CEH Vulnerability Analysis and System Hacking — 15 Questions

Question 1

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Craft a request with a local file inclusion parameter pointing to /etc/passwd. This approach uses a local file inclusion (LFI) parameter to safely test for file inclusion vulnerabilities without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include local files. While this directly confirms LFI, a successful LFI often indicates underlying input validation flaws that could also lead to RFI, making it a common and non-destructive first step to assess for file inclusion vulnerabilities in general, including the potential for RFI.

Answer

Use SQLMap to test for SQL injection

Answer

Scan the server with Nikto to detect known RFI signatures

Answer

Attempt to include a remote URL containing a web shell

Question 2

Which TWO of the following are valid techniques for password cracking?

Accepted Answer

Brute-force attack. A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. A rainbow table attack is also a valid password cracking technique that uses pre-computed hashes to reverse cryptographic hash functions, often for passwords. Both directly aim to discover the plaintext password.

Answer

Phishing

Answer

Man-in-the-middle attack

Answer

Keylogging

Question 3

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Accepted Answer

Apache Tomcat 8.5.5. Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.

Answer

MAC Address 00:1A:2B:3C:4D:5E

Answer

Apache httpd 2.4.18

Answer

OpenSSH 7.2p2

Question 4

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Accepted Answer

MySQL (3306) - exploit CVE-2016-6662. The explanation incorrectly states that CVE-2016-6662 is a 'critical remote code execution vulnerability... without requiring authentication' for initial access. CVE-2016-6662 is a local privilege escalation vulnerability in MySQL/MariaDB's mysqld_safe script, requiring local file write access to exploit, not remote initial access. Therefore, it does not justify option D as the 'highest chance of success' for initial remote access. The question also cannot be properly evaluated without the 'exhibit' mentioned in the stem, which would provide crucial context about the services and their versions.

Answer

HTTP (80) - exploit Apache vulnerability

Answer

SSH (22) - brute force user credentials

Answer

Proxy (8080) - exploit Squid vulnerability

Question 5

A security auditor reviews password hashes for three users: admin uses SHA-512 (hash prefix $6$...), root uses SHA-512 (hash prefix $6$...), and user uses MD5 (hash prefix $1$...). Which user has the weakest password hash?

Accepted Answer

user. The user hash prefix $1$ indicates MD5, which is cryptographically broken and much faster to attack than SHA-512 ($6$). The admin and root hashes use SHA-512, which is significantly stronger. Therefore, user has the weakest password hash.

Answer

admin

Answer

root

Answer

All are equally strong

Question 6

An attacker wants to exploit a known vulnerability. Which service is most likely vulnerable to CVE-2019-0215?

Accepted Answer

Apache httpd 2.4.18. CVE-2019-0215 affects Apache HTTP Server versions 2.4.17 to 2.4.38. Apache HTTP Server 2.4.18 is within the vulnerable range.

Answer

OpenSSH 7.2p2

Answer

Linux kernel

Answer

Squid http proxy 3.5.12

Question 7

Refer to the exhibit. An auditor discovers that 'SupportUser' is a member of the Administrators group. What is the most likely security concern?

Accepted Answer

SupportUser should be a standard user, not an administrator, to minimize attack surface.. The most significant security concern when a 'SupportUser' is a member of the 'Administrators' group is the violation of the principle of least privilege. This principle states that users should only be granted the minimum permissions necessary to perform their job functions. A support user typically does not require full administrative privileges. Granting excessive privileges significantly increases the attack surface; if the 'SupportUser' account is compromised, an attacker would gain administrative control, leading to a much greater potential impact than if the account had only standard user privileges. Options B, C, and D describe other potential issues, but they are either not directly inferable from the given information (C), or are operational/administrative issues rather than the primary security concern related to excessive privileges (B, D).

Answer

The group membership is not replicated to domain controllers.

Answer

The account has a weak password.

Answer

The account name is misspelled.

Question 8

A security analyst observes the following SSH logs:

sshd[1234]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1235]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1236]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1237]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1238]: Failed password for root from 203.0.113.7 port 22 ssh2

Which attack technique is being used?

Accepted Answer

Brute force attack against the root account. The logs show repeated failed SSH authentication attempts against the same privileged account (root) from a single source. This pattern indicates a brute force attack against the root account, where an attacker systematically tries many passwords for one target account.

Answer

Denial of Service (DoS) attack

Answer

Dictionary attack on SSH service

Answer

Port scanning of the SSH server

Question 9

During a vulnerability assessment, a tester reviews a web.xml file that specifies a session timeout of 60 minutes. Which of the following is a potential security weakness?

Accepted Answer

The session timeout is set to 60 minutes, which might be too long.. Assuming the web.xml exhibit shows a session timeout of 60 minutes, this is a potential security weakness. A long session timeout increases the window of opportunity for session hijacking or fixation attacks if a user leaves their session unattended. While an outdated web-app version (Option A) can indicate broader security risks (e.g., unpatched server, lack of modern security features), the version number itself is an indicator rather than a direct, exploitable vulnerability. A long session timeout (Option C) is a more direct and immediately exploitable configuration vulnerability. Options B and D are not security weaknesses; configuring error pages is a best practice to prevent information disclosure, and exposing servlet class names is fundamental to how Java web applications function and not inherently a vulnerability.

Answer

The web-app version is 2.4, which is outdated.

Answer

The error page location is configurable.

Answer

The servlet class name is exposed.

Question 10

Refer to the exhibit. An analyst performs reconnaissance on a Windows 10 system. Which of the following findings is most critical from a security perspective?

Accepted Answer

The registry key LocalAccountTokenFilterPolicy is set to 1, which may allow remote UAC bypass.. The LocalAccountTokenFilterPolicy registry key, when set to 1, disables remote User Account Control (UAC) filtering for local accounts. This means that local administrator accounts connecting remotely (e.g., via network shares or Windows Management Instrumentation - WMI) will receive a full administrative token, bypassing the UAC elevation prompt. This is a significant security misconfiguration that allows for a remote UAC bypass, making it easier for attackers to perform lateral movement or privilege escalation if they compromise local administrator credentials. Options A and C are standard reconnaissance findings, not critical vulnerabilities themselves. Option B indicates a potential vulnerability (missing patches), which can be critical, but D describes a definite, active misconfiguration with a direct and immediate security impact, making it the most critical finding among the choices.

Answer

The system is running Windows 10 Pro version 19041.

Answer

The last installed hotfix is from April 2021, indicating the system may be missing newer patches.

Answer

The system type is x64-based, but no additional security concerns are noted.

Question 11

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.

Answer

Nikto

Answer

Hydra

Answer

Nmap

Question 12

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Accepted Answer

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell. When a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

Answer

Exploit a kernel vulnerability using a local exploit

Answer

Use the find command with -exec to execute a shell

Answer

Check for world-writable scripts in cron jobs

Question 13

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Accepted Answer

Update Log4j to version 2.17.1 or later. CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.

Answer

Remove the JndiLookup class from the Log4j jar

Answer

Disable JDBC appender in Log4j configuration

Answer

Block outbound traffic from the server to the internet

Question 14

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Accepted Answer

Session hijacking via cross-site scripting (XSS). The absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Clickjacking

Question 15

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage