CEH Enumeration and System Hacking Practice Test 6 — 15 Questions

Question 1

During a security assessment, an analyst runs 'enum4linux -a 10.0.0.5' and obtains a list of users, shares, and OS information. What protocol is enum4linux primarily using to gather this information?

Accepted Answer

SMB/CIFS. enum4linux is a wrapper around tools from the Samba suite, primarily using the SMB/CIFS protocol to query Windows systems for information such as user lists, shares, and OS details. It leverages SMB's remote IPC mechanisms (e.g., via \pipe\lsarpc or \pipe\samr) to enumerate these data points, making D the correct answer.

Answer

NetBIOS

Answer

SNMP

Answer

LDAP

Question 2

A penetration tester discovers a Linux server with the SUID bit set on the 'find' command. How could this be exploited for privilege escalation?

Accepted Answer

By running 'find / -exec /bin/sh \;' to spawn a root shell. When the SUID bit is set on the 'find' command, it executes with the privileges of the file owner (typically root). The '-exec' option allows arbitrary command execution. Running 'find / -exec /bin/sh \;' spawns a shell with root privileges, enabling full system compromise.

Answer

By using 'find' to delete log files

Answer

By using 'find' to search for files owned by root

Answer

By using 'find' to mount a remote share

Question 3

An attacker uses SMTP commands to verify the existence of email accounts on a mail server. Which sequence of SMTP commands is used for this purpose?

Accepted Answer

VRFY, EXPN, RCPT TO. The VRFY command asks the mail server to verify whether a given email address exists, EXPN expands a mailing list to reveal individual addresses, and RCPT TO (used in the SMTP transaction) can also be used to check address validity by observing the server's response. Together, these commands allow an attacker to enumerate valid email accounts on the server.

Answer

EHLO, AUTH, STARTTLS

Answer

HELO, MAIL FROM, RCPT TO, DATA

Answer

NOOP, QUIT, RSET

Question 4

A security analyst suspects an attacker has replaced system binaries with a rootkit to hide malicious processes. Which covering tracks technique is the attacker using?

Accepted Answer

Rootkit installation. The attacker is using rootkit installation to replace system binaries (e.g., ps, ls, netstat) with trojaned versions that filter out malicious processes from system calls like readdir() or /proc listings. This is a classic covering tracks technique because the rootkit hides evidence of compromise by intercepting and modifying kernel or user-space output, making the attacker's activities invisible to standard monitoring tools.

Answer

Timestomping

Answer

Steganography

Answer

Log manipulation

Question 5

During an internal penetration test, you run 'smbclient -L //192.168.1.100 -N' and get an empty response. Which of the following is the MOST likely reason?

Accepted Answer

Null sessions are disabled on the target. The `-N` flag in smbclient suppresses password prompts, attempting a null session. An empty response (no error, no output) typically indicates the SMB service is running but null sessions are explicitly disabled, often via the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous` set to 1 or 2. This prevents anonymous enumeration of shares and users, which is a common security hardening measure on Windows systems.

Answer

The target is not running SMB

Answer

The target requires NTLM authentication

Answer

The target is a Linux server

Question 6

A penetration tester captures the following output from a command: 'smb: \> ls \192.168.1.20\C$'. The tester is able to list the contents of the C$ share without providing credentials. Which of the following is the MOST likely reason for this access?

Accepted Answer

The target has a null session vulnerability that allows access to admin shares. The output shows the tester successfully listing the C$ share (a default administrative share) without providing credentials. This is a classic indicator of a null session vulnerability, where Windows allows unauthenticated access to IPC$ and, in some configurations, admin shares via SMB. The tester is leveraging the default null session to enumerate or access these shares, which is a well-known weakness in older Windows systems or misconfigured Samba servers.

Answer

The C$ share is intentionally shared with Everyone

Answer

The target is running a Samba server with weak permissions

Answer

The tester is using a pass-the-hash attack

Question 7

Which TWO of the following are valid enumeration techniques? (Select 2)

Accepted Answer

LDAP enumeration. LDAP enumeration is a valid enumeration technique because it involves querying a Lightweight Directory Access Protocol (LDAP) service to extract information about users, groups, computers, and other objects from a directory service like Microsoft Active Directory. Attackers use tools such as ldapsearch or ADExplorer to anonymously or authenticatedly browse the directory tree, revealing usernames, group memberships, and organizational units, which are critical for planning further attacks.

Answer

ARP poisoning

Answer

DNS cache poisoning

Answer

ICMP flooding

Question 8

Which THREE of the following are password cracking techniques? (Select 3)

Accepted Answer

Dictionary attack. A dictionary attack is a password cracking technique where an attacker uses a precompiled list of likely passwords (a dictionary file) to attempt authentication against a target system. It relies on the fact that many users choose common words or phrases as passwords, making it effective against weak passwords but ineffective against strong, random ones.

Answer

Phishing

Answer

Steganography

Question 9

Which TWO of the following are examples of privilege escalation on Linux? (Select 2)

Accepted Answer

SUID bit abuse. SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.

Answer

Pass-the-Hash

Answer

Token impersonation

Answer

DLL hijacking

Question 10

A security analyst runs the command: nbtstat -A 192.168.1.10. The output shows the table of names for the remote machine. Which of the following is the MOST likely purpose of this command?

Accepted Answer

To enumerate NetBIOS names and services on the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote IP address, displaying the registered NetBIOS names and their associated service types (e.g., workstation, server, messenger). This is a core technique for NetBIOS enumeration, which reveals the remote host's computer name, logged-in user, and running NetBIOS services, making option C correct.

Answer

To perform a DNS zone transfer

Answer

To enumerate SNMP community strings on the remote host

Answer

To enumerate SMB shares on the remote host

Question 11

During a penetration test, you receive a list of password hashes from a Windows server. Which of the following tools would be BEST suited to perform a dictionary attack against these hashes?

Accepted Answer

John the Ripper. John the Ripper is a dedicated password cracking tool that supports dictionary attacks against various hash types, including Windows NTLM hashes. It takes the list of hashes and compares them against a wordlist of candidate passwords, making it the best choice for this task.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 12

A penetration tester obtains a list of password hashes and uses RainbowCrack. Which statement BEST describes how RainbowCrack works?

Accepted Answer

It uses time-memory trade-off with precomputed hash chains. RainbowCrack implements a time-memory trade-off attack by precomputing hash chains for a given set of passwords and storing them in rainbow tables. When a password hash is provided, the tool looks up the hash in these tables to reverse it, avoiding the need to recompute hashes for every possible password. This makes it far faster than brute-force for cracking hashes, provided the password is covered by the precomputed chains.

Answer

It uses a dictionary attack with word mangling rules

Answer

It uses online password guessing against the target service

Answer

It uses a brute-force attack by trying all possible character combinations

Question 13

After gaining initial access, an attacker attempts to escalate privileges by exploiting a misconfigured service running as SYSTEM. They find that the service's binary path is writable by the Everyone group. Which privilege escalation technique is the attacker MOST likely using?

Accepted Answer

Weak service permissions. The attacker can exploit weak service permissions where the binary path of a service running as SYSTEM is writable by the Everyone group. This allows the attacker to replace the legitimate service binary with a malicious executable, and when the service restarts (or the system reboots), the malicious code executes with SYSTEM privileges, achieving privilege escalation.

Answer

SUID/GUID abuse

Answer

Unquoted service path

Answer

Token impersonation

Question 14

A security engineer runs SNMPwalk on a network device and receives community strings as 'public' and 'private'. What is the PRIMARY concern?

Accepted Answer

The device may be exposing sensitive configuration information. The SNMP community strings 'public' and 'private' are default read-only and read-write credentials defined in SNMPv1 and SNMPv2c. An attacker who can SNMPwalk the device with these strings can enumerate the entire MIB tree, including system configuration, routing tables, interface details, and user accounts. This directly exposes sensitive configuration information, making C the primary concern.

Answer

The device is vulnerable to buffer overflow attacks

Answer

The device is infected with malware

Answer

The device is using outdated encryption protocols

Question 15

Which of the following is the PRIMARY purpose of steganography in the context of covering tracks after a system compromise?

Accepted Answer

To hide data within other files to avoid detection. The primary purpose of steganography in covering tracks is to hide stolen data or malicious payloads within innocuous files (e.g., images, audio, video) so that forensic tools and analysts do not detect the exfiltration or persistence. Unlike encryption, which makes data unreadable but still visible, steganography conceals the very existence of the hidden data, allowing an attacker to bypass network monitoring and file inspection. This aligns with the CEH objective of covering tracks by avoiding detection of unauthorized data transfers.

Answer

To create a backdoor for future access

Answer

To delete system logs permanently

Answer

To encrypt log files so they cannot be read