CEH Enumeration and System Hacking Practice Test 8 — 15 Questions

Question 1

A penetration tester runs the following command against a Linux server: `smbclient -L //192.168.1.10 -N`. The output lists shares including 'IPC$', 'ADMIN$', and 'data'. Which of the following is the BEST next step to enumerate the 'data' share?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use `smbclient //192.168.1.10/data -N` to attempt a null session connection. The command `smbclient -L //192.168.1.10 -N` performs a null session (no password) listing of SMB shares. The output shows that the 'data' share exists and is accessible without authentication (since the -N flag succeeded). The best next step is to attempt a null session connection to that specific share using `smbclient //192.168.1.10/data -N`, which will mount the share and allow file enumeration. This directly leverages the null session already confirmed by the initial scan.

Answer

Run `nmap --script smb-enum-shares -p 445 192.168.1.10`

Answer

Run `enum4linux -a 192.168.1.10` to gather more information

Answer

Use `rpcclient -U '' 192.168.1.10` to enumerate users

Question 2

Which of the following commands is used to enumerate SNMP information from a network device using a specific community string?

Accepted Answer

snmpwalk -c public -v 2c 192.168.1.1. `snmpwalk` is the standard command-line tool for enumerating SNMP (Simple Network Management Protocol) information from a network device. By specifying the community string (`-c public`) and SNMP version (`-v 2c`), it retrieves the entire Management Information Base (MIB) tree from the target IP address, allowing an attacker to discover system details, running processes, and network interfaces.

Answer

ldapsearch -x -h 192.168.1.1 -b dc=domain,dc=com

Answer

enum4linux -a 192.168.1.1

Answer

nbtstat -a 192.168.1.1

Question 3

A penetration tester has obtained a copy of the SAM database from a Windows system. The hashes extracted include both LM and NTLM hashes. Which of the following tools would be MOST efficient to crack the NTLM hashes using a dictionary attack with GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the most efficient tool for GPU-accelerated dictionary attacks against NTLM hashes because it is purpose-built for high-speed password cracking using OpenCL and CUDA, directly leveraging GPU parallelism. It supports the NTLM hash mode (1000) and can process millions of hashes per second, far outperforming CPU-based tools like John the Ripper for this specific task.

Answer

John the Ripper

Answer

Ophcrack

Answer

RainbowCrack

Question 4

After gaining initial access to a Linux server, a penetration tester wants to maintain persistence by creating a backdoor. The tester decides to replace a common system binary with a trojanized version. Which of the following techniques is MOST likely to evade detection by file integrity monitoring (FIM) systems?

Accepted Answer

Use a kernel-level rootkit that intercepts read operations to present the original binary's content. A kernel-level rootkit can intercept system calls (e.g., open, read) used by FIM tools to verify file integrity. When the FIM queries the trojanized binary, the rootkit returns the original, unmodified content, so the hash or checksum matches the baseline. This subverts detection at the kernel layer, bypassing user-space integrity checks entirely.

Answer

Replace the binary with a modified version that has the same file size and timestamp

Answer

Place the backdoor in a directory that is excluded from FIM monitoring

Answer

Use steganography to hide the backdoor inside an image file

Question 5

A security analyst reviews the following command output from a Linux system: `uid=0(root) gid=0(root) groups=0(root)`. The analyst suspects a privilege escalation attack. Which of the following techniques could have been used to achieve root access from a standard user account?

Accepted Answer

SUID/GUID abuse. The command output shows the current user has UID 0, which is the root user. On Linux, SUID (Set User ID) and GUID (Group ID) bits allow executables to run with the permissions of the file owner (e.g., root). A standard user can exploit a misconfigured SUID binary (like `passwd` or a custom script) to execute commands with root privileges, achieving privilege escalation. This is a classic Linux privilege escalation technique directly tied to the UID/GID output shown.

Answer

Token impersonation

Answer

Pass-the-hash attack

Answer

LLMNR/NBT-NS poisoning

Question 6

Which TWO of the following are valid methods for enumerating users on a SMTP server? (Select 2)

Accepted Answer

EXPN. EXPN (Expand) and VRFY (Verify) are SMTP commands defined in RFC 821 that allow an attacker to enumerate valid email addresses and mailing list members on a mail server. EXPN reveals the members of a mailing list, while VRFY confirms whether a specific mailbox exists. Both commands are often disabled in production to prevent user enumeration.

Answer

MAIL FROM

Answer

RCPT TO

Answer

AUTH

Question 7

Which THREE of the following are indicators that a system has been compromised by a rootkit? (Select 3)

Accepted Answer

Anti-virus software is disabled and cannot be restarted. Option A is correct because rootkits commonly disable or interfere with security tools such as anti-virus software, and the inability to restart them is a strong indicator of kernel-level or user-mode tampering. Option B is correct because rootkits are specifically designed to hide their presence, often by hooking system calls or modifying kernel structures so that processes, files, or registry keys do not appear in standard tools like Task Manager, ps, or top. Option C is correct because rootkits frequently maintain persistence and remote control by establishing covert connections to command-and-control (C2) servers, and such unexplained outbound traffic is a classic sign of compromise. Option D is not correct because repeated successful logins from unknown IPs suggest credential compromise or brute-force success, but they do not specifically indicate a rootkit, which is characterized by stealth and system-level hiding. Option E is not correct because increased disk space usage is a generic symptom that can result from many benign causes such as log growth, updates, or user data, and is not a specific indicator of rootkit activity.

Answer

Event logs show repeated successful logins from unknown IPs

Answer

Increased disk space usage without explanation

Question 8

A security analyst runs the command `nbtstat -A 192.168.1.50` in a Windows environment. What information is the analyst attempting to retrieve?

Accepted Answer

NetBIOS names and services of the remote system. The `nbtstat -A` command queries the NetBIOS name table of a remote system by its IP address. NetBIOS over TCP/IP (NBT) maintains a table of names and services (e.g., workstation, server, messenger) that the remote host has registered. This is a classic enumeration technique to discover shares, logged-in users, and other NetBIOS resources.

Answer

The current routing table on the host

Answer

Active network connections and listening ports

Answer

DNS records for the host

Question 9

During a penetration test, you successfully gain access to a web server with a low-privileged shell. You want to escalate privileges to root. Which of the following techniques is MOST likely to achieve privilege escalation on a misconfigured Linux system?

Accepted Answer

Search for and exploit a SUID binary that allows privilege escalation. SUID (Set User ID) binaries execute with the privileges of the file owner, typically root. On a misconfigured Linux system, a low-privileged user can run a SUID-root binary (e.g., `find`, `vim`, `nmap`) to spawn a shell with root privileges, directly achieving privilege escalation without needing credentials or additional exploits.

Answer

Use the `netcat` tool to establish a reverse shell back to the attacker

Answer

Use a password cracking tool like John the Ripper on the system's shadow file

Answer

Perform a brute force attack on the root password

Question 10

A security team has collected a hash file from a compromised Windows server that contains NTLM hashes. They want to crack the passwords as quickly as possible using a precomputed lookup table. Which tool and technique combination is BEST suited for this task?

Accepted Answer

Use RainbowCrack with precomputed rainbow tables. RainbowCrack is specifically designed for fast password cracking using precomputed rainbow tables, which are lookup tables that store hash chains for rapid reversal of hashes. Since the team already has NTLM hashes and wants the quickest method, RainbowCrack with precomputed tables avoids the computational overhead of real-time hashing, making it the best fit for this scenario.

Answer

Use John the Ripper in incremental mode

Answer

Use Hydra with a dictionary of common passwords

Answer

Use Hashcat with a rules-based attack

Question 11

A penetration tester is enumerating an SMTP server on port 25. They issue the command `VRFY root` and receive a 250 response, then `VRFY admin` also returns 250. What does this indicate about the SMTP server?

Accepted Answer

Both root and admin are valid email accounts on the server. The VRFY command is used to verify whether a specific user exists on an SMTP server. A 250 response code indicates that the user is valid and the mailbox exists. Since both `root` and `admin` returned 250, this confirms that both are valid email accounts on the server, making option A correct.

Answer

The SMTP server supports password authentication

Answer

The command failed due to syntax errors

Answer

The SMTP server has disabled user verification

Question 12

A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?

Accepted Answer

ldapsearch. ldapsearch is the correct tool because it can perform anonymous LDAP queries against a Windows domain controller's LDAP service (port 389) without requiring authentication. By default, many Windows DCs allow anonymous binds to retrieve directory information such as user and group objects, making ldapsearch the most direct and appropriate choice for this task.

Answer

smbclient

Answer

snmpwalk

Answer

enum4linux

Question 13

Which of the following tools is specifically designed to enumerate SMB shares and user information from Windows systems using the SMB protocol?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate SMB shares, user lists, OS information, and other details from Windows systems by leveraging the SMB protocol (typically over TCP/445 or TCP/139). It automates queries using SMB RPC calls, such as those from the `samr` and `lsarpc` pipes, making it the correct choice for targeted SMB enumeration.

Answer

snmpwalk

Answer

nmap

Answer

hping3

Question 14

A penetration tester is performing SNMP enumeration against a network device and wants to retrieve the entire Management Information Base (MIB) tree. Which command should they use?

Accepted Answer

snmpwalk -v 2c -c public 192.168.1.1 .1. `snmpwalk` is specifically designed to retrieve a subtree of MIB objects by performing a series of GETNEXT requests starting from a given OID. Using `.1` as the root OID (which corresponds to the entire ISO tree) with the SNMPv2c community string 'public' will enumerate all accessible OIDs in the MIB tree, effectively dumping the entire Management Information Base.

Answer

snmpset -v 2c -c private 192.168.1.1 1.3.6.1.2.1.1.0 s 'test'

Answer

snmpbulkwalk -v 2c -c public 192.168.1.1 .1

Answer

snmpget -v 2c -c public 192.168.1.1 1.3.6.1.2.1.1

Question 15

During a password cracking session, a pentester uses a wordlist combined with rules to generate variations of each word. This approach is called a hybrid attack. Which tool, when used with a rule file, can perform such an attack?

Accepted Answer

Hashcat. Hashcat is a powerful password recovery tool that supports hybrid attacks by combining a wordlist with rule-based mutations. When used with a rule file (e.g., best64.rule), Hashcat applies transformations like prefixing, suffixing, or character substitution to each word, enabling efficient generation of password variations. This directly matches the hybrid attack described in the question.

Answer

RainbowCrack

Answer

Ophcrack

Answer

Hydra