CEH Enumeration and System Hacking Practice Test 9 — 15 Questions

Question 1

A forensic analyst discovers that an attacker used a rootkit to hide malicious processes and files on a compromised Linux system. The rootkit also intercepts system calls to `open()` and `stat()` to return clean results. Which of the following techniques is the rootkit using to cover its tracks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Syscall hooking to modify the return values of userland commands. The rootkit intercepts system calls like `open()` and `stat()` to return clean results, which is a classic example of syscall hooking. By hooking these kernel-level functions, the rootkit can filter out any information about its own malicious files and processes, making them invisible to userland commands such as `ls`, `ps`, or `cat`. This technique operates at the kernel level, not in user space, allowing it to control what data is returned to any process that makes those syscalls.

Answer

Steganography to conceal malicious files in image metadata

Answer

Token impersonation to gain administrator privileges

Answer

Log manipulation by clearing entries in /var/log

Question 2

Which of the following is a primary purpose of the enumeration phase in a penetration test?

Accepted Answer

To gather in-depth information about the target system and its resources. The enumeration phase is the active process of extracting detailed information about a target system, such as user accounts, network shares, services, and system policies, using direct queries. This phase goes beyond passive reconnaissance by establishing connections to the target to gather data that can be used to identify attack vectors. In a CEH context, enumeration is specifically defined as the step where the tester collects in-depth information about the target's resources and potential entry points.

Answer

To exploit identified vulnerabilities and gain access

Answer

To perform a vulnerability scan on the target network

Answer

To delete logs and cover tracks after a successful compromise

Question 3

A security analyst is investigating a potential SMB-based attack. They notice unusual traffic on port 445 from a host running `enum4linux`. Which of the following enumeration actions could `enum4linux` perform that would generate such traffic?

Accepted Answer

Enumerating SMB shares and user accounts. enum4linux is a tool specifically designed for enumerating information from Windows and Samba systems via the SMB protocol (port 445). It can list SMB shares, retrieve user account lists, and gather other system details by querying the SMB service, which directly generates traffic on port 445.

Answer

Scanning for open ports on the target system

Answer

Performing a DNS zone transfer

Answer

Querying SNMP MIB values using community strings

Question 4

Which TWO of the following are valid enumeration techniques used to identify user accounts on a system? (Select 2)

Accepted Answer

SMTP VRFY command. SMTP VRFY (option C) is a valid user-enumeration technique because the SMTP VRFY command asks the mail server to verify whether a given mailbox or username exists, and servers that respond with 250/251 confirm the account while 550 indicates it does not exist. SMB enumeration with enum4linux (option E) is also valid because it queries SMB/RPC services (such as SAMR and LSA) to extract usernames, groups, shares, and password policy information from Windows and Samba hosts. Port scanning with nmap (option A) only identifies open ports and services, not user accounts, so it is not an enumeration technique for accounts. A DNS zone transfer (option B) can reveal hostnames and subdomains but does not enumerate system user accounts. SNMPwalk of the entire MIB (option D) gathers device and system information via OIDs but does not directly enumerate user accounts on the target system.

Answer

Port scanning with nmap

Answer

DNS zone transfer

Answer

SNMPwalk of the entire MIB

Question 5

A penetration tester is tasked with performing privilege escalation on a Windows system. Which THREE of the following methods are commonly used for Windows privilege escalation? (Select 3)

Accepted Answer

Token impersonation (e.g., SeImpersonatePrivilege). Token impersonation (B) is a classic Windows privilege escalation technique: if a service account holds SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege), tools like JuicyPotato, RoguePotato, or PrintSpoofer can impersonate a SYSTEM token to gain elevated privileges. Exploiting unquoted service paths (C) works because Windows resolves unquoted paths containing spaces by trying each possible executable name in order, so a low-privileged user who can write to an earlier directory in the path can plant a malicious binary that runs as the service account (often SYSTEM). Exploiting weak service permissions (E) is also valid on Windows, since misconfigured service DACLs allowing SERVICE_CHANGE_CONFIG or WRITE_DAC let an attacker reconfigure the service binary path or replace its executable to run code as the service's privileged account. SUID bit abuse (A) is a Linux/Unix mechanism and does not exist on Windows filesystems, and pass-the-hash (D), while a Windows credential-reuse attack, is a lateral movement/authentication technique rather than a local privilege escalation method, so neither belongs here.

Answer

SUID bit abuse

Answer

Pass-the-hash attack

Question 6

Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)

Accepted Answer

Hashcat. Hashcat is a high-performance password recovery tool that supports offline cracking of password hashes using GPU acceleration. It can process a wide range of hash types (e.g., MD5, SHA-1, bcrypt, NTLM) by comparing precomputed or brute-force generated hashes against a target hash file, all without interacting with a live authentication server.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 7

A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?

Accepted Answer

Display the NetBIOS name table of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.

Answer

Perform a reverse DNS lookup

Answer

Test connectivity to the remote host using ICMP

Answer

Enumerate DNS records for the domain

Question 8

Which tool is specifically designed to enumerate SMB shares and user accounts on a Windows target by leveraging the SMB protocol?

Accepted Answer

Enum4linux. Enum4linux is a tool specifically designed to enumerate SMB shares and user accounts on Windows targets by leveraging the SMB protocol. It uses the SMB/CIFS protocol to query services like the SAMR (Security Account Manager Remote) and LSARPC (Local Security Authority Remote Procedure Call) interfaces to extract user lists, share listings, and OS information. This makes it the correct choice for targeted SMB enumeration.

Answer

Wireshark

Answer

Nmap

Answer

Hydra

Question 9

During an SMTP enumeration, a penetration tester connects to the mail server on port 25 and issues the commands 'VRFY root', 'EXPN admin', and 'RCPT TO:unknown@domain.com'. The server responds with '252' for VRFY, '250' for EXPN, and '550' for RCPT TO. What does this indicate?

Accepted Answer

The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist. The SMTP response code 252 for VRFY root typically indicates that the user exists but is disabled or cannot receive mail at this time (the server knows the user but restricts verification). A 250 response for EXPN admin confirms that the admin mailing list exists. The 550 response for RCPT TO:unknown@domain.com definitively indicates that the recipient does not exist on the server. Therefore, option A correctly interprets these responses: root exists but is disabled, the admin list exists, and the unknown user does not exist.

Answer

The server has open relay enabled

Answer

The server is vulnerable to SMTP injection

Answer

The server is not running SMTP

Question 10

Which of the following tools is used to crack Windows LAN Manager (LM) and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It is optimized for Windows password hashes and provides an efficient time-memory trade-off by looking up hashes in sorted tables.

Answer

Hashcat

Answer

John the Ripper

Answer

Hydra

Question 11

After compromising a system, an attacker wants to erase their tracks. They clear the Windows Event Logs using `wevtutil cl` commands. However, the logs are forwarded to a remote SIEM. Which covering tracks technique would be MOST effective to avoid detection?

Accepted Answer

Modify specific event log entries to remove evidence of their actions. Modifying specific event log entries directly removes the incriminating evidence without disrupting the logging pipeline. Since logs are forwarded to a remote SIEM, simply clearing or disabling local logs would trigger an alert due to a gap in log forwarding. By surgically editing only the relevant entries (e.g., using PowerShell or API calls to alter Event Log records), the attacker avoids detection while the SIEM continues to receive logs, maintaining the appearance of normal operation.

Answer

Disable Windows Event Log service (EventLog)

Answer

Use a rootkit to hide files and processes

Answer

Encrypt the log files

Question 12

A penetration tester discovers a service running on UDP port 161 with a default community string 'public'. They use `snmpwalk -v2c -c public 192.168.1.10` and retrieve extensive system information. Which enumeration technique is being performed?

Accepted Answer

SNMP enumeration. The question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.

Answer

SMB enumeration

Answer

LDAP enumeration

Answer

SMTP enumeration

Question 13

In the context of system hacking methodology (CHPSET), which phase involves hiding malicious files from the operating system and security tools using techniques such as NTFS alternate data streams (ADS) or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Erasing tracks, Hiding files) methodology specifically involves concealing malicious files from the OS and security tools. Techniques like NTFS alternate data streams (ADS) allow data to be stored in a file's metadata stream (e.g., type echo payload > file.txt:stream) without affecting the visible file size, while steganography hides data within images or audio files. This phase occurs after gaining access and before covering tracks.

Answer

Privilege escalation

Answer

Erasing tracks

Answer

Cracking passwords

Question 14

Which password cracking method uses a precomputed table of hash chains to reverse password hashes quickly?

Accepted Answer

Rainbow table attack. A rainbow table attack is correct because it uses precomputed tables of hash chains to reverse password hashes quickly. Instead of computing the hash for every possible password in real time, the attacker looks up the hash in the table to find the corresponding plaintext, drastically reducing the time needed for cracking.

Answer

Hybrid attack

Answer

Dictionary attack

Answer

Brute-force attack

Question 15

A security analyst notices that an attacker has gained SYSTEM privileges on a Windows server after compromising a service running as LOCAL SYSTEM. The attacker then uses `whoami /priv` and finds the SeTcbPrivilege (Act as part of the operating system) is enabled. Which privilege escalation technique might the attacker use next?

Accepted Answer

Token impersonation. With SeTcbPrivilege enabled, the attacker can call the `CreateProcessAsUser` or `DuplicateTokenEx` API to impersonate any user token, including SYSTEM. This is a classic token impersonation attack, allowing the attacker to elevate from LOCAL SYSTEM to a higher-integrity context or move laterally by creating processes with arbitrary identities.

Answer

Sticky keys exploit

Answer

DLL injection

Answer

Pass-the-hash