CEH Enumeration and System Hacking Practice Test 11 — 15 Questions

Question 1

A penetration tester uses `smbclient -L //192.168.1.30 -N` and receives a list of shares including a hidden administrative share (C$) and a user share named "Backup". What is the most immediate security concern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Null session enumeration is possible, allowing information gathering. The `-N` flag in the `smbclient` command suppresses password prompts, enabling a null session connection. The fact that the command successfully lists shares without authentication indicates that null session enumeration is permitted, which is a critical security flaw. This allows an attacker to gather sensitive information (share names, user lists, etc.) without any credentials, often serving as the first step in a targeted attack.

Answer

The Backup share may contain sensitive data

Answer

SMB signing is not enabled

Answer

The C$ share is a default administrative share

Question 2

Which type of password cracking attack uses a precomputed table of hash chains to reverse hashes quickly?

Accepted Answer

Rainbow table attack. A rainbow table attack is correct because it uses a precomputed table of hash chains to reverse hashes quickly. Rainbow tables reduce the time needed for cracking by storing chains of hash values that allow for efficient lookup, trading off storage space for computational speed. This technique is specifically designed to reverse cryptographic hash functions like LM, NTLM, or MD5 without performing brute-force or dictionary lookups for each attempt.

Answer

Dictionary attack

Answer

Brute-force attack

Answer

Hybrid attack

Question 3

An attacker modifies system logs to remove entries related to their activities. Which technique is being used to cover tracks?

Accepted Answer

Log manipulation. Log manipulation is the correct answer because it directly involves altering or deleting log entries to hide evidence of unauthorized activities. Attackers often use this technique to remove traces of their actions from system logs, such as event logs in Windows or syslog files in Linux, thereby covering their tracks and avoiding detection.

Answer

Token impersonation

Answer

Steganography

Answer

Rootkit installation

Question 4

A forensic analyst finds a system where the user's password hash was obtained and cracked offline. The attacker then used stolen credentials to log in and run `wevtutil cl system`. What is the purpose of this command?

Accepted Answer

Clear the System event log. The `wevtutil cl system` command clears the System event log on Windows. After cracking the user's password hash offline, the attacker logs in with stolen credentials and runs this command to erase forensic evidence of their activities, such as logon events or service failures, from the System log. This is a common post-exploitation step to hinder incident response.

Answer

Remove scheduled tasks

Answer

Delete the SAM database

Answer

Disable Windows Defender

Question 5

A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)

Accepted Answer

enum4linux. enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.

Answer

John the Ripper

Answer

SNMPwalk

Answer

Nmap

Question 6

During a penetration test, the tester successfully cracks a password hash using a hybrid attack. Which THREE characteristics describe a hybrid attack? (Select three.)

Accepted Answer

Applies mutations like appending numbers or symbols. A hybrid attack applies mutations such as appending numbers or symbols to dictionary words, which is a core characteristic of this attack type. This technique combines the efficiency of a wordlist with the flexibility of brute-force modifications, making it effective against passwords that follow common patterns like 'password123'.

Answer

Tries every possible combination of characters

Answer

Relies on precomputed hash chains

Question 7

A penetration tester runs `nbtstat -A 192.168.1.10` on a Windows machine. The output reveals the NetBIOS name table and shows a <20> entry. What does this indicate?

Accepted Answer

The target is a file server. The <20> entry in the NetBIOS name table indicates that the target machine is running the File Server service, which is a NetBIOS service type for file sharing. The `nbtstat -A` command queries the remote NetBIOS name table, and the <20> hex code specifically maps to the 'File Server Service' (also known as the 'Server' service) in the NetBIOS naming convention, as defined in RFC 1001/1002. This service is essential for SMB-based file sharing, making the target a file server.

Answer

The target is a printer

Answer

The target is a domain controller

Answer

The target is a workstation

Question 8

During an internal penetration test, an analyst uses `enum4linux -a 10.0.0.5` and retrieves a list of local users, including an account named 'sqlsvc'. The analyst then attempts to crack the password using a dictionary attack. Which password cracking tool would be most efficient for this task?

Accepted Answer

John the Ripper. John the Ripper is the most efficient tool for performing a dictionary attack against password hashes retrieved from a system, such as those obtained from the SAM database or via enum4linux. It supports a wide range of hash types and can be configured to use custom wordlists, making it ideal for cracking the 'sqlsvc' account password in an internal penetration test.

Answer

RainbowCrack

Answer

SNMPwalk

Answer

Ophcrack

Question 9

Which enumeration technique would be MOST effective for gathering usernames from an SMTP server that supports the VRFY command?

Accepted Answer

SMTP VRFY enumeration. The VRFY command is an SMTP protocol command (RFC 821) that allows a client to verify whether a specific mailbox exists on the server. Since the question explicitly states the SMTP server supports VRFY, sending VRFY requests with common usernames or using a wordlist directly enumerates valid usernames, making SMTP VRFY enumeration the most effective technique.

Answer

SNMP enumeration using SNMPwalk

Answer

NetBIOS enumeration using nbtstat

Answer

LDAP anonymous queries

Question 10

After gaining initial access to a Linux server, an attacker runs `find / -perm -4000 -o -perm -2000 2>/dev/null`. What is the primary objective of this command?

Accepted Answer

Identify files with SUID or GUID bits set for privilege escalation. The command `find / -perm -4000 -o -perm -2000 2>/dev/null` searches the entire filesystem for files with the SUID (setuid, permission 4000) or SGID (setgid, permission 2000) bits set. These special permission bits allow a file to execute with the privileges of its owner (often root) or group, respectively. An attacker's primary objective is to identify such files because they can be exploited to escalate privileges from a low-privileged user to a higher-privileged user (e.g., root) by running a vulnerable SUID/SGID binary.

Answer

Locate world-writable files for data exfiltration

Answer

List all files owned by the root user

Answer

Find configuration files containing passwords

Question 11

A security analyst observes repeated log entries showing `EXPN` commands from an external IP address to the company's mail server. What is the MOST likely objective of this activity?

Accepted Answer

Enumerating valid email addresses and mailing list members. The `EXPN` command is part of the SMTP protocol (RFC 5321) and is used to expand a mailing list or alias, revealing the individual email addresses that belong to it. By repeatedly issuing `EXPN` commands, an attacker can enumerate valid email addresses and mailing list members, which is a reconnaissance technique for gathering targets for phishing or social engineering. This aligns with the enumeration phase of system hacking, where the goal is to extract user and service information.

Answer

Testing SMTP authentication mechanisms

Answer

Attempting to perform a denial-of-service attack

Answer

Delivering spam emails through open relay

Question 12

Which tool is specifically designed to perform SNMP enumeration by walking the MIB tree using a known community string?

Accepted Answer

SNMPwalk. SNMPwalk is the correct tool because it is specifically designed to perform SNMP enumeration by walking the Management Information Base (MIB) tree using a known community string (e.g., 'public' or 'private'). It sends successive GETNEXT requests to retrieve all OID values from the SNMP agent, effectively dumping the entire MIB tree for reconnaissance.

Answer

enum4linux

Answer

nbtstat

Answer

smbclient

Question 13

During a penetration test, an analyst obtains a dump of password hashes from a Windows server. The hashes are in LM:NT format. The analyst wants to crack the NT portion using a brute-force attack on 8-character alphanumeric passwords. Which tool is BEST suited for this task?

Accepted Answer

Hashcat. Hashcat is the best tool for this task because it is optimized for high-speed GPU-accelerated brute-force attacks, making it ideal for cracking 8-character alphanumeric NT hashes. It supports the LM:NT format natively and allows precise control over attack modes, including brute-force with custom character sets, which is essential for exhaustive enumeration of 62^8 possibilities.

Answer

John the Ripper

Answer

RainbowCrack

Answer

Ophcrack

Question 14

An attacker has compromised a Linux machine and wants to hide a rootkit by replacing system binaries with trojaned versions. Which technique is being used to maintain persistent access while evading detection?

Accepted Answer

Rootkit installation via binary replacement. Replacing system binaries (e.g., `ls`, `ps`, `netstat`) with trojaned versions is a classic rootkit technique. The rootkit intercepts system calls or filters output to hide its own processes, files, and network connections, allowing the attacker to maintain persistent access while evading detection by standard administrative tools.

Answer

Log manipulation

Answer

Token impersonation

Answer

Steganography

Question 15

A security analyst runs `ldapsearch -x -h 10.0.0.3 -b "dc=company,dc=com"` and receives a large number of entries including user objects. What type of information is being collected?

Accepted Answer

Active Directory users and attributes. The `ldapsearch` command with the `-x` flag (simple authentication) and `-b` base DN `"dc=company,dc=com"` performs an LDAP query against the specified server (10.0.0.3). LDAP is the protocol used to query and retrieve directory services, and in a Windows environment, Active Directory exposes user objects, groups, and their attributes via LDAP. Therefore, the output contains Active Directory users and their associated attributes, making D correct.

Answer

SMB share listings

Answer

SNMP MIB values

Answer

NetBIOS names and MAC addresses