CEH Enumeration and System Hacking Practice Test 11 — 15 Questions

Question 1

In the context of privilege escalation on Windows, what is token impersonation, and which tool is commonly used to exploit it?

Accepted Answer

A technique to assume another user's security context; Incognito. Token impersonation is a privilege escalation technique where an attacker assumes the security context (including privileges and identity) of another user by duplicating or manipulating an existing access token. The Incognito tool is specifically designed to enumerate available tokens on a Windows system and impersonate them, allowing an attacker to escalate privileges to that of a higher-privileged user (e.g., SYSTEM). This is a core technique in post-exploitation after gaining initial access.

Answer

A technique to dump hashes; Hashcat

Answer

A technique to steal session cookies; Mimikatz

Answer

A technique to bypass UAC; Metasploit

Question 2

A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)

Accepted Answer

enum4linux. enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.

Answer

John the Ripper

Answer

SNMPwalk

Answer

Nmap

Question 3

During a penetration test, the tester successfully cracks a password hash using a hybrid attack. Which THREE characteristics describe a hybrid attack? (Select three.)

Accepted Answer

Applies mutations like appending numbers or symbols. A hybrid attack applies mutations such as appending numbers or symbols to dictionary words, which is a core characteristic of this attack type. This technique combines the efficiency of a wordlist with the flexibility of brute-force modifications, making it effective against passwords that follow common patterns like 'password123'.

Answer

Tries every possible combination of characters

Answer

Relies on precomputed hash chains

Question 4

Which TWO of the following are common methods used to hide files on a compromised system? (Select two.)

Accepted Answer

NTFS Alternate Data Streams. NTFS Alternate Data Streams (option C) are a Windows file-system feature that lets extra data be attached to an existing file without changing its visible size or content, so an attacker can hide payloads or exfiltrated data behind a legitimate-looking file. Steganography (option E) conceals data inside other files such as images, audio, or video, making the hidden content difficult to detect without specialized analysis. Rootkits (option A) are used to hide the presence of malware, processes, or files by subverting the OS, but they are not themselves a file-hiding method in the same direct sense as ADS or steganography. Token impersonation (option B) is a privilege-escalation and lateral-movement technique that steals another user's access token, not a file-hiding method. Log manipulation (option D) is an anti-forensic technique for altering or deleting audit records, not for concealing files on disk.

Answer

Rootkits

Answer

Token impersonation

Answer

Log manipulation

Question 5

A penetration tester runs `nbtstat -A 192.168.1.10` on a Windows machine. The output reveals the NetBIOS name table and shows a <20> entry. What does this indicate?

Accepted Answer

The target is a file server. The <20> entry in the NetBIOS name table indicates that the target machine is running the File Server service, which is a NetBIOS service type for file sharing. The `nbtstat -A` command queries the remote NetBIOS name table, and the <20> hex code specifically maps to the 'File Server Service' (also known as the 'Server' service) in the NetBIOS naming convention, as defined in RFC 1001/1002. This service is essential for SMB-based file sharing, making the target a file server.

Answer

The target is a printer

Answer

The target is a domain controller

Answer

The target is a workstation

Question 6

During an internal penetration test, an analyst uses `enum4linux -a 10.0.0.5` and retrieves a list of local users, including an account named 'sqlsvc'. The analyst then attempts to crack the password using a dictionary attack. Which password cracking tool would be most efficient for this task?

Accepted Answer

John the Ripper. John the Ripper is the most efficient tool for performing a dictionary attack against password hashes retrieved from a system, such as those obtained from the SAM database or via enum4linux. It supports a wide range of hash types and can be configured to use custom wordlists, making it ideal for cracking the 'sqlsvc' account password in an internal penetration test.

Answer

RainbowCrack

Answer

SNMPwalk

Answer

Ophcrack

Question 7

Which enumeration technique would be MOST effective for gathering usernames from an SMTP server that supports the VRFY command?

Accepted Answer

SMTP VRFY enumeration. The VRFY command is an SMTP protocol command (RFC 821) that allows a client to verify whether a specific mailbox exists on the server. Since the question explicitly states the SMTP server supports VRFY, sending VRFY requests with common usernames or using a wordlist directly enumerates valid usernames, making SMTP VRFY enumeration the most effective technique.

Answer

SNMP enumeration using SNMPwalk

Answer

NetBIOS enumeration using nbtstat

Answer

LDAP anonymous queries

Question 8

After gaining initial access to a Linux server, an attacker runs `find / -perm -4000 -o -perm -2000 2>/dev/null`. What is the primary objective of this command?

Accepted Answer

Identify files with SUID or GUID bits set for privilege escalation. The command `find / -perm -4000 -o -perm -2000 2>/dev/null` searches the entire filesystem for files with the SUID (setuid, permission 4000) or SGID (setgid, permission 2000) bits set. These special permission bits allow a file to execute with the privileges of its owner (often root) or group, respectively. An attacker's primary objective is to identify such files because they can be exploited to escalate privileges from a low-privileged user to a higher-privileged user (e.g., root) by running a vulnerable SUID/SGID binary.

Answer

Locate world-writable files for data exfiltration

Answer

List all files owned by the root user

Answer

Find configuration files containing passwords

Question 9

A security analyst observes repeated log entries showing `EXPN` commands from an external IP address to the company's mail server. What is the MOST likely objective of this activity?

Accepted Answer

Enumerating valid email addresses and mailing list members. The `EXPN` command is part of the SMTP protocol (RFC 5321) and is used to expand a mailing list or alias, revealing the individual email addresses that belong to it. By repeatedly issuing `EXPN` commands, an attacker can enumerate valid email addresses and mailing list members, which is a reconnaissance technique for gathering targets for phishing or social engineering. This aligns with the enumeration phase of system hacking, where the goal is to extract user and service information.

Answer

Testing SMTP authentication mechanisms

Answer

Attempting to perform a denial-of-service attack

Answer

Delivering spam emails through open relay

Question 10

Which tool is specifically designed to perform SNMP enumeration by walking the MIB tree using a known community string?

Accepted Answer

SNMPwalk. SNMPwalk is the correct tool because it is specifically designed to perform SNMP enumeration by walking the Management Information Base (MIB) tree using a known community string (e.g., 'public' or 'private'). It sends successive GETNEXT requests to retrieve all OID values from the SNMP agent, effectively dumping the entire MIB tree for reconnaissance.

Answer

enum4linux

Answer

nbtstat

Answer

smbclient

Question 11

During a penetration test, an analyst obtains a dump of password hashes from a Windows server. The hashes are in LM:NT format. The analyst wants to crack the NT portion using a brute-force attack on 8-character alphanumeric passwords. Which tool is BEST suited for this task?

Accepted Answer

Hashcat. Hashcat is the best tool for this task because it is optimized for high-speed GPU-accelerated brute-force attacks, making it ideal for cracking 8-character alphanumeric NT hashes. It supports the LM:NT format natively and allows precise control over attack modes, including brute-force with custom character sets, which is essential for exhaustive enumeration of 62^8 possibilities.

Answer

John the Ripper

Answer

RainbowCrack

Answer

Ophcrack

Question 12

An attacker has compromised a Linux machine and wants to hide a rootkit by replacing system binaries with trojaned versions. Which technique is being used to maintain persistent access while evading detection?

Accepted Answer

Rootkit installation via binary replacement. Replacing system binaries (e.g., `ls`, `ps`, `netstat`) with trojaned versions is a classic rootkit technique. The rootkit intercepts system calls or filters output to hide its own processes, files, and network connections, allowing the attacker to maintain persistent access while evading detection by standard administrative tools.

Answer

Log manipulation

Answer

Token impersonation

Answer

Steganography

Question 13

A security analyst runs `ldapsearch -x -h 10.0.0.3 -b "dc=company,dc=com"` and receives a large number of entries including user objects. What type of information is being collected?

Accepted Answer

Active Directory users and attributes. The `ldapsearch` command with the `-x` flag (simple authentication) and `-b` base DN `"dc=company,dc=com"` performs an LDAP query against the specified server (10.0.0.3). LDAP is the protocol used to query and retrieve directory services, and in a Windows environment, Active Directory exposes user objects, groups, and their attributes via LDAP. Therefore, the output contains Active Directory users and their associated attributes, making D correct.

Answer

SMB share listings

Answer

SNMP MIB values

Answer

NetBIOS names and MAC addresses

Question 14

In the context of system hacking methodology (CHPSET), which phase involves removing evidence of the attacker's activities from logs and system files?

Accepted Answer

Erasing tracks. In the CEH system hacking methodology (CHPSET), the 'Erasing tracks' phase is specifically defined as the step where attackers remove evidence of their activities, such as clearing logs, modifying timestamps, or deleting system files. This ensures that intrusion detection systems or system administrators cannot trace the attack back to the source.

Answer

Spying

Answer

Privilege escalation

Answer

Cracking passwords

Question 15

An attacker successfully escalates privileges on a Windows server using a known vulnerability in the Print Spooler service (PrintNightmare). Which type of privilege escalation does this represent?

Accepted Answer

Local exploit in a service. The PrintNightmare vulnerability (CVE-2021-34527) allows an attacker to execute arbitrary code with SYSTEM privileges via the Windows Print Spooler service. Since the attacker exploits a vulnerability in a running service (spoolsv.exe) to elevate from a lower-privileged user to SYSTEM, this is a classic local exploit in a service. The attack does not involve hijacking DLLs, abusing SUID bits (a Unix concept), or impersonating tokens, making option A the correct classification.

Answer

DLL hijacking

Answer

SUID abuse

Answer

Token impersonation