CEH Vulnerability Analysis and System Hacking — 20 Questions

Question 1

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.

Answer

Nikto

Answer

Hydra

Answer

Nmap

Question 2

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Accepted Answer

Craft a request with a local file inclusion parameter pointing to /etc/passwd. Option A is correct because it uses a local file inclusion (LFI) parameter to test for file inclusion without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include files, which is a direct indicator of an RFI vulnerability if the server returns the file contents. This approach is safe and non-destructive, as it only reads a standard system file.

Answer

Use SQLMap to test for SQL injection

Answer

Scan the server with Nikto to detect known RFI signatures

Answer

Attempt to include a remote URL containing a web shell

Question 3

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Accepted Answer

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell. Option B is correct because when a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

Answer

Exploit a kernel vulnerability using a local exploit

Answer

Use the find command with -exec to execute a shell

Answer

Check for world-writable scripts in cron jobs

Question 4

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Accepted Answer

Update Log4j to version 2.17.1 or later. Option A is correct because CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.

Answer

Remove the JndiLookup class from the Log4j jar

Answer

Disable JDBC appender in Log4j configuration

Answer

Block outbound traffic from the server to the internet

Question 5

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Accepted Answer

Session hijacking via cross-site scripting (XSS). Option C is correct because the absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Clickjacking

Question 6

Which TWO of the following are valid techniques for password cracking?

Accepted Answer

Brute-force attack. A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. It is computationally intensive but guaranteed to succeed given enough time, making it a fundamental method in password auditing and recovery.

Answer

Phishing

Answer

Man-in-the-middle attack

Answer

Keylogging

Question 7

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage

Question 8

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Accepted Answer

Apache Tomcat 8.5.5. Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.

Answer

MAC Address 00:1A:2B:3C:4D:5E

Answer

Apache httpd 2.4.18

Answer

OpenSSH 7.2p2

Question 9

You are a penetration tester hired by a medium-sized financial company. The company has a network consisting of 50 Windows workstations (Windows 10 Pro) and 5 Windows Server 2019 servers (domain controller, file server, web server, database server, and mail server). The network is segmented into three VLANs: User VLAN (192.168.1.0/24), Server VLAN (192.168.2.0/24), and DMZ (192.168.3.0/24). The web server is in the DMZ and hosts a public-facing e-commerce application built on ASP.NET with a SQL Server backend. The database server is in the Server VLAN and is not directly accessible from the internet. You are given a standard user account on a workstation in the User VLAN. After initial reconnaissance, you discover that the web server is running an outdated version of IIS (7.5) and is vulnerable to a known privilege escalation vulnerability (CVE-2020-0613) that allows local privilege escalation if an attacker has already gained initial access. You also find that the web application has a SQL injection vulnerability in the login page. You successfully exploit the SQL injection to extract the password hash of the web application's service account, which is 'web_svc'. You crack the hash offline and obtain the plaintext password. The 'web_svc' account has local administrative privileges on the web server. Using these credentials, you authenticate to the web server via RDP. From there, you want to pivot to the database server to extract credit card information stored in the database. The database server only allows connections from the web server on port 1433 (SQL Server). Using the 'web_svc' account, you are able to connect to the database server using SQL Server Management Studio. However, you find that the 'web_svc' account has only 'public' and 'guest' database roles, which do not allow reading any sensitive tables. You need to escalate privileges on the database server. What is the most effective next step?

Accepted Answer

Exploit the privilege escalation vulnerability on the web server to gain SYSTEM access, then dump the SQL Server service account credentials (e.g., from the SQL Server error logs or registry) and use them to log into the database server with sysadmin privileges. Option B is correct because the web_svc account lacks sufficient database privileges, but by exploiting the privilege escalation vulnerability (CVE-2020-0613) on the web server to gain SYSTEM access, you can extract the SQL Server service account credentials (e.g., from SQL Server error logs or registry). The SQL Server service account typically runs with sysadmin privileges, allowing you to connect to the database server with full administrative rights and access the credit card data.

Answer

Use the web_svc account to create a new SQL Server login with sysadmin privileges via the SQL Server Management Studio

Answer

Perform a brute-force attack against the 'sa' account on the database server using a wordlist

Answer

Try to use the web_svc account to directly query the credit card table using a SQL injection payload on the web application

Question 10

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Accepted Answer

Create a Volume Shadow Copy to access SAM file. On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer

Run the tool as Administrator

Answer

Use reg.exe save to export SAM hive

Answer

Enable SeDebugPrivilege for the current process

Question 11

Which TWO vulnerabilities are associated with buffer overflow attacks?

Accepted Answer

Arbitrary code execution. Buffer overflow attacks occur when a program writes more data to a buffer than it can hold, overwriting adjacent memory. This can corrupt the stack and allow an attacker to inject and execute arbitrary code (option A) by overwriting the return address or function pointers. Stack smashing (option B) is a specific technique that deliberately corrupts the call stack to hijack control flow, often as part of a buffer overflow exploit.

Answer

Authentication bypass via SQL injection

Answer

Cross-site scripting (XSS)

Answer

Race condition

Question 12

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Accepted Answer

MySQL (3306) - exploit CVE-2016-6662. MySQL (3306) is the correct target because CVE-2016-6662 is a critical remote code execution vulnerability in MySQL that allows an attacker to inject malicious configuration directives via a crafted `my.cnf` file, leading to arbitrary code execution with the privileges of the MySQL daemon (typically root). This provides a reliable, high-impact initial access vector without requiring authentication or brute-forcing, making it the highest-chance option among the listed services.

Answer

HTTP (80) - exploit Apache vulnerability

Answer

SSH (22) - brute force user credentials

Answer

Proxy (8080) - exploit Squid vulnerability

Question 13

Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.

Question 14

Match each type of attack to its description.

Question 15

Refer to the exhibit. An analyst runs netstat on a Windows server and observes multiple established connections to port 3389 from internal IPs. Which attack is most likely occurring?

Accepted Answer

RDP brute-force attack. Multiple established RDP connections from different internal IPs suggest a brute-force or password-spraying attack against RDP. The established connections indicate successful authentication attempts.

Answer

SMB relay attack

Answer

DDoS attack

Answer

Man-in-the-middle attack

Question 16

Refer to the exhibit. A security auditor reviews the password hashes. Which user has the weakest password hash?

Accepted Answer

user. The hash prefix $1$ indicates MD5, which is significantly weaker than SHA-512 ($6$). The user 'user' uses MD5.

Answer

admin

Answer

root

Answer

All are equally strong

Question 17

Refer to the exhibit. An attacker wants to exploit a known vulnerability. Which service is most likely vulnerable to CVE-2019-0215?

Accepted Answer

Apache httpd 2.4.18. CVE-2019-0215 affects Apache HTTP Server versions 2.4.17 to 2.4.38. The exhibit shows Apache 2.4.18, which is within the vulnerable range.

Answer

OpenSSH 7.2p2

Answer

Linux kernel

Answer

Squid http proxy 3.5.12

Question 18

Refer to the exhibit. A penetration tester runs hashcat to crack NTLM hashes. Which hash mode (-m) would be correct for NTLM?

Accepted Answer

1000. NTLM hash mode is 1000. The exhibit shows -m 1000, which is correct for NTLM.

Answer

1100

Answer

3000

Answer

5500

Question 19

Refer to the exhibit. A security analyst checks for missing patches. Which vulnerability is this system likely exposed to?

Accepted Answer

PrintNightmare (CVE-2021-34527). The system is Windows 10 build 19041 (2004) with patches up to 9/17/2020. EternalBlue (MS17-010) was patched in 2017, so it is likely patched. However, BlueKeep (CVE-2019-0708) affects older systems (Windows 7/2008 R2), not Windows 10. ZeroLogon (CVE-2020-1472) was patched in August 2020; the system has KB4577586 from 9/8/2020 which includes the fix. PrintNightmare (CVE-2021-34527) was disclosed in 2021, after the patch dates shown, so the system is likely vulnerable to PrintNightmare.

Answer

EternalBlue (MS17-010)

Answer

BlueKeep (CVE-2019-0708)

Answer

ZeroLogon (CVE-2020-1472)