CEH Enumeration and System Hacking — Timed 40 Questions

Question 1

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

Accepted Answer

nbtstat. The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

Answer

nslookup

Answer

netstat

Answer

net view

Question 2

During a penetration test, you gain access to a target system as a low-privileged user. Which of the following is the BEST next step according to the CEH system hacking methodology (CHPSET)?

Accepted Answer

Escalate privileges to gain higher-level access. The CEH methodology follows: Cracking passwords, Hiding files, Privilege escalation, Executing applications, Spying, Erasing tracks. After gaining initial access as a low-privileged user, the next logical step is to escalate privileges to gain higher access (e.g., administrator or root).

Answer

Execute applications to extract data

Answer

Hide files to conceal tools and data

Answer

Erase event logs to avoid detection

Question 3

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

Accepted Answer

Privilege escalation; gain root access. A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

Answer

Information disclosure; read sensitive files

Answer

Denial of service; crash the system

Answer

Buffer overflow; execute arbitrary code

Question 4

A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?

Accepted Answer

Use enum4linux -a 192.168.1.10 to enumerate users and policies. The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.

Answer

Attempt to crack the administrator password using a dictionary attack

Answer

Perform a port scan to check for open ports

Answer

Run snmpwalk to retrieve SNMP community strings

Question 5

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY enumeration. The VRFY command is an SMTP command defined in RFC 821 that asks the server to verify whether a given email address exists. When the server responds with '250 OK' for a valid address and '550 No such user' for an invalid one, the attacker is directly using the VRFY command to enumerate valid users. This is explicitly known as VRFY enumeration.

Answer

EXPN enumeration

Answer

SMTP banner grabbing

Answer

RCPT TO enumeration

Question 6

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

Accepted Answer

Erasing tracks. The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

Answer

Spying

Answer

Executing applications

Answer

Cracking passwords

Question 7

Which of the following tools is specifically designed to perform password cracking using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.

Answer

John the Ripper

Answer

Ophcrack

Answer

Hashcat

Question 8

During a penetration test, you successfully execute a privilege escalation attack by abusing a service running with SYSTEM privileges on a Windows machine. Which of the following techniques is MOST likely being used?

Accepted Answer

Token impersonation. Token impersonation is the correct technique because it allows an attacker to steal or duplicate an access token from a process running with SYSTEM privileges. Once the attacker has a token with SYSTEM integrity level, they can use Windows API calls such as ImpersonateLoggedOnUser or DuplicateTokenEx to execute code in the security context of that token, effectively escalating privileges to SYSTEM.

Answer

Pass-the-hash

Answer

SUID abuse

Answer

DLL hijacking

Question 9

A penetration tester executes the command: snmpwalk -c public -v2c 192.168.1.50. Which of the following BEST describes the purpose of this command?

Accepted Answer

Enumerate the MIB tree of the SNMP agent using the 'public' community string. The `snmpwalk` command is used to retrieve a subtree of management information from an SNMP agent. By specifying `-c public` (the community string) and `-v2c` (SNMP version 2c), the command performs a GETNEXT request cycle to walk the entire MIB tree, enumerating all accessible OIDs and their values. Option D correctly identifies this as enumerating the MIB tree using the 'public' community string.

Answer

Modify SNMP settings on the remote device

Answer

Perform a brute-force attack on the SNMP community string

Answer

Test the SNMP agent for denial of service vulnerabilities

Question 10

A security analyst is investigating a compromised Linux system. The /var/log/auth.log file appears to be truncated, and the timestamps on several binaries in /bin/ have been modified. Which of the following tools or techniques is the attacker MOST likely using to cover tracks?

Accepted Answer

Rootkit. The attacker is most likely using a rootkit to cover tracks because rootkits are designed to hide malicious activity by intercepting system calls (e.g., via LD_PRELOAD or kernel modules) to hide processes, files, and network connections. The truncated auth.log and modified timestamps on binaries in /bin/ indicate the rootkit is actively tampering with system logs and file metadata to evade detection, which aligns with rootkit behavior rather than simpler tools.

Answer

Timestamp manipulation tool

Answer

Steganography

Answer

Log cleaner script

Question 11

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

Accepted Answer

Use ldapsearch to query the directory for all attributes. Option C is correct because `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.

Answer

Run nmap with the smb-enum-shares script

Answer

Perform a DNS zone transfer

Answer

Use net view to list domain resources

Question 12

An attacker has gained access to a Windows server and wants to crack the password hashes extracted from the SAM file. The attacker knows the passwords are complex but wants to maximize speed. Which tool is BEST suited for high-speed password cracking using GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the correct answer because it is specifically designed for high-speed password cracking using GPU acceleration, leveraging OpenCL or CUDA to offload computation to the GPU. This allows it to achieve millions of hashes per second, making it ideal for cracking complex passwords from SAM hashes (NTLM) when speed is the priority.

Answer

Ophcrack

Answer

RainbowCrack

Answer

John the Ripper

Question 13

Which TWO of the following are valid SMTP enumeration commands that can be used to discover valid email addresses? (Select 2)

Accepted Answer

EXPN. EXPN is a valid SMTP command that requests the server to expand a mailing list or alias, revealing the individual email addresses that belong to it. This enumeration technique is useful for discovering valid email addresses without sending a message, as defined in RFC 821.

Answer

HELO

Answer

RCPT TO

Answer

ATRN

Question 14

Which TWO of the following are common tools used for SMB enumeration? (Select 2)

Accepted Answer

enum4linux. enum4linux is a wrapper tool that leverages SMB/CIFS operations (via smbclient, rpcclient, and net) to enumerate user lists, share listings, OS information, and password policies from Windows and Samba targets. It directly queries the SMB protocol (port 445/139) and is a standard tool for SMB enumeration in penetration testing.

Answer

ldapsearch

Answer

snmpwalk

Answer

nbtstat

Question 15

Which THREE of the following are password cracking techniques that can be used with Hashcat? (Select 3)

Accepted Answer

Brute-force attack. Hashcat is a GPU-accelerated password recovery tool that supports multiple attack modes. A brute-force attack (option B) systematically tries every possible combination of characters from a defined keyspace until the correct password is found. Hashcat implements this via its '?a' mask or direct brute-force mode, making it a core technique for cracking hashes when no prior knowledge of the password exists.

Answer

Token impersonation

Answer

Rainbow table attack

Question 16

A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?

Accepted Answer

NetBIOS names and their associated service types. The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.

Answer

SMB share lists and open sessions

Answer

DNS records for the host and domain

Answer

ARP cache entries for the subnet

Question 17

During a penetration test, you execute the command `enum4linux -a 192.168.1.20`. The output reveals that the 'backup' account has a blank password and belongs to the 'Domain Admins' group. Which phase of the CHPSET methodology does identifying this vulnerability belong to?

Accepted Answer

Cracking passwords. The command `enum4linux -a` enumerates SMB shares, users, and password policies from a Windows target. Discovering that the 'backup' account has a blank password directly identifies a weak or missing credential, which falls under the 'Cracking passwords' phase of the CHPSET methodology. This phase involves identifying and exploiting weak, default, or blank passwords to gain unauthorized access.

Answer

Privilege escalation

Answer

Spying

Answer

Executing applications

Question 18

A forensic analyst examining a compromised Linux system finds the following entry in /var/log/auth.log: `Mar 15 10:23:45 server sshd[1234]: Accepted password for root from 10.0.0.5 port 54321 ssh2`. However, the analyst also notices that /var/log/auth.log has been truncated and the /etc/ssh/sshd_config file contains `LogLevel QUIET`. Which attack phase is most likely being obscured?

Accepted Answer

Erasing tracks. The presence of `LogLevel QUIET` in sshd_config suppresses all authentication log entries, and the truncation of /var/log/auth.log indicates an attempt to remove evidence of unauthorized access. Together, these actions are classic examples of erasing tracks, as the attacker is modifying logs and configuration to hide their activities from forensic analysis.

Answer

Privilege escalation

Answer

Executing applications

Answer

Spying

Question 19

An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?

Accepted Answer

Token impersonation using RottenPotato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

SUID abuse

Question 20

A system administrator wants to enumerate all users in an Active Directory domain. Which protocol and query technique should they use?

Accepted Answer

LDAP anonymous query. Option D is correct because LDAP anonymous queries allow unauthenticated users to query an Active Directory domain for directory information, including user enumeration. By default, AD permits anonymous LDAP binds to retrieve attributes like sAMAccountName, userPrincipalName, and group memberships, making it a standard technique for enumerating users without credentials.

Answer

SNMP with public community string

Answer

SMB null session

Answer

SMTP VRFY