CEH Enumeration and System Hacking Practice Test 9 — 15 Questions

Question 1

A security team has collected a hash file from a compromised Windows server that contains NTLM hashes. They want to crack the passwords as quickly as possible using a precomputed lookup table. Which tool and technique combination is BEST suited for this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use RainbowCrack with precomputed rainbow tables. RainbowCrack is specifically designed for fast password cracking using precomputed rainbow tables, which are lookup tables that store hash chains for rapid reversal of hashes. Since the team already has NTLM hashes and wants the quickest method, RainbowCrack with precomputed tables avoids the computational overhead of real-time hashing, making it the best fit for this scenario.

Answer

Use John the Ripper in incremental mode

Answer

Use Hydra with a dictionary of common passwords

Answer

Use Hashcat with a rules-based attack

Question 2

A penetration tester is enumerating an SMTP server on port 25. They issue the command `VRFY root` and receive a 250 response, then `VRFY admin` also returns 250. What does this indicate about the SMTP server?

Accepted Answer

Both root and admin are valid email accounts on the server. The VRFY command is used to verify whether a specific user exists on an SMTP server. A 250 response code indicates that the user is valid and the mailbox exists. Since both `root` and `admin` returned 250, this confirms that both are valid email accounts on the server, making option A correct.

Answer

The SMTP server supports password authentication

Answer

The command failed due to syntax errors

Answer

The SMTP server has disabled user verification

Question 3

A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?

Accepted Answer

ldapsearch. ldapsearch is the correct tool because it can perform anonymous LDAP queries against a Windows domain controller's LDAP service (port 389) without requiring authentication. By default, many Windows DCs allow anonymous binds to retrieve directory information such as user and group objects, making ldapsearch the most direct and appropriate choice for this task.

Answer

smbclient

Answer

snmpwalk

Answer

enum4linux

Question 4

An attacker has gained access to a Linux server and wants to cover their tracks. They edit the `.bash_history` file, modify system logs in `/var/log`, and install a kernel module that hides their processes. Which two steps of the system hacking methodology (CHPSET) are being performed?

Accepted Answer

Erasing tracks and Spying. The attacker is performing 'Erasing tracks' by editing .bash_history and modifying logs in /var/log, and 'Spying' by installing a kernel module to hide processes, which allows continued covert monitoring. These correspond to the 'Erasing tracks' and 'Spying' steps in the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Executing applications, Erasing tracks) methodology.

Answer

Erasing tracks and Privilege escalation

Answer

Cracking passwords and Covering tracks

Answer

Executing applications and Spying

Question 5

Which of the following tools is specifically designed to enumerate SMB shares and user information from Windows systems using the SMB protocol?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate SMB shares, user lists, OS information, and other details from Windows systems by leveraging the SMB protocol (typically over TCP/445 or TCP/139). It automates queries using SMB RPC calls, such as those from the `samr` and `lsarpc` pipes, making it the correct choice for targeted SMB enumeration.

Answer

snmpwalk

Answer

nmap

Answer

hping3

Question 6

A penetration tester is performing SNMP enumeration against a network device and wants to retrieve the entire Management Information Base (MIB) tree. Which command should they use?

Accepted Answer

snmpwalk -v 2c -c public 192.168.1.1 .1. `snmpwalk` is specifically designed to retrieve a subtree of MIB objects by performing a series of GETNEXT requests starting from a given OID. Using `.1` as the root OID (which corresponds to the entire ISO tree) with the SNMPv2c community string 'public' will enumerate all accessible OIDs in the MIB tree, effectively dumping the entire Management Information Base.

Answer

snmpset -v 2c -c private 192.168.1.1 1.3.6.1.2.1.1.0 s 'test'

Answer

snmpbulkwalk -v 2c -c public 192.168.1.1 .1

Answer

snmpget -v 2c -c public 192.168.1.1 1.3.6.1.2.1.1

Question 7

During a password cracking session, a pentester uses a wordlist combined with rules to generate variations of each word. This approach is called a hybrid attack. Which tool, when used with a rule file, can perform such an attack?

Accepted Answer

Hashcat. Hashcat is a powerful password recovery tool that supports hybrid attacks by combining a wordlist with rule-based mutations. When used with a rule file (e.g., best64.rule), Hashcat applies transformations like prefixing, suffixing, or character substitution to each word, enabling efficient generation of password variations. This directly matches the hybrid attack described in the question.

Answer

RainbowCrack

Answer

Ophcrack

Answer

Hydra

Question 8

A forensic analyst discovers that an attacker used a rootkit to hide malicious processes and files on a compromised Linux system. The rootkit also intercepts system calls to `open()` and `stat()` to return clean results. Which of the following techniques is the rootkit using to cover its tracks?

Accepted Answer

Syscall hooking to modify the return values of userland commands. The rootkit intercepts system calls like `open()` and `stat()` to return clean results, which is a classic example of syscall hooking. By hooking these kernel-level functions, the rootkit can filter out any information about its own malicious files and processes, making them invisible to userland commands such as `ls`, `ps`, or `cat`. This technique operates at the kernel level, not in user space, allowing it to control what data is returned to any process that makes those syscalls.

Answer

Steganography to conceal malicious files in image metadata

Answer

Token impersonation to gain administrator privileges

Answer

Log manipulation by clearing entries in /var/log

Question 9

Which of the following is a primary purpose of the enumeration phase in a penetration test?

Accepted Answer

To gather in-depth information about the target system and its resources. The enumeration phase is the active process of extracting detailed information about a target system, such as user accounts, network shares, services, and system policies, using direct queries. This phase goes beyond passive reconnaissance by establishing connections to the target to gather data that can be used to identify attack vectors. In a CEH context, enumeration is specifically defined as the step where the tester collects in-depth information about the target's resources and potential entry points.

Answer

To exploit identified vulnerabilities and gain access

Answer

To perform a vulnerability scan on the target network

Answer

To delete logs and cover tracks after a successful compromise

Question 10

A security analyst is investigating a potential SMB-based attack. They notice unusual traffic on port 445 from a host running `enum4linux`. Which of the following enumeration actions could `enum4linux` perform that would generate such traffic?

Accepted Answer

Enumerating SMB shares and user accounts. enum4linux is a tool specifically designed for enumerating information from Windows and Samba systems via the SMB protocol (port 445). It can list SMB shares, retrieve user account lists, and gather other system details by querying the SMB service, which directly generates traffic on port 445.

Answer

Scanning for open ports on the target system

Answer

Performing a DNS zone transfer

Answer

Querying SNMP MIB values using community strings

Question 11

Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)

Accepted Answer

Hashcat. Hashcat is a high-performance password recovery tool that supports offline cracking of password hashes using GPU acceleration. It can process a wide range of hash types (e.g., MD5, SHA-1, bcrypt, NTLM) by comparing precomputed or brute-force generated hashes against a target hash file, all without interacting with a live authentication server.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 12

A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?

Accepted Answer

Display the NetBIOS name table of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.

Answer

Perform a reverse DNS lookup

Answer

Test connectivity to the remote host using ICMP

Answer

Enumerate DNS records for the domain

Question 13

Which tool is specifically designed to enumerate SMB shares and user accounts on a Windows target by leveraging the SMB protocol?

Accepted Answer

Enum4linux. Enum4linux is a tool specifically designed to enumerate SMB shares and user accounts on Windows targets by leveraging the SMB protocol. It uses the SMB/CIFS protocol to query services like the SAMR (Security Account Manager Remote) and LSARPC (Local Security Authority Remote Procedure Call) interfaces to extract user lists, share listings, and OS information. This makes it the correct choice for targeted SMB enumeration.

Answer

Wireshark

Answer

Nmap

Answer

Hydra

Question 14

During an SMTP enumeration, a penetration tester connects to the mail server on port 25 and issues the commands 'VRFY root', 'EXPN admin', and 'RCPT TO:unknown@domain.com'. The server responds with '252' for VRFY, '250' for EXPN, and '550' for RCPT TO. What does this indicate?

Accepted Answer

The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist. The SMTP response code 252 for VRFY root typically indicates that the user exists but is disabled or cannot receive mail at this time (the server knows the user but restricts verification). A 250 response for EXPN admin confirms that the admin mailing list exists. The 550 response for RCPT TO:unknown@domain.com definitively indicates that the recipient does not exist on the server. Therefore, option A correctly interprets these responses: root exists but is disabled, the admin list exists, and the unknown user does not exist.

Answer

The server has open relay enabled

Answer

The server is vulnerable to SMTP injection

Answer

The server is not running SMTP

Question 15

Which of the following tools is used to crack Windows LAN Manager (LM) and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It is optimized for Windows password hashes and provides an efficient time-memory trade-off by looking up hashes in sorted tables.

Answer

Hashcat

Answer

John the Ripper

Answer

Hydra