CEH Enumeration and System Hacking Practice Test 2 — 15 Questions

Question 1

A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?

Accepted Answer

NetBIOS names and their associated service types. The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.

Answer

SMB share lists and open sessions

Answer

DNS records for the host and domain

Answer

ARP cache entries for the subnet

Question 2

During a penetration test, you execute the command `enum4linux -a 192.168.1.20`. The output reveals that the 'backup' account has a blank password and belongs to the 'Domain Admins' group. Which phase of the CHPSET methodology does identifying this vulnerability belong to?

Accepted Answer

Cracking passwords. The command `enum4linux -a` enumerates SMB shares, users, and password policies from a Windows target. Discovering that the 'backup' account has a blank password directly identifies a weak or missing credential, which falls under the 'Cracking passwords' phase of the CHPSET methodology. This phase involves identifying and exploiting weak, default, or blank passwords to gain unauthorized access.

Answer

Privilege escalation

Answer

Spying

Answer

Executing applications

Question 3

A forensic analyst examining a compromised Linux system finds the following entry in /var/log/auth.log: `Mar 15 10:23:45 server sshd[1234]: Accepted password for root from 10.0.0.5 port 54321 ssh2`. However, the analyst also notices that /var/log/auth.log has been truncated and the /etc/ssh/sshd_config file contains `LogLevel QUIET`. Which attack phase is most likely being obscured?

Accepted Answer

Erasing tracks. The presence of `LogLevel QUIET` in sshd_config suppresses all authentication log entries, and the truncation of /var/log/auth.log indicates an attempt to remove evidence of unauthorized access. Together, these actions are classic examples of erasing tracks, as the attacker is modifying logs and configuration to hide their activities from forensic analysis.

Answer

Privilege escalation

Answer

Executing applications

Answer

Spying

Question 4

An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?

Accepted Answer

Token impersonation using RottenPotato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

SUID abuse

Question 5

A system administrator wants to enumerate all users in an Active Directory domain. Which protocol and query technique should they use?

Accepted Answer

LDAP anonymous query. Option D is correct because LDAP anonymous queries allow unauthenticated users to query an Active Directory domain for directory information, including user enumeration. By default, AD permits anonymous LDAP binds to retrieve attributes like sAMAccountName, userPrincipalName, and group memberships, making it a standard technique for enumerating users without credentials.

Answer

SNMP with public community string

Answer

SMB null session

Answer

SMTP VRFY

Question 6

A penetration tester runs `snmpwalk -c public -v2c 192.168.1.50 1.3.6.1.2.1.1` and receives a list of system descriptions, uptime, and contact information. Which type of information is the tester primarily gathering?

Accepted Answer

System information and version details. The `snmpwalk` command with the OID `1.3.6.1.2.1.1` (the system group in MIB-II, defined in RFC 1213) queries the SNMP agent for system-level information. The output includes system description, uptime, contact, and version details, which are all part of the system group. This is a classic enumeration technique to gather system information and version details from a target device using SNMP with the default public community string.

Answer

SMB share names and permissions

Answer

Network topology and routing tables

Answer

Active directory users and groups

Question 7

During a penetration test, you run `smtp-user-enum -M VRFY -U users.txt -t 10.0.0.10` and receive responses '252 2.5.2 User <username>' for some users and '550 5.1.1 User unknown' for others. What does this indicate?

Accepted Answer

The SMTP server is revealing valid usernames via the VRFY command. The VRFY command in SMTP (RFC 821) asks the server to verify whether a mailbox exists. A response starting with '252' indicates the user is valid, while '550 5.1.1' means the user does not exist. By comparing these responses, the attacker can enumerate valid usernames on the mail server, which is exactly what the output shows.

Answer

The SMTP server is using EXPN instead of VRFY

Answer

The SMTP server is vulnerable to command injection

Answer

The SMTP server is properly configured to prevent enumeration

Question 8

An attacker has obtained password hashes from a Windows system. They plan to use rainbow tables to crack them. Which tool would be most appropriate for generating and using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is the tool specifically designed for generating and using rainbow tables, which are precomputed hash chains used to reverse cryptographic hash functions. The question explicitly asks for the tool most appropriate for generating and using rainbow tables, and RainbowCrack directly supports both creating rainbow tables (with rtgen) and performing lookups (with rcsort and rcrack).

Answer

Hashcat

Answer

Ophcrack

Answer

John the Ripper

Question 9

Which of the following tools is specifically used to enumerate SMB shares and retrieve file listings from Windows systems?

Accepted Answer

smbclient. smbclient is a tool from the Samba suite specifically designed to interact with SMB/CIFS shares. It allows an attacker to enumerate available shares on a Windows target and retrieve file listings by connecting to the SMB service (port 445 or 139) using commands like 'smbclient -L //target' or by mounting a share and listing its contents.

Answer

ldapsearch

Answer

snmpwalk

Answer

nmap

Question 10

A security administrator notices repeated failed login attempts from a single IP address targeting the SSH service. The attempts use common usernames (root, admin, test) and a list of passwords from a dictionary. What type of password attack is being conducted?

Accepted Answer

Dictionary attack. This is a dictionary attack because the attacker uses a predefined list of common usernames and passwords (a dictionary) against the SSH service. Unlike a brute-force attack that tries all possible combinations, a dictionary attack only tests likely entries from a wordlist, making it faster but limited to the dictionary's contents.

Answer

Rainbow table attack

Answer

Hybrid attack

Answer

Brute-force attack

Question 11

A Linux system has a script named 'backup' owned by root with the SUID bit set and world-executable permissions. A standard user executes the script and discovers it runs a command that reads /etc/shadow and writes output to a world-readable file. What is the most likely intended exploitation path?

Accepted Answer

SUID abuse to read sensitive files. Option C is correct because the SUID bit on the 'backup' script, owned by root and world-executable, allows any user to execute it with root privileges. If the script reads /etc/shadow (which is normally root-only) and writes the output to a world-readable file, an attacker can exploit this to exfiltrate password hashes. This is a classic SUID abuse scenario where a privileged binary or script is used to access sensitive files.

Answer

GUID abuse

Answer

LD_PRELOAD injection

Answer

Token impersonation

Question 12

An incident responder finds that the Windows Event Logs on a compromised server have been cleared, and the Security log shows gaps in coverage. Additionally, a rootkit is suspected. Which phase of the hacking methodology does the clearing of logs represent?

Accepted Answer

Erasing tracks. Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

Answer

Privilege escalation

Answer

Cracking passwords

Answer

Executing applications

Question 13

Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)

Accepted Answer

smbclient. smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Windows file shares. It can list available shares with the `-L` option and, with valid credentials, enumerate users via the `-U` flag or by browsing the IPC$ share. This makes it a direct tool for SMB enumeration.

Answer

nslookup

Answer

snmpwalk

Answer

ldapsearch

Question 14

Which THREE of the following are valid techniques in the system hacking methodology (CHPSET)? (Choose three.)

Accepted Answer

Privilege escalation. Privilege escalation is a core phase in the CEH system hacking methodology (CHPSET), which stands for Cracking, Hacking, Privilege Escalation, System Hacking, Erasing Tracks, and Tunneling. After initial access is gained, an attacker must escalate privileges (e.g., from a standard user to root or SYSTEM) to gain full control over the target system. This is achieved through techniques like exploiting kernel vulnerabilities, token manipulation, or using tools such as Metasploit's getsystem.

Answer

Social engineering

Answer

Network sniffing

Question 15

A penetration tester obtains password hashes from a Windows system. Which TWO methods would be most efficient for cracking NTLM hashes offline? (Choose two.)

Accepted Answer

Using Hashcat with a brute-force attack on GPU. Option D is correct because Hashcat, when used with a GPU, can perform massively parallel brute-force attacks against NTLM hashes, achieving billions of hash calculations per second. This makes it one of the most efficient tools for offline password cracking of NTLM hashes, especially when the password is not in a dictionary.

Answer

Using RainbowCrack with precomputed rainbow tables for NTLM

Answer

Performing an online brute-force against the SAM database

Answer

Using Ophcrack with rainbow tables for NTLM