CEH Enumeration and System Hacking Practice Test 4 — 15 Questions

Question 1

A Linux system has a script named 'backup' owned by root with the SUID bit set and world-executable permissions. A standard user executes the script and discovers it runs a command that reads /etc/shadow and writes output to a world-readable file. What is the most likely intended exploitation path?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SUID abuse to read sensitive files. The SUID bit on the 'backup' script, owned by root and world-executable, allows any user to execute it with root privileges. If the script reads /etc/shadow (which is normally root-only) and writes the output to a world-readable file, an attacker can exploit this to exfiltrate password hashes. This is a classic SUID abuse scenario where a privileged binary or script is used to access sensitive files.

Answer

GUID abuse

Answer

LD_PRELOAD injection

Answer

Token impersonation

Question 2

An incident responder finds that the Windows Event Logs on a compromised server have been cleared, and the Security log shows gaps in coverage. Additionally, a rootkit is suspected. Which phase of the hacking methodology does the clearing of logs represent?

Accepted Answer

Erasing tracks. Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

Answer

Privilege escalation

Answer

Cracking passwords

Answer

Executing applications

Question 3

A penetration tester obtains password hashes from a Windows system. Which TWO methods would be most efficient for cracking NTLM hashes offline? (Choose two.)

Accepted Answer

Using Hashcat with a brute-force attack on GPU. Hashcat, when used with a GPU, can perform massively parallel brute-force attacks against NTLM hashes, achieving billions of hash calculations per second. This makes it one of the most efficient tools for offline password cracking of NTLM hashes, especially when the password is not in a dictionary.

Answer

Using RainbowCrack with precomputed rainbow tables for NTLM

Answer

Performing an online brute-force against the SAM database

Answer

Using Ophcrack with rainbow tables for NTLM

Question 4

A security analyst runs 'nbtstat -A 192.168.1.10' and receives a table showing the machine name and a list of names registered. Which service is being enumerated?

Accepted Answer

NetBIOS. The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.

Answer

SNMP

Answer

LDAP

Answer

SMTP

Question 5

During a penetration test, you need to enumerate SMB shares on a Windows target. Which of the following tools is specifically designed for this purpose?

Accepted Answer

enum4linux. enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.

Answer

ldapsearch

Answer

nmap

Answer

snmpwalk

Question 6

Which SNMP community string is typically used for read-only access by default on many devices?

Accepted Answer

public. The default read-only community string in SNMPv1 and SNMPv2c is 'public'. This string acts as a password that allows an SNMP manager to query device MIB objects for monitoring purposes without making configuration changes. It is widely documented in RFC 1157 and is the standard default across most networking equipment.

Answer

snmp

Answer

private

Answer

admin

Question 7

An attacker attempts to enumerate valid email users by connecting to an SMTP server and issuing the following commands: EHLO example.com, VRFY root, VRFY admin, VRFY user1. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY. The VRFY command is specifically designed to verify whether a mailbox exists on an SMTP server. By issuing VRFY followed by usernames (root, admin, user1), the attacker can enumerate valid email users based on the server's responses (e.g., 250 or 251 for valid, 550 for invalid). This is a classic SMTP user enumeration technique.

Answer

RCPT TO

Answer

MAIL FROM

Answer

EXPN

Question 8

A tester runs 'snmpwalk -v2c -c public 192.168.1.1' and receives a large amount of system information. What does this command do?

Accepted Answer

It walks the SNMP MIB tree using version 2c and the public community string.. The `snmpwalk` command is used to retrieve a subtree of management values from an SNMP agent. The `-v2c` flag specifies SNMP version 2c, which uses community-based security, and `-c public` provides the community string 'public' (often the default read-only community). The command walks the entire MIB tree starting from the root, returning all available OID values, which explains the large amount of system information received.

Answer

It performs a brute-force attack on SNMP community strings.

Answer

It enumerates users on a Windows domain.

Answer

It sets SNMP values using the private community string.

Question 9

During a penetration test, you gain access to a Linux server as a low-privileged user. Which of the following is an effective technique to escalate privileges by exploiting misconfigured file permissions?

Accepted Answer

SUID/GUID abuse. SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.

Answer

Pass-the-hash

Answer

Token impersonation

Answer

Kerberoasting

Question 10

An ethical hacker needs to crack a set of NTLM hashes obtained from a Windows system. Which tool would be MOST efficient for performing a dictionary attack with hybrid rules?

Accepted Answer

Hashcat. Hashcat is the most efficient tool for performing a dictionary attack with hybrid rules because it is GPU-accelerated, supports the NTLM hash mode (1000), and allows the application of rule-based mutations (e.g., appending digits or special characters) directly to dictionary words. Its speed and flexibility in handling large wordlists with complex rule sets make it superior for cracking NTLM hashes in a professional penetration test.

Answer

John the Ripper

Answer

Ophcrack

Answer

RainbowCrack

Question 11

After successfully exploiting a system, an attacker uses the command 'wevtutil cl system' on a Windows target. What is the MOST likely purpose of this command?

Accepted Answer

To clear the system event log. The command 'wevtutil cl system' is used to clear the System event log on a Windows system. After successfully exploiting a target, an attacker would use this command to erase traces of their activities, such as log entries generated by their tools or actions, thereby hindering forensic analysis. The 'cl' parameter stands for 'clear log', and 'system' specifies the System log.

Answer

To export event logs to a file

Answer

To disable Windows event logging

Answer

To create a new event log entry

Question 12

Which phase of the system hacking methodology (CHPSET) involves hiding files from the operating system using techniques such as rootkits or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking passwords, Hacking, Privilege escalation, Spying, Erasing tracks, Executing applications, Hiding files) methodology involves concealing malicious files from the operating system and security tools. Techniques such as rootkits (which hook system calls like NtQueryDirectoryFile to hide files from directory listings) and steganography (embedding data within innocent files like images or audio) are used to avoid detection. This phase directly follows 'Executing applications' and ensures the attacker's payload remains persistent and covert.

Answer

Cracking passwords

Answer

Erasing tracks

Answer

Executing applications

Question 13

A penetration tester uses the following command to extract the contents of a SAM file: 'samdump2 SYSTEM /mnt/windows/Windows/System32/config/SAM'. What is the primary purpose of this action?

Accepted Answer

To capture NTLM hashes for offline cracking. The `samdump2` tool extracts password hash data from the SAM (Security Account Manager) registry hive file. By providing the SYSTEM hive (which contains the boot key) and the SAM file, the tool decrypts and dumps the NTLM hashes of local user accounts. These hashes can then be used in offline cracking attacks (e.g., with John the Ripper or Hashcat) to recover plaintext passwords, making option C correct.

Answer

To escalate privileges on the system

Answer

To enumerate users via LDAP

Answer

To perform a pass-the-hash attack

Question 14

During a penetration test, you discover a Windows service running with SYSTEM privileges that has a weak file permission allowing the 'Everyone' group to modify its executable. Which privilege escalation technique is MOST directly applicable here?

Accepted Answer

Weak service binary permissions. The scenario describes a Windows service executable with weak file permissions that allow the 'Everyone' group to modify it. This directly enables an attacker to replace the legitimate executable with a malicious one, which will then be executed with SYSTEM privileges when the service starts. This is the classic 'weak service binary permissions' privilege escalation vector, often exploited using tools like `icacls` or `accesschk` to identify the vulnerability.

Answer

Token impersonation

Answer

DLL hijacking

Answer

Unquoted service path

Question 15

An attacker uses 'rpcclient -U '' -N 192.168.1.10' followed by 'enumdomusers' and 'enumdomgroups'. What type of enumeration is being performed, and which protocol does it rely on?

Accepted Answer

SMB/RPC enumeration over port 445. The `rpcclient` tool with the `-U '' -N` flags performs a null session connection to a Windows system over the SMB protocol. The subsequent `enumdomusers` and `enumdomgroups` commands enumerate domain users and groups via MS-RPC (Remote Procedure Call) functions, which are transported over SMB. By default, modern Windows systems use SMB over port 445, making option B the correct choice.

Answer

LDAP enumeration over port 389

Answer

NetBIOS enumeration over port 139

Answer

SNMP enumeration over port 161