CEH Enumeration and System Hacking Practice Test 12 — 15 Questions

Question 1

In the context of system hacking methodology (CHPSET), which phase involves removing evidence of the attacker's activities from logs and system files?

Accepted Answer

Erasing tracks. In the CEH system hacking methodology (CHPSET), the 'Erasing tracks' phase is specifically defined as the step where attackers remove evidence of their activities, such as clearing logs, modifying timestamps, or deleting system files. This ensures that intrusion detection systems or system administrators cannot trace the attack back to the source.

Answer

Spying

Answer

Privilege escalation

Answer

Cracking passwords

Question 2

An attacker successfully escalates privileges on a Windows server using a known vulnerability in the Print Spooler service (PrintNightmare). Which type of privilege escalation does this represent?

Accepted Answer

Local exploit in a service. The PrintNightmare vulnerability (CVE-2021-34527) allows an attacker to execute arbitrary code with SYSTEM privileges via the Windows Print Spooler service. Since the attacker exploits a vulnerability in a running service (spoolsv.exe) to elevate from a lower-privileged user to SYSTEM, this is a classic local exploit in a service. The attack does not involve hijacking DLLs, abusing SUID bits (a Unix concept), or impersonating tokens, making option A the correct classification.

Answer

DLL hijacking

Answer

SUID abuse

Answer

Token impersonation

Question 3

Which of the following commands would a penetration tester use to enumerate SMB shares on a target Windows machine from a Linux system?

Accepted Answer

smbclient -L // -N. The `smbclient -L // -N` command lists SMB shares on a target Windows machine without requiring a password (null session). This is a standard enumeration technique because SMB uses TCP port 445 and the `-L` flag queries the share list, while `-N` suppresses the password prompt, allowing anonymous access if the target permits null sessions.

Answer

ldapsearch -x -h <IP>

Answer

snmpwalk -v2c -c public <IP>

Answer

nbtstat -A <IP>

Question 4

During a penetration test, an analyst detects that an SNMP agent on a network device is using the default community string 'public'. Which TWO actions can the analyst perform using this information? (Choose TWO.)

Accepted Answer

Enumerate user accounts and system details. The default SNMP community string 'public' typically grants read-only access to the SNMP agent. With read-only access, the analyst can perform an SNMPwalk (using tools like snmpwalk or MIB browsers) to enumerate the entire Management Information Base (MIB) tree, which often includes system details, user accounts, running processes, and network configurations. This enumeration is a key step in the Enumeration phase of a penetration test, as it can reveal sensitive information without authentication.

Answer

Extract encrypted passwords from the device

Answer

Write new configuration to the device

Answer

Disable the SNMP agent remotely

Question 5

Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)

Accepted Answer

Installing a rootkit. Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.

Answer

Running a vulnerability scanner

Answer

Enabling firewall rules

Answer

Creating new user accounts

Question 6

A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?

Accepted Answer

Perform a NetBIOS name table lookup of the remote host. The command 'nbtstat -A' performs a NetBIOS name table lookup against a remote host using its IP address. It queries the NetBIOS over TCP/IP (NBT) service on UDP port 137 to retrieve the remote machine's NetBIOS name table, which includes the computer name and logged-in user. This is a standard enumeration technique to gather information about Windows hosts on a local network.

Answer

Perform an SNMP walk to enumerate the remote host's MIB

Answer

Execute a dictionary attack against the remote host's passwords

Answer

Enumerate all SMB shares on the remote host

Question 7

During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?

Accepted Answer

Exploit the SUID binary to execute commands as root. The SUID binary owned by root runs with root privileges regardless of the user executing it. Exploiting a vulnerable SUID binary (e.g., via command injection, buffer overflow, or misconfigured capabilities) allows the low-privileged user to execute arbitrary commands as root, directly escalating privileges. This is the most effective method because it leverages a known privilege escalation vector specific to Linux SUID binaries.

Answer

Perform an SMTP VRFY attack to enumerate users

Answer

Use enum4linux to enumerate SMB shares

Answer

Run 'sudo -l' to list sudo privileges

Question 8

A security analyst wants to enumerate all users from an SMTP server. Which of the following SMTP commands can be used for user enumeration?

Accepted Answer

VRFY. The VRFY command is used in SMTP to verify whether a mailbox exists on the server. By issuing VRFY followed by a username, the server typically responds with a 250 code if the user exists or a 550 code if not, enabling user enumeration. This is a recognized technique in security assessments to discover valid email accounts.

Answer

DATA

Answer

MAIL FROM

Answer

HELO

Question 9

During a network assessment, you use SNMPwalk against a target. Which of the following is a prerequisite for successful SNMP enumeration?

Accepted Answer

Knowledge of the SNMP community string. SNMP enumeration relies on the SNMP community string, which acts as a password-like credential for read or read/write access to MIB data. Without the correct community string (defaults are often 'public' for read-only and 'private' for read-write), SNMPwalk cannot authenticate with the target agent and will fail to retrieve any OID values.

Answer

An open TCP port 161

Answer

The target must be running Linux

Answer

A valid username and password

Question 10

An analyst detects an SMB enumeration attempt in network logs. Which of the following tools would MOST likely generate such traffic?

Accepted Answer

enum4linux 192.168.1.1. enum4linux is a tool specifically designed to enumerate SMB (Server Message Block) shares, users, and other information from Windows systems using the SMB protocol. The analyst detected SMB enumeration traffic, which is exactly what enum4linux generates by querying NetBIOS and SMB services (ports 139 and 445).

Answer

nmap -sT 192.168.1.1

Answer

snmpwalk -v 2c 192.168.1.1

Answer

ldapsearch -h 192.168.1.1

Question 11

A penetration tester wants to crack Windows NTLM hashes using rainbow tables. Which tool is specifically designed for this purpose?

Accepted Answer

RainbowCrack. RainbowCrack is specifically designed for cracking hashes using precomputed rainbow tables. It works by performing a lookup in a rainbow table to reverse a hash into its plaintext, which is the core mechanism described in the question. While Hashcat and John the Ripper can also crack NTLM hashes, they are not specifically designed for rainbow table attacks; they primarily use brute-force or dictionary-based methods.

Answer

Hashcat

Answer

John the Ripper

Answer

Ophcrack

Question 12

Which of the following is a passive OS fingerprinting technique?

Accepted Answer

Capturing packets and analyzing TTL values. Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Answer

Using nmap -O

Answer

Performing a ping sweep

Answer

Sending SYN packets and analyzing responses

Question 13

After compromising a Windows system, an attacker wants to cover tracks by deleting event logs. Which command would achieve this?

Accepted Answer

wevtutil cl Security. The wevtutil cl Security command clears the Windows Security event log, which is a standard method for an attacker to cover tracks by removing evidence of their activities. This command is built into Windows and can be executed from the command line with administrative privileges, making it a direct and effective way to delete event logs without relying on external tools.

Answer

del *.log

Answer

rm -rf /var/log/*

Answer

clear-eventlog -Log Security

Question 14

Which of the following is a method of hiding files on a system using steganography?

Accepted Answer

Embedding a secret message in an image file. Steganography is the practice of concealing a secret message within a non-secret file, such as an image, audio, or video file. By embedding data into the least significant bits (LSB) of pixel values in an image, the file appears unchanged to the casual observer, effectively hiding the secret message in plain sight.

Answer

Encrypting a file with AES

Answer

Renaming a file to a system filename

Answer

Using a rootkit to hide processes

Question 15

A security analyst runs the following command: 'smbclient -L //192.168.1.50 -N'. What is the purpose of this command?

Accepted Answer

List available SMB shares on the remote host anonymously. The `smbclient -L` command lists the available SMB shares on a remote host. The `-N` flag suppresses the password prompt, effectively performing an anonymous (null session) enumeration of shares. This is a standard technique in the enumeration phase to discover accessible resources without authentication.

Answer

Connect to the remote host's SMB share with a null password

Answer

Perform a dictionary attack on SMB passwords

Answer

Enumerate users via SMB