CEH Enumeration and System Hacking Practice Test 2 — 15 Questions

Question 1

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Privilege escalation; gain root access. A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

Answer

Information disclosure; read sensitive files

Answer

Denial of service; crash the system

Answer

Buffer overflow; execute arbitrary code

Question 2

A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?

Accepted Answer

Use enum4linux -a 192.168.1.10 to enumerate users and policies. The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.

Answer

Attempt to crack the administrator password using a dictionary attack

Answer

Perform a port scan to check for open ports

Answer

Run snmpwalk to retrieve SNMP community strings

Question 3

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY enumeration. The VRFY command is an SMTP command defined in RFC 821 that asks the server to verify whether a given email address exists. When the server responds with '250 OK' for a valid address and '550 No such user' for an invalid one, the attacker is directly using the VRFY command to enumerate valid users. This is explicitly known as VRFY enumeration.

Answer

EXPN enumeration

Answer

SMTP banner grabbing

Answer

RCPT TO enumeration

Question 4

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

Accepted Answer

Erasing tracks. The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

Answer

Spying

Answer

Executing applications

Answer

Cracking passwords

Question 5

Which of the following tools is specifically designed to perform password cracking using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.

Answer

John the Ripper

Answer

Ophcrack

Answer

Hashcat

Question 6

A penetration tester executes the command: snmpwalk -c public -v2c 192.168.1.50. Which of the following BEST describes the purpose of this command?

Accepted Answer

Enumerate the MIB tree of the SNMP agent using the 'public' community string. The `snmpwalk` command is used to retrieve a subtree of management information from an SNMP agent. By specifying `-c public` (the community string) and `-v2c` (SNMP version 2c), the command performs a GETNEXT request cycle to walk the entire MIB tree, enumerating all accessible OIDs and their values. Option D correctly identifies this as enumerating the MIB tree using the 'public' community string.

Answer

Modify SNMP settings on the remote device

Answer

Perform a brute-force attack on the SNMP community string

Answer

Test the SNMP agent for denial of service vulnerabilities

Question 7

A security analyst is investigating a compromised Linux system. The /var/log/auth.log file appears to be truncated, and the timestamps on several binaries in /bin/ have been modified. Which of the following tools or techniques is the attacker MOST likely using to cover tracks?

Accepted Answer

Rootkit. The attacker is most likely using a rootkit to cover tracks because rootkits are designed to hide malicious activity by intercepting system calls (e.g., via LD_PRELOAD or kernel modules) to hide processes, files, and network connections. The truncated auth.log and modified timestamps on binaries in /bin/ indicate the rootkit is actively tampering with system logs and file metadata to evade detection, which aligns with rootkit behavior rather than simpler tools.

Answer

Timestamp manipulation tool

Answer

Steganography

Answer

Log cleaner script

Question 8

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

Accepted Answer

Use ldapsearch to query the directory for all attributes. `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.

Answer

Run nmap with the smb-enum-shares script

Answer

Perform a DNS zone transfer

Answer

Use net view to list domain resources

Question 9

An attacker has gained access to a Windows server and wants to crack the password hashes extracted from the SAM file. The attacker knows the passwords are complex but wants to maximize speed. Which tool is BEST suited for high-speed password cracking using GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the correct answer because it is specifically designed for high-speed password cracking using GPU acceleration, leveraging OpenCL or CUDA to offload computation to the GPU. This allows it to achieve millions of hashes per second, making it ideal for cracking complex passwords from SAM hashes (NTLM) when speed is the priority.

Answer

Ophcrack

Answer

RainbowCrack

Answer

John the Ripper

Question 10

Which TWO of the following are common tools used for SMB enumeration? (Select 2)

Accepted Answer

enum4linux. enum4linux is a wrapper tool that leverages SMB/CIFS operations (via smbclient, rpcclient, and net) to enumerate user lists, share listings, OS information, and password policies from Windows and Samba targets. It directly queries the SMB protocol (port 445/139) and is a standard tool for SMB enumeration in penetration testing.

Answer

ldapsearch

Answer

snmpwalk

Answer

nbtstat

Question 11

Which THREE of the following are password cracking techniques that can be used with Hashcat? (Select 3)

Accepted Answer

Brute-force attack. Hashcat is a GPU-accelerated password recovery tool whose core attack modes include brute-force (option B), where it exhaustively tries every possible character combination within a defined mask or keyspace, and dictionary attack (option D), where it hashes each word from a wordlist and compares it to the target hash. Hashcat also supports hybrid attack (option E), which combines a wordlist with a mask (e.g., appending digits or symbols to dictionary words) to cover mangled passwords, invoked with modes like -a 6 and -a 7. Rainbow table attack (option C) is a legitimate cracking technique in general, but it is not a Hashcat attack mode because Hashcat computes hashes on the fly rather than looking them up in precomputed chains. Token impersonation (option A) is a Windows privilege-escalation technique involving stolen access tokens, not a password cracking method, so it is unrelated to Hashcat.

Answer

Token impersonation

Answer

Rainbow table attack

Question 12

A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?

Accepted Answer

NetBIOS names and their associated service types. The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.

Answer

SMB share lists and open sessions

Answer

DNS records for the host and domain

Answer

ARP cache entries for the subnet

Question 13

During a penetration test, you execute the command `enum4linux -a 192.168.1.20`. The output reveals that the 'backup' account has a blank password and belongs to the 'Domain Admins' group. Which phase of the CHPSET methodology does identifying this vulnerability belong to?

Accepted Answer

Cracking passwords. The command `enum4linux -a` enumerates SMB shares, users, and password policies from a Windows target. Discovering that the 'backup' account has a blank password directly identifies a weak or missing credential, which falls under the 'Cracking passwords' phase of the CHPSET methodology. This phase involves identifying and exploiting weak, default, or blank passwords to gain unauthorized access.

Answer

Privilege escalation

Answer

Spying

Answer

Executing applications

Question 14

A forensic analyst examining a compromised Linux system finds the following entry in /var/log/auth.log: `Mar 15 10:23:45 server sshd[1234]: Accepted password for root from 10.0.0.5 port 54321 ssh2`. However, the analyst also notices that /var/log/auth.log has been truncated and the /etc/ssh/sshd_config file contains `LogLevel QUIET`. Which attack phase is most likely being obscured?

Accepted Answer

Erasing tracks. The presence of `LogLevel QUIET` in sshd_config suppresses all authentication log entries, and the truncation of /var/log/auth.log indicates an attempt to remove evidence of unauthorized access. Together, these actions are classic examples of erasing tracks, as the attacker is modifying logs and configuration to hide their activities from forensic analysis.

Answer

Privilege escalation

Answer

Executing applications

Answer

Spying

Question 15

An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?

Accepted Answer

Token impersonation using RottenPotato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

SUID abuse