name service query (NBNS) against the target IP address using UDP port 137. It retrieves the NetBIOS name table, which includes the computer name, logged-in user, and domain membership, directly from the NetBIOS over TCP/IP (NetBT) protocol stack.

Answer

SNMP

Answer

LDAP

Answer

SMTP

Question 10

A penetration tester wants to enumerate user accounts on a Linux system running SMTP service. Which commands are commonly used for this purpose?

Accepted Answer

VRFY, EXPN, RCPT TO. The VRFY command verifies whether a user mailbox exists on the SMTP server, EXPN expands a mailing list or alias to reveal individual member addresses, and RCPT TO specifies the recipient for a mail message and can be used to validate addresses during the SMTP conversation. These three commands are the standard SMTP enumeration techniques for discovering valid user accounts on a Linux system running an SMTP service.

Answer

USER, PASS, QUIT

Answer

AUTH LOGIN, STARTTLS, EHLO

Answer

HELO, MAIL FROM, DATA

Question 11

During a penetration test, the tester runs `enum4linux -U 192.168.1.20` and obtains a list of usernames. What service is being enumerated, and what is the primary risk associated with this information disclosure?

Accepted Answer

SMB; it can facilitate password spraying or brute‑force attacks. enum4linux is a tool that queries SMB (Server Message Block) services on a target, typically over TCP ports 139 or 445. The `-U` flag specifically enumerates users from the SAM database via the SMB protocol. The primary risk of obtaining a valid username list is that it enables password spraying or brute-force attacks against SMB authentication, which can lead to unauthorized access.

Answer

NFS; it can lead to unauthorized file access

Answer

SNMP; it can reveal community strings

Answer

LDAP; it can expose directory structure

Question 12

An analyst observes the following SNMP walk output on a network device: `SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.5.1 = STRING: "cisco"`. Which finding is most significant?

Accepted Answer

The SNMP community string is "cisco" and likely weak. The SNMP walk output reveals the community string 'cisco' in the OID `enterprises.9.9.23.1.2.1.1.5.1`, which corresponds to the SNMP community string (ciscoSnmpCommunityString) in Cisco's private MIB. A default or easily guessable community string like 'cisco' is a critical security weakness because it allows unauthorized read or read-write access to the device, enabling enumeration of system information or configuration changes. This finding is the most significant because it directly indicates a weak authentication mechanism that can be exploited for further enumeration or system compromise.

Answer

The SNMP service is using version 2c

Answer

The device is running Cisco IOS version 12.0

Answer

The device is configured for read-write access

Question 13

Which tool is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where rainbow tables allow rapid reversal of hashes without brute-forcing each password individually. This makes it the correct choice for the scenario described.

Answer

John the Ripper

Answer

RainbowCrack

Answer

Hashcat

Question 14

During a penetration test, a tester gains a low-privilege shell on a Linux server. The command `sudo -l` reveals that the user can run `/usr/bin/find` as root. Which technique can the tester use to escalate privileges?

Accepted Answer

Use find with the -exec flag to spawn a shell. The `sudo -l` output shows the user can run `/usr/bin/find` as root without a password. The `find` command has a built-in `-exec` flag that allows executing arbitrary commands on each found file. By running `sudo find / -exec /bin/sh \;`, the tester can spawn a root shell, escalating privileges because the command runs with sudo (root) privileges.

Answer

Abuse the SUID bit on find

Answer

Exploit a kernel vulnerability

Answer

Run a buffer overflow on the find binary

Question 15

A security engineer notices repeated log entries showing a user account logging in at odd hours and then clearing event logs. The engineer suspects credential theft. Which phase of the CHPSET methodology involves erasing tracks?

Accepted Answer

Erasing tracks. The CHPSET methodology (Cracking passwords, Hiding files, Planting backdoors, Spying, Erasing tracks, and Transferring files) defines the phases of system hacking. Erasing tracks is the phase where attackers clear event logs, modify log files, or use tools like `wevtutil` or `clearlogs.exe` to remove evidence of their activities, matching the engineer's observation of cleared logs after suspicious logins.

Answer

Hiding files

Answer

Spying

Answer

Cracking passwords