CEH Enumeration and System Hacking — Timed 10 Questions

Question 1

During a penetration test, you gain access to a target system as a low-privileged user. Which of the following is the BEST next step according to the CEH system hacking methodology (CHPSET)?

Accepted Answer

Escalate privileges to gain higher-level access. The CEH methodology includes phases such as Cracking passwords, Privilege escalation, Hiding files, Executing applications, Spying, and Erasing tracks. After gaining initial access as a low-privileged user, the next logical step is to escalate privileges to gain higher access (e.g., administrator or root).

Answer

Execute applications to extract data

Answer

Hide files to conceal tools and data

Answer

Erase event logs to avoid detection

Question 2

During a penetration test, you successfully execute a privilege escalation attack by abusing a service running with SYSTEM privileges on a Windows machine. Which of the following techniques is MOST likely being used?

Accepted Answer

DLL hijacking. DLL hijacking is the most likely technique because it involves placing a malicious DLL where a service that runs with SYSTEM privileges will load it, causing the attacker's code to execute with SYSTEM privileges. Token impersonation relies on stealing or duplicating access tokens and typically requires SeImpersonate/SeAssignPrimaryToken privileges; it does not require modifying what a service loads. Pass-the-hash is primarily credential-based lateral movement, and SUID abuse is a Unix/Linux privilege escalation method.

Answer

Pass-the-hash

Answer

SUID abuse

Answer

Token impersonation

Question 3

Which TWO of the following are valid SMTP enumeration commands that can be used to discover valid email addresses? (Select 2)

Accepted Answer

EXPN. EXPN is a valid SMTP command that requests the server to expand a mailing list or alias, revealing the individual email addresses that belong to it. VRFY is another valid SMTP command that requests the server to verify if a mailbox exists for a given user. Both commands are useful for discovering valid email addresses without sending a message, as defined in RFC 821.

Answer

HELO

Answer

RCPT TO

Answer

ATRN

Question 4

Which THREE of the following are password cracking techniques that can be used with Hashcat? (Select 3)

Accepted Answer

Brute-force attack. Hashcat is a GPU-accelerated password recovery tool that supports multiple attack modes.
A **Brute-force attack** (option B) systematically tries every possible combination of characters from a defined keyspace until the correct password is found. Hashcat implements this via its '?a' mask or direct brute-force mode, making it a core technique for cracking hashes when no prior knowledge of the password exists.
A **Dictionary attack** (option D) attempts to crack passwords by trying words from a predefined list (dictionary). Hashcat supports this mode, allowing users to specify wordlists for efficient cracking of common or weak passwords.
A **Hybrid attack** (option E) combines elements of dictionary and brute-force attacks. For example, it might append or prepend numbers/symbols to dictionary words, or use a mask with a dictionary word, significantly increasing the chances of cracking passwords that are variations of common words.

Answer

Token impersonation

Answer

Rainbow table attack

Question 5

A system administrator wants to enumerate all users in an Active Directory domain. Which protocol and query technique should they use?

Accepted Answer

LDAP anonymous query. LDAP anonymous queries allow unauthenticated users to query an Active Directory domain for directory information, including user enumeration. While modern Active Directory configurations often restrict anonymous LDAP binds by default for security reasons, if enabled or misconfigured, it becomes a highly effective technique for enumerating users without credentials.

Answer

SNMP with public community string

Answer

SMB null session

Answer

SMTP VRFY

Question 6

Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)

Accepted Answer

smbclient. smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Windows file shares. It can list available shares with the `-L` option and, with valid credentials, enumerate users via the `-U` flag or by browsing the IPC$ share. enum4linux is a wrapper script that automates the enumeration of information from Windows and Samba hosts, including users, groups, shares, and more, by leveraging tools like smbclient and rpcclient. Both are direct tools for SMB enumeration.

Answer

nslookup

Answer

snmpwalk

Answer

ldapsearch

Question 7

Which THREE of the following are valid techniques in the system hacking methodology (CHPSET)? (Choose three.)

Accepted Answer

Privilege escalation. The CEH system hacking methodology, often remembered by the acronym CHPSET, includes Cracking Passwords, Hacking, Privilege Escalation, System Hacking, Erasing Tracks, and Tunneling. Therefore, Privilege Escalation (P), Erasing Tracks (E), and Cracking Passwords (C) are all explicit and valid techniques within this methodology. Privilege escalation involves gaining higher-level access (e.g., from a standard user to root or SYSTEM) to gain full control over the target system. Erasing tracks aims to remove evidence of the attack to maintain anonymity and prevent detection. Cracking passwords is a fundamental step often used for initial access or privilege escalation by gaining credentials.

Answer

Social engineering

Answer

Network sniffing

Question 8

Which TWO tools are commonly used for enumerating NFS exports on a target system? (Select 2 correct answers)

Accepted Answer

nmap (with script nfs-ls). B is correct because nmap's nfs-ls script is specifically designed to enumerate NFS exports by querying the NFS service (port 2049) and listing the available shares. It works by sending MOUNT protocol requests to the target, which reveals the exported file systems and their access permissions, making it a standard tool for NFS enumeration in penetration testing. D is also correct because showmount is a standard command-line utility used to query the mount daemon on a remote host for a list of exported directories. The 'showmount -e <target_ip>' command is commonly used to display the NFS exports available from a server.

Answer

enum4linux

Answer

smbclient

Answer

ldapsearch

Question 9

Which of the following is the correct order of phases in the system hacking methodology known as CHPSET?

Accepted Answer

Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing. The CHPSET methodology in system hacking stands for Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing. Option D correctly lists these phases in order: Cracking (password cracking), Hiding (covering tracks), Privilege escalation (gaining higher access), Executing (running malicious code), Spying (monitoring activity), and Erasing (removing evidence). This sequence follows the logical progression from initial access to maintaining access and finally covering tracks.

Answer

Spying, Erasing, Cracking, Hiding, Privilege escalation, Executing

Answer

Privilege escalation, Cracking, Hiding, Executing, Spying, Erasing

Answer

Executing, Cracking, Spying, Hiding, Privilege escalation, Erasing

Question 10

Which TWO tools are commonly used for password cracking against hashed passwords? (Select two.)

Accepted Answer

John the Ripper. John the Ripper (B) is a widely used offline password cracking tool that supports various hash algorithms (e.g., MD5, SHA-1, bcrypt) and modes like dictionary, brute-force, and incremental attacks. It is specifically designed to recover passwords from hashed password files. Hashcat (D) is another extremely powerful and popular password cracking utility, known for its high performance, especially with GPU acceleration, and its ability to crack a vast array of hash types and attack modes (e.g., dictionary, brute-force, hybrid, mask attacks). Both are standard tools for cracking stored hashed passwords.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit