CEH Enumeration and System Hacking Practice Test 4 — 15 Questions

Question 1

During a penetration test, you gain access to a Linux server as a low-privileged user. Which of the following is an effective technique to escalate privileges by exploiting misconfigured file permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SUID/GUID abuse. SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.

Answer

Pass-the-hash

Answer

Token impersonation

Answer

Kerberoasting

Question 2

An ethical hacker needs to crack a set of NTLM hashes obtained from a Windows system. Which tool would be MOST efficient for performing a dictionary attack with hybrid rules?

Accepted Answer

Hashcat. Hashcat is the most efficient tool for performing a dictionary attack with hybrid rules because it is GPU-accelerated, supports the NTLM hash mode (1000), and allows the application of rule-based mutations (e.g., appending digits or special characters) directly to dictionary words. Its speed and flexibility in handling large wordlists with complex rule sets make it superior for cracking NTLM hashes in a professional penetration test.

Answer

John the Ripper

Answer

Ophcrack

Answer

RainbowCrack

Question 3

After successfully exploiting a system, an attacker uses the command 'wevtutil cl system' on a Windows target. What is the MOST likely purpose of this command?

Accepted Answer

To clear the system event log. The command 'wevtutil cl system' is used to clear the System event log on a Windows system. After successfully exploiting a target, an attacker would use this command to erase traces of their activities, such as log entries generated by their tools or actions, thereby hindering forensic analysis. The 'cl' parameter stands for 'clear log', and 'system' specifies the System log.

Answer

To export event logs to a file

Answer

To disable Windows event logging

Answer

To create a new event log entry

Question 4

Which phase of the system hacking methodology (CHPSET) involves hiding files from the operating system using techniques such as rootkits or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking passwords, Hacking, Privilege escalation, Spying, Erasing tracks, Executing applications, Hiding files) methodology involves concealing malicious files from the operating system and security tools. Techniques such as rootkits (which hook system calls like NtQueryDirectoryFile to hide files from directory listings) and steganography (embedding data within innocent files like images or audio) are used to avoid detection. This phase directly follows 'Executing applications' and ensures the attacker's payload remains persistent and covert.

Answer

Cracking passwords

Answer

Erasing tracks

Answer

Executing applications

Question 5

A penetration tester uses the following command to extract the contents of a SAM file: 'samdump2 SYSTEM /mnt/windows/Windows/System32/config/SAM'. What is the primary purpose of this action?

Accepted Answer

To capture NTLM hashes for offline cracking. The `samdump2` tool extracts password hash data from the SAM (Security Account Manager) registry hive file. By providing the SYSTEM hive (which contains the boot key) and the SAM file, the tool decrypts and dumps the NTLM hashes of local user accounts. These hashes can then be used in offline cracking attacks (e.g., with John the Ripper or Hashcat) to recover plaintext passwords, making option C correct.

Answer

To escalate privileges on the system

Answer

To enumerate users via LDAP

Answer

To perform a pass-the-hash attack

Question 6

During a penetration test, you discover a Windows service running with SYSTEM privileges that has a weak file permission allowing the 'Everyone' group to modify its executable. Which privilege escalation technique is MOST directly applicable here?

Accepted Answer

Weak service binary permissions. The scenario describes a Windows service executable with weak file permissions that allow the 'Everyone' group to modify it. This directly enables an attacker to replace the legitimate executable with a malicious one, which will then be executed with SYSTEM privileges when the service starts. This is the classic 'weak service binary permissions' privilege escalation vector, often exploited using tools like `icacls` or `accesschk` to identify the vulnerability.

Answer

Token impersonation

Answer

DLL hijacking

Answer

Unquoted service path

Question 7

An attacker uses 'rpcclient -U '' -N 192.168.1.10' followed by 'enumdomusers' and 'enumdomgroups'. What type of enumeration is being performed, and which protocol does it rely on?

Accepted Answer

SMB/RPC enumeration over port 445. The `rpcclient` tool with the `-U '' -N` flags performs a null session connection to a Windows system over the SMB protocol. The subsequent `enumdomusers` and `enumdomgroups` commands enumerate domain users and groups via MS-RPC (Remote Procedure Call) functions, which are transported over SMB. By default, modern Windows systems use SMB over port 445, making option B the correct choice.

Answer

LDAP enumeration over port 389

Answer

NetBIOS enumeration over port 139

Answer

SNMP enumeration over port 161

Question 8

Which TWO tools are commonly used for enumerating NFS exports on a target system? (Select 2 correct answers)

Accepted Answer

nmap (with script nfs-ls). Option B, nmap with the nfs-ls script, is correct because Nmap's NSE script nfs-ls queries an NFS server and lists the files and directories available through its exports, making it a valid enumeration tool for NFS. Option D, showmount, is correct because showmount -e <target> directly queries the target's mountd/rpcbind service and displays the list of exported file systems, which is the classic NFS enumeration command. The other options do not belong: enum4linux (A) and smbclient (C) target SMB/NetBIOS/Windows shares rather than NFS, and ldapsearch (E) queries LDAP directory services, not NFS exports.

Answer

enum4linux

Answer

smbclient

Answer

ldapsearch

Question 9

Which THREE of the following are valid techniques for covering tracks after compromising a system? (Select 3 correct answers)

Accepted Answer

Clearing event logs using wevtutil. A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.

Answer

Exploiting SUID binaries to gain root

Answer

Disabling Windows Defender via Group Policy

Question 10

Which TWO of the following are examples of hybrid password attacks? (Select 2 correct answers)

Accepted Answer

Using a dictionary file and appending random numbers to each word. A hybrid password attack combines a dictionary or wordlist with additional modifications, such as appending random numbers to each word. This approach leverages common password patterns where users often add digits to a base word to meet complexity requirements, making it more effective than a simple dictionary attack.

Answer

Using a wordlist to try every possible password in the list

Answer

Generating all possible character combinations up to a certain length

Answer

Cracking passwords using precomputed rainbow tables

Question 11

During a penetration test, you run the command `enum4linux -a 192.168.1.10` and receive output containing user account names, group memberships, and share listings. Which protocol is primarily being enumerated?

Accepted Answer

SMB. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via the SMB (Server Message Block) protocol. The command `enum4linux -a 192.168.1.10` performs a comprehensive scan that retrieves user accounts, group memberships, and share listings, all of which are exposed through SMB's named pipe and RPC mechanisms. SMB is the correct protocol because it is the primary means for file and printer sharing in Windows networks, and enum4linux leverages SMB's IPC$ share and SAMR/LSA RPC services to extract this data.

Answer

NFS

Answer

SNMP

Answer

SMTP

Question 12

A security analyst suspects an attacker has used a rainbow table to crack password hashes from a compromised system. Which password cracking technique involves precomputed hash chains?

Accepted Answer

Rainbow table attack. A rainbow table attack is the correct answer because it specifically uses precomputed hash chains to reverse cryptographic hash functions. Rainbow tables are a form of time-memory trade-off where chains of hashes are computed and stored, allowing an attacker to look up a hash and quickly find the original plaintext without recomputing all possible hashes. This technique is distinct from other methods because it relies on precomputation rather than real-time guessing or dictionary lookups.

Answer

Dictionary attack

Answer

Brute force attack

Answer

Hybrid attack

Question 13

During a security assessment, you find a Linux binary with the SUID bit set and owned by root. You execute it and obtain a root shell. This is an example of which privilege escalation technique?

Accepted Answer

SUID abuse. The SUID (Set User ID) bit on a binary owned by root allows it to execute with root privileges regardless of the user running it. When you execute such a binary and it spawns a shell, that shell inherits the elevated privileges, effectively granting you a root shell. This is a classic example of SUID abuse, a common privilege escalation technique on Linux systems.

Answer

DLL hijacking

Answer

Kernel exploit

Answer

Token impersonation

Question 14

A penetration tester is attempting to enumerate user accounts on a mail server. They connect to port 25 and issue the commands `VRFY root` and `EXPN support`. Which protocol is being targeted?

Accepted Answer

SMTP. The commands VRFY and EXPN are SMTP (Simple Mail Transfer Protocol) commands defined in RFC 821 and RFC 5321. VRFY is used to verify whether a mailbox exists on the server, while EXPN expands a mailing list alias to reveal its members. Since the tester connected to port 25 (the default SMTP port) and issued these commands, SMTP is the protocol being targeted.

Answer

LDAP

Answer

SMB

Answer

SNMP

Question 15

After gaining access to a system, an attacker modifies log files to remove evidence of their activities. This action is part of which phase of the system hacking methodology?

Accepted Answer

Erasing tracks. 'Erasing tracks,' because after gaining access, the attacker's goal is to cover their footprints by modifying or deleting log files, clearing event logs, or using tools like `wevtutil` or `clearev` to remove evidence of their activities. This phase ensures the system administrator cannot detect the intrusion or trace the attacker's actions.

Answer

Spying

Answer

Executing applications

Answer

Hiding files