CEH Enumeration and System Hacking Practice Test 8 — 15 Questions

Question 1

A security analyst runs the command `nbtstat -A 192.168.1.105` on a Windows machine. What information is the analyst most likely trying to gather?

Accepted Answer

The NetBIOS name table and MAC address of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against the specified IP address using the NetBIOS over TCP/IP (NBT) protocol. It returns the remote host's NetBIOS name table, which includes registered names and services, along with the MAC address of the network adapter. This is a standard enumeration technique to identify the hostname, logged-in user, and other NetBIOS-related information.

Answer

The LDAP directory structure of the domain

Answer

The SNMP community strings of the target

Answer

The SMB shares available on the remote host

Question 2

During a penetration test, a tester uses the SMTP VRFY command against a mail server. The server responds with '252 Cannot VRFY user, but will accept message' for most usernames. Which action should the tester take to enumerate valid email addresses more effectively?

Accepted Answer

Use the EXPN command to expand mailing lists and verify addresses. The SMTP VRFY command is used to verify whether a specific user exists on the mail server. When the server responds with '252 Cannot VRFY user, but will accept message', it indicates that VRFY is disabled or restricted, but the server still supports the EXPN command. EXPN (Expand) reveals the actual members of a mailing list or alias, allowing the tester to enumerate valid email addresses indirectly by querying known or guessed list names.

Answer

Use the NetBIOS nbtstat command to query the mail server

Answer

Run a brute-force attack on the SMTP service using Hydra

Answer

Switch to SNMP enumeration to gather email addresses

Question 3

A penetration tester is attempting to escalate privileges on a Linux target. The tester runs `find / -perm -4000 -type f 2>/dev/null` and discovers that `/usr/bin/pkexec` has the SUID bit set. The target runs Ubuntu 20.04 with default configurations. Which of the following is the MOST likely next step?

Accepted Answer

Exploit the pkexec vulnerability (CVE-2021-4034) to gain root access. CVE-2021-4034 (PwnKit) is a memory corruption vulnerability in pkexec that allows unprivileged users to escalate privileges to root by exploiting an out-of-bounds write in the argument parsing logic. On Ubuntu 20.04 with default configurations, the pkexec binary is SUID root and vulnerable to this exploit, making it the most direct and effective next step for privilege escalation.

Answer

Change the ownership of the pkexec binary to root:root

Answer

Use pkexec to execute a command as root directly

Answer

Remove the SUID bit from pkexec to prevent misuse

Question 4

An analyst observes repeated failed login attempts to a Windows server from an internal IP, followed by a successful login using the account 'admin' from the same IP. The analyst checks the Security log and finds Event ID 4624 with Logon Type 3. What type of attack is MOST likely occurring?

Accepted Answer

Dictionary attack on the admin account. Event ID 4624 with Logon Type 3 indicates a network logon (typically SMB or other network resource access). The sequence of repeated failed attempts followed by a successful login from the same internal IP strongly suggests a dictionary (brute-force) attack against the 'admin' account. The attacker systematically tried passwords until one succeeded, which is the hallmark of a dictionary attack.

Answer

SMB relay attack

Answer

Kerberos golden ticket attack

Answer

Pass-the-hash attack

Question 5

Which tool is specifically designed to crack Windows LM and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted use case.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 6

A security team discovers that an attacker has been using steganography to exfiltrate data from the corporate network. The attacker hid data inside image files and uploaded them to a public image hosting site. Which of the following is the BEST method to detect this type of exfiltration?

Accepted Answer

Deploy a steganography detection tool that analyzes image pixel patterns for statistical anomalies. Steganography detection tools analyze statistical anomalies in pixel patterns (e.g., LSB embedding, DCT coefficient deviations) that are invisible to the human eye but detectable via algorithms like chi-square analysis or RS analysis. This directly identifies hidden payloads without relying on file hashes or headers, which steganography does not alter.

Answer

Compare file hashes of uploaded images to known-good baselines

Answer

Block all image uploads to external sites

Answer

Use network-based DLP to inspect image file headers for hidden data

Question 7

A penetration tester runs the following command against a Linux server: `smbclient -L //192.168.1.10 -N`. The output lists shares including 'IPC$', 'ADMIN$', and 'data'. Which of the following is the BEST next step to enumerate the 'data' share?

Accepted Answer

Use `smbclient //192.168.1.10/data -N` to attempt a null session connection. The command `smbclient -L //192.168.1.10 -N` performs a null session (no password) listing of SMB shares. The output shows that the 'data' share exists and is accessible without authentication (since the -N flag succeeded). The best next step is to attempt a null session connection to that specific share using `smbclient //192.168.1.10/data -N`, which will mount the share and allow file enumeration. This directly leverages the null session already confirmed by the initial scan.

Answer

Run `nmap --script smb-enum-shares -p 445 192.168.1.10`

Answer

Run `enum4linux -a 192.168.1.10` to gather more information

Answer

Use `rpcclient -U '' 192.168.1.10` to enumerate users

Question 8

Which of the following commands is used to enumerate SNMP information from a network device using a specific community string?

Accepted Answer

snmpwalk -c public -v 2c 192.168.1.1. `snmpwalk` is the standard command-line tool for enumerating SNMP (Simple Network Management Protocol) information from a network device. By specifying the community string (`-c public`) and SNMP version (`-v 2c`), it retrieves the entire Management Information Base (MIB) tree from the target IP address, allowing an attacker to discover system details, running processes, and network interfaces.

Answer

ldapsearch -x -h 192.168.1.1 -b dc=domain,dc=com

Answer

enum4linux -a 192.168.1.1

Answer

nbtstat -a 192.168.1.1

Question 9

A penetration tester has obtained a copy of the SAM database from a Windows system. The hashes extracted include both LM and NTLM hashes. Which of the following tools would be MOST efficient to crack the NTLM hashes using a dictionary attack with GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the most efficient tool for GPU-accelerated dictionary attacks against NTLM hashes because it is purpose-built for high-speed password cracking using OpenCL and CUDA, directly leveraging GPU parallelism. It supports the NTLM hash mode (1000) and can process millions of hashes per second, far outperforming CPU-based tools like John the Ripper for this specific task.

Answer

John the Ripper

Answer

Ophcrack

Answer

RainbowCrack

Question 10

After gaining initial access to a Linux server, a penetration tester wants to maintain persistence by creating a backdoor. The tester decides to replace a common system binary with a trojanized version. Which of the following techniques is MOST likely to evade detection by file integrity monitoring (FIM) systems?

Accepted Answer

Use a kernel-level rootkit that intercepts read operations to present the original binary's content. A kernel-level rootkit can intercept system calls (e.g., open, read) used by FIM tools to verify file integrity. When the FIM queries the trojanized binary, the rootkit returns the original, unmodified content, so the hash or checksum matches the baseline. This subverts detection at the kernel layer, bypassing user-space integrity checks entirely.

Answer

Replace the binary with a modified version that has the same file size and timestamp

Answer

Place the backdoor in a directory that is excluded from FIM monitoring

Answer

Use steganography to hide the backdoor inside an image file

Question 11

A security analyst reviews the following command output from a Linux system: `uid=0(root) gid=0(root) groups=0(root)`. The analyst suspects a privilege escalation attack. Which of the following techniques could have been used to achieve root access from a standard user account?

Accepted Answer

SUID/GUID abuse. The command output shows the current user has UID 0, which is the root user. On Linux, SUID (Set User ID) and GUID (Group ID) bits allow executables to run with the permissions of the file owner (e.g., root). A standard user can exploit a misconfigured SUID binary (like `passwd` or a custom script) to execute commands with root privileges, achieving privilege escalation. This is a classic Linux privilege escalation technique directly tied to the UID/GID output shown.

Answer

Token impersonation

Answer

Pass-the-hash attack

Answer

LLMNR/NBT-NS poisoning

Question 12

Which TWO of the following are valid methods for enumerating users on a SMTP server? (Select 2)

Accepted Answer

EXPN. EXPN (Expand) and VRFY (Verify) are SMTP commands defined in RFC 821 that allow an attacker to enumerate valid email addresses and mailing list members on a mail server. EXPN reveals the members of a mailing list, while VRFY confirms whether a specific mailbox exists. Both commands are often disabled in production to prevent user enumeration.

Answer

MAIL FROM

Answer

RCPT TO

Answer

AUTH

Question 13

Which TWO of the following are common techniques for covering tracks after compromising a system? (Select 2)

Accepted Answer

Manipulating event logs to remove evidence of intrusion. Manipulating event logs (e.g., clearing, modifying, or deleting entries in Windows Event Log or syslog) is a standard post-exploitation step to remove traces of unauthorized access, such as failed login attempts or privilege escalation events. Attackers often use tools like `wevtutil` or `clearlogs` to erase evidence, making forensic reconstruction difficult.

Answer

Increasing the frequency of password changes

Answer

Enabling verbose logging for future attacks

Answer

Setting up a honeypot to distract defenders

Question 14

A security analyst runs the command `nbtstat -A 192.168.1.50` in a Windows environment. What information is the analyst attempting to retrieve?

Accepted Answer

NetBIOS names and services of the remote system. The `nbtstat -A` command queries the NetBIOS name table of a remote system by its IP address. NetBIOS over TCP/IP (NBT) maintains a table of names and services (e.g., workstation, server, messenger) that the remote host has registered. This is a classic enumeration technique to discover shares, logged-in users, and other NetBIOS resources.

Answer

The current routing table on the host

Answer

Active network connections and listening ports

Answer

DNS records for the host

Question 15

During a penetration test, you successfully gain access to a web server with a low-privileged shell. You want to escalate privileges to root. Which of the following techniques is MOST likely to achieve privilege escalation on a misconfigured Linux system?

Accepted Answer

Search for and exploit a SUID binary that allows privilege escalation. SUID (Set User ID) binaries execute with the privileges of the file owner, typically root. On a misconfigured Linux system, a low-privileged user can run a SUID-root binary (e.g., `find`, `vim`, `nmap`) to spawn a shell with root privileges, directly achieving privilege escalation without needing credentials or additional exploits.

Answer

Use the `netcat` tool to establish a reverse shell back to the attacker

Answer

Use a password cracking tool like John the Ripper on the system's shadow file

Answer

Perform a brute force attack on the root password