CEH Enumeration and System Hacking Practice Test 9 — 15 Questions

Question 1

A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?

Accepted Answer

Display the NetBIOS name table of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.

Answer

Perform a reverse DNS lookup

Answer

Test connectivity to the remote host using ICMP

Answer

Enumerate DNS records for the domain

Question 2

Which tool is specifically designed to enumerate SMB shares and user accounts on a Windows target by leveraging the SMB protocol?

Accepted Answer

Enum4linux. enum4linux is a Perl script that wraps Samba tools (like smbclient, rpclient, net) to enumerate SMB shares, users, groups, and more from Windows hosts.

Answer

Wireshark

Answer

Nmap

Answer

Hydra

Question 3

During an SMTP enumeration, a penetration tester connects to the mail server on port 25 and issues the commands 'VRFY root', 'EXPN admin', and 'RCPT TO:unknown@domain.com'. The server responds with '252' for VRFY, '250' for EXPN, and '550' for RCPT TO. What does this indicate?

Accepted Answer

The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist. VRFY returns 252 if the user exists but is disabled (or ambiguous), EXPN returns 250 if the mailing list/alias exists, RCPT TO returns 550 if the mailbox does not exist. This allows enumerating valid users on the server.

Answer

The server has open relay enabled

Answer

The server is vulnerable to SMTP injection

Answer

The server is not running SMTP

Question 4

An attacker gains access to a Linux web server as the 'www-data' user. They run `find / -perm -4000 -type f 2>/dev/null` and see that `/usr/bin/passwd` has the SUID bit set. Which privilege escalation technique is this command checking for?

Accepted Answer

SUID abuse. The find command searches for files with SUID bit set (4000). SUID binaries run with the file owner's privileges, often root. Checking for SUID files is a common technique to find potential privilege escalation vectors, e.g., exploiting a vulnerable SUID binary.

Answer

Password cracking

Answer

Kernel exploit

Answer

Token impersonation

Question 5

Which of the following tools is used to crack Windows LAN Manager (LM) and NTLM password hashes using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is a tool that uses rainbow tables (precomputed hash chains) to crack password hashes, including LM and NTLM. Ophcrack also uses rainbow tables but is specifically for LM hashes; RainbowCrack is more general.

Answer

Hashcat

Answer

John the Ripper

Answer

Hydra

Question 6

After compromising a system, an attacker wants to erase their tracks. They clear the Windows Event Logs using `wevtutil cl` commands. However, the logs are forwarded to a remote SIEM. Which covering tracks technique would be MOST effective to avoid detection?

Accepted Answer

Modify specific event log entries to remove evidence of their actions. If logs are forwarded to a remote SIEM, local log deletion will still leave traces in the SIEM. A better approach is to manipulate specific log entries (e.g., modify or delete only the incriminating entries) to avoid raising alert on bulk deletion. However, the best among options is to modify logs selectively.

Answer

Disable Windows Event Log service (EventLog)

Answer

Use a rootkit to hide files and processes

Answer

Encrypt the log files

Question 7

A penetration tester discovers a service running on UDP port 161 with a default community string 'public'. They use `snmpwalk -v2c -c public 192.168.1.10` and retrieve extensive system information. Which enumeration technique is being performed?

Accepted Answer

SNMP enumeration. The correct answer is D because the question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.

Answer

SMB enumeration

Answer

LDAP enumeration

Answer

SMTP enumeration

Question 8

In the context of system hacking methodology (CHPSET), which phase involves hiding malicious files from the operating system and security tools using techniques such as NTFS alternate data streams (ADS) or steganography?

Accepted Answer

Hiding files. CHPSET: Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing tracks. Hiding files involves techniques like ADS or steganography to conceal malicious files.

Answer

Privilege escalation

Answer

Erasing tracks

Answer

Cracking passwords

Question 9

Which password cracking method uses a precomputed table of hash chains to reverse password hashes quickly?

Accepted Answer

Rainbow table attack. Rainbow tables are precomputed tables of hash chains that allow fast lookup to reverse a hash into a plaintext password.

Answer

Hybrid attack

Answer

Dictionary attack

Answer

Brute-force attack

Question 10

A security analyst notices that an attacker has gained SYSTEM privileges on a Windows server after compromising a service running as LOCAL SYSTEM. The attacker then uses `whoami /priv` and finds the SeTcbPrivilege (Act as part of the operating system) is enabled. Which privilege escalation technique might the attacker use next?

Accepted Answer

Token impersonation. SeTcbPrivilege allows impersonating any user, including SYSTEM. It can be used to execute processes under arbitrary identities, enabling further privilege escalation.

Answer

Sticky keys exploit

Answer

DLL injection

Answer

Pass-the-hash

Question 11

During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?

Accepted Answer

LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk. The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.

Answer

NFS enumeration; it indicates that NFS shares are world-readable

Answer

SNMP enumeration; it indicates that the community string is weak

Answer

SMTP enumeration; it indicates that the mail server is misconfigured

Question 12

A penetration tester gains access to a Linux server and attempts to escalate privileges. They run `sudo -l` and see that the user can run `/usr/bin/vim` as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

Use vim's shell escape via `:!bash` to get a root shell. If a user has sudo rights to run vim as root, they can escape to a shell by typing `:!bash` within vim, gaining a root shell. This is a known sudo privilege escalation vector.

Answer

Perform token impersonation using SeImpersonatePrivilege

Answer

Exploit a kernel vulnerability (CVE-2023-xxxx)

Answer

Abuse the SUID bit on vim

Question 13

Which TWO of the following are enumeration techniques used to gather information from Windows systems? (Select 2)

Accepted Answer

SMB enumeration using enum4linux. NetBIOS enumeration (nbtstat) and SMB enumeration (enum4linux, smbclient) are both Windows-oriented. LDAP enumeration is for directory services, not exclusively Windows; SMTP is mail; NFS is Unix/Linux.

Answer

SMTP enumeration using VRFY

Answer

LDAP enumeration using ldapsearch

Answer

NFS enumeration using showmount

Question 14

Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)

Accepted Answer

Installing a rootkit to hide files and processes. Covering tracks includes log manipulation (clearing or modifying logs), using rootkits to hide processes/files, and steganography to hide malicious data. Disabling antivirus is more of an evasion technique during the attack, not specifically covering tracks. Privilege escalation is a different phase.

Answer

Escalating privileges to SYSTEM

Answer

Disabling antivirus software

Question 15

Which TWO of the following are password cracking techniques? (Select 2)

Accepted Answer

Rainbow table attack. Dictionary attack and rainbow table attack are both password cracking techniques. SQL injection is a web attack, not password cracking. Phishing is social engineering. ARP spoofing is network attack.

Answer

SQL injection

Answer

Phishing

Answer

ARP spoofing