CEH Enumeration and System Hacking Practice Test 12 — 15 Questions

Question 1

Which of the following commands would a penetration tester use to enumerate SMB shares on a target Windows machine from a Linux system?

Accepted Answer

smbclient -L // -N. The `smbclient -L // -N` command lists SMB shares on a target Windows machine without requiring a password (null session). This is a standard enumeration technique because SMB uses TCP port 445 and the `-L` flag queries the share list, while `-N` suppresses the password prompt, allowing anonymous access if the target permits null sessions.

Answer

ldapsearch -x -h <IP>

Answer

snmpwalk -v2c -c public <IP>

Answer

nbtstat -A <IP>

Question 2

During a penetration test, an analyst detects that an SNMP agent on a network device is using the default community string 'public'. Which TWO actions can the analyst perform using this information? (Choose TWO.)

Accepted Answer

Enumerate user accounts and system details. The default SNMP community string 'public' typically grants read-only access to the SNMP agent. With read-only access, the analyst can perform an SNMPwalk (using tools like snmpwalk or MIB browsers) to enumerate the entire Management Information Base (MIB) tree, which often includes system details, user accounts, running processes, and network configurations. This enumeration is a key step in the Enumeration phase of a penetration test, as it can reveal sensitive information without authentication.

Answer

Extract encrypted passwords from the device

Answer

Write new configuration to the device

Answer

Disable the SNMP agent remotely

Question 3

A security team is investigating a compromised Linux server. They suspect the attacker used privilege escalation via SUID binaries. Which THREE techniques should the team check as potential attack vectors? (Choose THREE.)

Accepted Answer

Injecting a malicious shared library via LD_PRELOAD into a SUID binary. Option A is correct because LD_PRELOAD can be abused to inject a malicious shared library into a SUID binary, causing the library's code to run with the binary's elevated privileges (though modern loaders ignore LD_PRELOAD for SUID binaries unless the binary is misconfigured or the library path is otherwise trusted). Option C is correct because SUID shell scripts are inherently dangerous: the shell may honor user-controlled environment variables such as PATH, IFS, or command names, letting an attacker execute arbitrary commands with the script's effective UID. Option E is correct because legitimate SUID binaries like nmap (with --interactive) or find (via -exec) can be abused to spawn a shell or run commands as root, a classic GTFOBins privilege-escalation vector. Option B is incorrect because SeDebugPrivilege and token impersonation are Windows access-token concepts, not Linux SUID mechanisms. Option D is incorrect because a DDoS attack targets availability and does not escalate privileges on the compromised Linux host.

Answer

Using token impersonation with SeDebugPrivilege

Answer

Performing a DDoS attack on the server

Question 4

Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)

Accepted Answer

Installing a rootkit. Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.

Answer

Running a vulnerability scanner

Answer

Enabling firewall rules

Answer

Creating new user accounts

Question 5

A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?

Accepted Answer

Perform a NetBIOS name table lookup of the remote host. The command 'nbtstat -A' performs a NetBIOS name table lookup against a remote host using its IP address. It queries the NetBIOS over TCP/IP (NBT) service on UDP port 137 to retrieve the remote machine's NetBIOS name table, which includes the computer name and logged-in user. This is a standard enumeration technique to gather information about Windows hosts on a local network.

Answer

Perform an SNMP walk to enumerate the remote host's MIB

Answer

Execute a dictionary attack against the remote host's passwords

Answer

Enumerate all SMB shares on the remote host

Question 6

During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?

Accepted Answer

Exploit the SUID binary to execute commands as root. The SUID binary owned by root runs with root privileges regardless of the user executing it. Exploiting a vulnerable SUID binary (e.g., via command injection, buffer overflow, or misconfigured capabilities) allows the low-privileged user to execute arbitrary commands as root, directly escalating privileges. This is the most effective method because it leverages a known privilege escalation vector specific to Linux SUID binaries.

Answer

Perform an SMTP VRFY attack to enumerate users

Answer

Use enum4linux to enumerate SMB shares

Answer

Run 'sudo -l' to list sudo privileges

Question 7

A security analyst wants to enumerate all users from an SMTP server. Which of the following SMTP commands can be used for user enumeration?

Accepted Answer

VRFY. The VRFY command is used in SMTP to verify whether a mailbox exists on the server. By issuing VRFY followed by a username, the server typically responds with a 250 code if the user exists or a 550 code if not, enabling user enumeration. This is a recognized technique in security assessments to discover valid email accounts.

Answer

DATA

Answer

MAIL FROM

Answer

HELO

Question 8

During a network assessment, you use SNMPwalk against a target. Which of the following is a prerequisite for successful SNMP enumeration?

Accepted Answer

Knowledge of the SNMP community string. SNMP enumeration relies on the SNMP community string, which acts as a password-like credential for read or read/write access to MIB data. Without the correct community string (defaults are often 'public' for read-only and 'private' for read-write), SNMPwalk cannot authenticate with the target agent and will fail to retrieve any OID values.

Answer

An open TCP port 161

Answer

The target must be running Linux

Answer

A valid username and password

Question 9

An analyst detects an SMB enumeration attempt in network logs. Which of the following tools would MOST likely generate such traffic?

Accepted Answer

enum4linux 192.168.1.1. enum4linux is a tool specifically designed to enumerate SMB (Server Message Block) shares, users, and other information from Windows systems using the SMB protocol. The analyst detected SMB enumeration traffic, which is exactly what enum4linux generates by querying NetBIOS and SMB services (ports 139 and 445).

Answer

nmap -sT 192.168.1.1

Answer

snmpwalk -v 2c 192.168.1.1

Answer

ldapsearch -h 192.168.1.1

Question 10

A penetration tester wants to crack Windows NTLM hashes using rainbow tables. Which tool is specifically designed for this purpose?

Accepted Answer

RainbowCrack. RainbowCrack is specifically designed for cracking hashes using precomputed rainbow tables. It works by performing a lookup in a rainbow table to reverse a hash into its plaintext, which is the core mechanism described in the question. While Hashcat and John the Ripper can also crack NTLM hashes, they are not specifically designed for rainbow table attacks; they primarily use brute-force or dictionary-based methods.

Answer

Hashcat

Answer

John the Ripper

Answer

Ophcrack

Question 11

Which of the following is a passive OS fingerprinting technique?

Accepted Answer

Capturing packets and analyzing TTL values. Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Answer

Using nmap -O

Answer

Performing a ping sweep

Answer

Sending SYN packets and analyzing responses

Question 12

After compromising a Windows system, an attacker wants to cover tracks by deleting event logs. Which command would achieve this?

Accepted Answer

wevtutil cl Security. The wevtutil cl Security command clears the Windows Security event log, which is a standard method for an attacker to cover tracks by removing evidence of their activities. This command is built into Windows and can be executed from the command line with administrative privileges, making it a direct and effective way to delete event logs without relying on external tools.

Answer

del *.log

Answer

rm -rf /var/log/*

Answer

clear-eventlog -Log Security

Question 13

Which of the following is a method of hiding files on a system using steganography?

Accepted Answer

Embedding a secret message in an image file. Steganography is the practice of concealing a secret message within a non-secret file, such as an image, audio, or video file. By embedding data into the least significant bits (LSB) of pixel values in an image, the file appears unchanged to the casual observer, effectively hiding the secret message in plain sight.

Answer

Encrypting a file with AES

Answer

Renaming a file to a system filename

Answer

Using a rootkit to hide processes

Question 14

A security analyst runs the following command: 'smbclient -L //192.168.1.50 -N'. What is the purpose of this command?

Accepted Answer

List available SMB shares on the remote host anonymously. The `smbclient -L` command lists the available SMB shares on a remote host. The `-N` flag suppresses the password prompt, effectively performing an anonymous (null session) enumeration of shares. This is a standard technique in the enumeration phase to discover accessible resources without authentication.

Answer

Connect to the remote host's SMB share with a null password

Answer

Perform a dictionary attack on SMB passwords

Answer

Enumerate users via SMB

Question 15

Which TWO of the following are techniques used to escalate privileges on a Linux system?

Accepted Answer

Exploiting a SUID binary. Option D (Exploiting a SUID binary) is correct because a file with the SUID bit set executes with the privileges of its owner (often root), so a misconfigured or vulnerable SUID program can be abused to run commands as root and escalate from a normal user. Option E (Kernel exploit) is correct because flaws in the Linux kernel (e.g., Dirty COW, Dirty Pipe) allow a local unprivileged user to corrupt kernel memory or abuse syscalls and gain root-level privileges. Option A (SMB relay attack) is not a Linux privilege-escalation technique; it is a network attack that relays captured SMB/NTLM authentication to another host to gain access, typically in Windows/AD environments. Option B (Pass-the-hash attack) is a credential-reuse technique for authenticating with captured NTLM hashes, not a local Linux privilege-escalation method. Option C (Token impersonation) is a Windows access-token abuse technique (e.g., via SeImpersonatePrivilege), not a Linux privilege-escalation technique.

Answer

SMB relay attack

Answer

Pass-the-hash attack

Answer

Token impersonation