CEH Vulnerability Analysis and System Hacking — Timed 10 Questions

Question 1

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

10 minute time limit — choose an answer to begin.

Accepted Answer

Craft a request with a local file inclusion parameter pointing to /etc/passwd. This approach uses a local file inclusion (LFI) parameter to safely test for file inclusion vulnerabilities without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include local files. While this directly confirms LFI, a successful LFI often indicates underlying input validation flaws that could also lead to RFI, making it a common and non-destructive first step to assess for file inclusion vulnerabilities in general, including the potential for RFI.

Answer

Use SQLMap to test for SQL injection

Answer

Scan the server with Nikto to detect known RFI signatures

Answer

Attempt to include a remote URL containing a web shell

Question 2

Which TWO of the following are valid techniques for password cracking?

Accepted Answer

Brute-force attack. A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. A rainbow table attack is also a valid password cracking technique that uses pre-computed hashes to reverse cryptographic hash functions, often for passwords. Both directly aim to discover the plaintext password.

Answer

Phishing

Answer

Man-in-the-middle attack

Answer

Keylogging

Question 3

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Accepted Answer

Apache Tomcat 8.5.5. Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.

Answer

MAC Address 00:1A:2B:3C:4D:5E

Answer

Apache httpd 2.4.18

Answer

OpenSSH 7.2p2

Question 4

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Accepted Answer

MySQL (3306) - exploit CVE-2016-6662. The explanation incorrectly states that CVE-2016-6662 is a 'critical remote code execution vulnerability... without requiring authentication' for initial access. CVE-2016-6662 is a local privilege escalation vulnerability in MySQL/MariaDB's mysqld_safe script, requiring local file write access to exploit, not remote initial access. Therefore, it does not justify option D as the 'highest chance of success' for initial remote access. The question also cannot be properly evaluated without the 'exhibit' mentioned in the stem, which would provide crucial context about the services and their versions.

Answer

HTTP (80) - exploit Apache vulnerability

Answer

SSH (22) - brute force user credentials

Answer

Proxy (8080) - exploit Squid vulnerability

Question 5

A security auditor reviews password hashes for three users: admin uses SHA-512 (hash prefix $6$...), root uses SHA-512 (hash prefix $6$...), and user uses MD5 (hash prefix $1$...). Which user has the weakest password hash?

Accepted Answer

user. The user hash prefix $1$ indicates MD5, which is cryptographically broken and much faster to attack than SHA-512 ($6$). The admin and root hashes use SHA-512, which is significantly stronger. Therefore, user has the weakest password hash.

Answer

admin

Answer

root

Answer

All are equally strong

Question 6

An attacker wants to exploit a known vulnerability. Which service is most likely vulnerable to CVE-2019-0215?

Accepted Answer

Apache httpd 2.4.18. CVE-2019-0215 affects Apache HTTP Server versions 2.4.17 to 2.4.38. Apache HTTP Server 2.4.18 is within the vulnerable range.

Answer

OpenSSH 7.2p2

Answer

Linux kernel

Answer

Squid http proxy 3.5.12

Question 7

Refer to the exhibit. An auditor discovers that 'SupportUser' is a member of the Administrators group. What is the most likely security concern?

Accepted Answer

SupportUser should be a standard user, not an administrator, to minimize attack surface.. The most significant security concern when a 'SupportUser' is a member of the 'Administrators' group is the violation of the principle of least privilege. This principle states that users should only be granted the minimum permissions necessary to perform their job functions. A support user typically does not require full administrative privileges. Granting excessive privileges significantly increases the attack surface; if the 'SupportUser' account is compromised, an attacker would gain administrative control, leading to a much greater potential impact than if the account had only standard user privileges. Options B, C, and D describe other potential issues, but they are either not directly inferable from the given information (C), or are operational/administrative issues rather than the primary security concern related to excessive privileges (B, D).

Answer

The group membership is not replicated to domain controllers.

Answer

The account has a weak password.

Answer

The account name is misspelled.

Question 8

A security analyst observes the following SSH logs:

sshd[1234]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1235]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1236]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1237]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1238]: Failed password for root from 203.0.113.7 port 22 ssh2

Which attack technique is being used?

Accepted Answer

Brute force attack against the root account. The logs show repeated failed SSH authentication attempts against the same privileged account (root) from a single source. This pattern indicates a brute force attack against the root account, where an attacker systematically tries many passwords for one target account.

Answer

Denial of Service (DoS) attack

Answer

Dictionary attack on SSH service

Answer

Port scanning of the SSH server

Question 9

During a vulnerability assessment, a tester reviews a web.xml file that specifies a session timeout of 60 minutes. Which of the following is a potential security weakness?

Accepted Answer

The session timeout is set to 60 minutes, which might be too long.. Assuming the web.xml exhibit shows a session timeout of 60 minutes, this is a potential security weakness. A long session timeout increases the window of opportunity for session hijacking or fixation attacks if a user leaves their session unattended. While an outdated web-app version (Option A) can indicate broader security risks (e.g., unpatched server, lack of modern security features), the version number itself is an indicator rather than a direct, exploitable vulnerability. A long session timeout (Option C) is a more direct and immediately exploitable configuration vulnerability. Options B and D are not security weaknesses; configuring error pages is a best practice to prevent information disclosure, and exposing servlet class names is fundamental to how Java web applications function and not inherently a vulnerability.

Answer

The web-app version is 2.4, which is outdated.

Answer

The error page location is configurable.

Answer

The servlet class name is exposed.

Question 10

Refer to the exhibit. An analyst performs reconnaissance on a Windows 10 system. Which of the following findings is most critical from a security perspective?

Accepted Answer

The registry key LocalAccountTokenFilterPolicy is set to 1, which may allow remote UAC bypass.. The LocalAccountTokenFilterPolicy registry key, when set to 1, disables remote User Account Control (UAC) filtering for local accounts. This means that local administrator accounts connecting remotely (e.g., via network shares or Windows Management Instrumentation - WMI) will receive a full administrative token, bypassing the UAC elevation prompt. This is a significant security misconfiguration that allows for a remote UAC bypass, making it easier for attackers to perform lateral movement or privilege escalation if they compromise local administrator credentials. Options A and C are standard reconnaissance findings, not critical vulnerabilities themselves. Option B indicates a potential vulnerability (missing patches), which can be critical, but D describes a definite, active misconfiguration with a direct and immediate security impact, making it the most critical finding among the choices.

Answer

The system is running Windows 10 Pro version 19041.

Answer

The last installed hotfix is from April 2021, indicating the system may be missing newer patches.

Answer

The system type is x64-based, but no additional security concerns are noted.