CEH Enumeration and System Hacking Practice Test 2 — 15 Questions

Question 1

Which TWO of the following are enumeration techniques used to gather information from Windows systems? (Select 2)

Accepted Answer

SMB enumeration using enum4linux. SMB enumeration using enum4linux is correct because enum4linux is a tool that queries Windows SMB shares, user lists, and OS information via the SMB protocol (ports 139/445). It leverages SMB null sessions to extract data like user accounts, group memberships, and share permissions, making it a standard enumeration technique for Windows systems. NetBIOS enumeration using nbtstat is also correct as NetBIOS is a legacy but still relevant naming service on Windows networks, and `nbtstat` is a built-in Windows command-line utility used to display NetBIOS over TCP/IP protocol statistics, including remote NetBIOS name tables, which can reveal hostnames, workgroup/domain names, and MAC addresses.

Answer

SMTP enumeration using VRFY

Answer

LDAP enumeration using ldapsearch

Answer

NFS enumeration using showmount

Question 2

Which TWO of the following are password cracking techniques? (Select 2)

Accepted Answer

Rainbow table attack. A rainbow table attack is a password cracking technique that uses precomputed hash chains to reverse cryptographic hash functions. Instead of computing hashes on the fly, the attacker matches captured password hashes against a precomputed table of hash values, drastically reducing the time needed to recover plaintext passwords. This is a classic offline attack against hashed passwords, especially effective when salts are not used.

A dictionary attack is another password cracking technique where an attacker attempts to guess a password by trying every word in a pre-compiled list (a dictionary). This can be used against live login forms or, more commonly, against captured password hashes by hashing each dictionary word and comparing it to the target hash. It's effective against weak passwords that are common words or phrases.

Answer

SQL injection

Answer

Phishing

Answer

ARP spoofing

Question 3

In the context of privilege escalation on Windows, what is token impersonation, and which tool is commonly used to exploit it?

Accepted Answer

A technique to assume another user's security context; Incognito. Token impersonation is a privilege escalation technique where an attacker assumes the security context (including privileges and identity) of another user by duplicating or manipulating an existing access token. The Incognito tool is specifically designed to enumerate available tokens on a Windows system and impersonate them, allowing an attacker to escalate privileges to that of a higher-privileged user (e.g., SYSTEM). This is a core technique in post-exploitation after gaining initial access.

Answer

A technique to dump hashes; Hashcat

Answer

A technique to steal session cookies; Mimikatz

Answer

A technique to bypass UAC; Metasploit

Question 4

Which TWO of the following are common methods used to hide files on a compromised system? (Select two.)

Accepted Answer

NTFS Alternate Data Streams. NTFS Alternate Data Streams (ADS) allow files to be hidden within other files by appending a stream name after a colon (e.g., `legit.txt:hidden.exe`). This is a native NTFS feature that does not show the hidden data in standard directory listings (like `dir`), making it a common method for attackers to conceal malicious payloads on a compromised Windows system.

Answer

Rootkits

Answer

Token impersonation

Answer

Log manipulation

Question 5

A security team is investigating a compromised Linux server. They suspect the attacker used privilege escalation via SUID binaries. Which THREE techniques should the team check as potential attack vectors? (Choose THREE.)

Accepted Answer

Injecting a malicious shared library via LD_PRELOAD into a SUID binary. LD_PRELOAD can be used to inject a malicious shared library into a SUID binary if the binary is dynamically linked and the environment is not sanitized. When the SUID binary runs, the loader loads the attacker's library, executing arbitrary code with the binary's elevated privileges. This bypasses normal permission checks and allows privilege escalation.

Exploiting a vulnerable SUID binary (like 'nmap' or 'find') involves using specific functionalities or flaws within these programs (e.g., 'find -exec' or older 'nmap --interactive' modes) to execute arbitrary commands with the elevated privileges of the SUID binary.

Leveraging a SUID shell script that calls a user-controlled command, while SUID on shell scripts is generally ignored by the kernel, refers to scenarios where a SUID *binary* executes a shell script, or a script is part of a SUID context, and that script then calls a command with user-controlled input or path, leading to privilege escalation.

Answer

Using token impersonation with SeDebugPrivilege

Answer

Performing a DDoS attack on the server

Question 6

Which TWO of the following are techniques used to escalate privileges on a Linux system?

Accepted Answer

Exploiting a SUID binary. SUID (Set User ID) binaries execute with the file owner's privileges, typically root. If a misconfigured SUID binary (e.g., one that allows command injection or arbitrary file reads) is exploited, an attacker can escalate from a low-privileged user to root. Common examples include exploiting SUID on binaries like `find`, `nmap`, or custom scripts with weak permissions. A kernel exploit targets vulnerabilities within the operating system's kernel. Successful exploitation can grant an attacker the highest level of privileges (root on Linux) by manipulating kernel data structures or executing arbitrary code in kernel mode, bypassing standard security controls.

Answer

SMB relay attack

Answer

Pass-the-hash attack

Answer

Token impersonation

Question 7

Which TWO of the following tools are used for password cracking?

Accepted Answer

Hashcat. Hashcat and John the Ripper are both widely recognized and powerful password cracking tools. Hashcat is known for its high performance, often leveraging GPU acceleration, and supports a vast array of hash types (e.g., MD5, SHA-1, bcrypt, NTLM). It works by comparing hash values against candidate passwords generated from wordlists, brute-force, or rule-based attacks. John the Ripper (JtR) is another popular open-source password cracker, capable of detecting weak Unix passwords and supporting various hash and cipher types. Both tools are essential for offline password cracking in penetration testing and system hacking.

Answer

Wireshark

Answer

Snmpwalk

Answer

Nmap

Question 8

Which TWO of the following are enumeration techniques?

Accepted Answer

LDAP enumeration. LDAP enumeration is a technique used to query Lightweight Directory Access Protocol (LDAP) directories, such as Microsoft Active Directory, to extract information about users, groups, computers, and network resources. Attackers use tools like ldapsearch or ADSI Edit to anonymously or authenticatedly browse the directory tree, often revealing sensitive data like usernames, email addresses, and group memberships. This is a core enumeration method because it directly targets directory services to gather reconnaissance data. SMTP enumeration involves querying an SMTP server to identify valid user accounts, often using commands like VRFY (verify) or EXPN (expand). This can reveal usernames that can then be used for further attacks like brute-forcing or phishing.

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

SQL injection

Question 9

A security auditor runs SNMPwalk against a network device using the default community string 'public' and obtains extensive system information. Which THREE of the following are effective countermeasures to prevent unauthorized SNMP enumeration?

Accepted Answer

Implement an access control list (ACL) limiting SNMP access to management hosts. Implementing an access control list (ACL) restricts SNMP queries to only authorized management hosts, preventing unauthorized devices from sending SNMP requests to the network device. Changing the community string from 'public' to a complex, unique string significantly increases the difficulty for attackers to guess the credential for SNMPv1/v2c. Upgrading to SNMP version 3 is the most robust solution as it introduces strong authentication (to verify the identity of the sender) and encryption (to protect the confidentiality of data in transit), addressing the fundamental security weaknesses of earlier SNMP versions.

Answer

Disable SNMP entirely on all devices

Answer

Set the community string to 'private' for read-only access

Question 10

A penetration tester successfully gains access to a Linux server as a low-privilege user. The goal is to escalate to root. Which THREE methods could the tester use to achieve privilege escalation?

Accepted Answer

Exploit a vulnerable SUID binary to spawn a root shell. Privilege escalation on Linux involves several common techniques.
1.  **Exploiting vulnerable SUID binaries (Option B):** A vulnerable SUID binary can be exploited to execute arbitrary commands with root privileges. The SUID bit (setuid) allows a binary to run with the permissions of its owner (typically root), so if a binary like 'find' or 'vim' has the SUID bit set and can be tricked into spawning a shell, the tester gains a root shell. This is a classic privilege escalation technique.
2.  **Exploiting sudo misconfigurations (Option C):** If a low-privilege user has `sudo` access, using `sudo -l` can reveal commands they are allowed to run. Misconfigurations, such as `NOPASSWD` for sensitive commands or commands that can be abused (e.g., `vi` or `less` with `sudo` can be used to spawn a shell), can lead to root privileges.
3.  **Running local kernel exploits (Option E):** If the Linux kernel has known vulnerabilities, a local kernel exploit matching the specific kernel version can be compiled and executed to gain root access. This is a highly effective method when applicable.

Options A and D are incorrect. Option A is an enumeration step, not an exploitation method itself. Option D involves checking `/etc/shadow`, which is typically only readable by the root user, making it inaccessible to a low-privilege user without prior escalation.

Answer

Enumerate SUID binaries with 'find / -perm -4000'

Answer

Check /etc/shadow for weak password hashes

Question 11

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

Accepted Answer

nbtstat. The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

Answer

nslookup

Answer

netstat

Answer

net view

Question 12

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

Accepted Answer

Privilege escalation; gain root access. A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

Answer

Information disclosure; read sensitive files

Answer

Denial of service; crash the system

Answer

Buffer overflow; execute arbitrary code

Question 13

A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?

Accepted Answer

Use enum4linux -a 192.168.1.10 to enumerate users and policies. The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.

Answer

Attempt to crack the administrator password using a dictionary attack

Answer

Perform a port scan to check for open ports

Answer

Run snmpwalk to retrieve SNMP community strings

Question 14

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY enumeration. The VRFY command is an SMTP command defined in RFC 821 that asks the server to verify whether a given email address exists. When the server responds with '250 OK' for a valid address and '550 No such user' for an invalid one, the attacker is directly using the VRFY command to enumerate valid users. This is explicitly known as VRFY enumeration.

Answer

EXPN enumeration

Answer

SMTP banner grabbing

Answer

RCPT TO enumeration

Question 15

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

Accepted Answer

Erasing tracks. The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

Answer

Spying

Answer

Executing applications

Answer

Cracking passwords