CEH Enumeration and System Hacking Practice Question
A penetration tester captures the following output from a command: 'smb: \> ls \\192.168.1.20\C$'. The tester is able to list the contents of the C$ share without providing credentials. Which of the following is the MOST likely reason for this access?
⚠ Common exam trap
A common mix-up: candidates confuse null session access with pass-the-hash or weak permissions, but the key clue is the absence of any credential usage in the command, which directly points to the null session vulnerability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The target has a null session vulnerability that allows access to admin shares
The output shows the tester successfully listing the C$ share (a default administrative share) without providing credentials. This is a classic indicator of a null session vulnerability, where Windows allows unauthenticated access to IPC$ and, in some configurations, admin shares via SMB. The tester is leveraging the default null session to enumerate or access these shares, which is a well-known weakness in older Windows systems or misconfigured Samba servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The C$ share is intentionally shared with Everyone
Why it's wrong here
The C$ share is an administrative share automatically created by Windows for remote management of the operating system. By design, these shares have highly restricted default permissions, typically allowing access only to members of the local Administrators group. Sharing C$ with the 'Everyone' group would represent a severe and highly unusual misconfiguration, which is not the default behavior for administrative shares and is generally avoided due to the significant security risk.
- ✗
The target is running a Samba server with weak permissions
Why it's wrong here
The C$ share is a specific administrative share convention used exclusively by Microsoft Windows operating systems to provide remote access to the root of a drive. Samba, an open-source re-implementation of the SMB/CIFS protocol, does not inherently create or expose shares named C$. While Samba can be configured to share directories, it would not present them as a Windows-specific administrative share like C$, making this option incompatible with a Samba server.
- ✓
The target has a null session vulnerability that allows access to admin shares
Why this is correct
A null session is an unauthenticated connection to a Windows IPC$ share, primarily intended for anonymous enumeration of system information. In older Windows versions (e.g., NT, 2000, XP) or systems with specific misconfigurations, these null sessions could be exploited to gain unauthorized access to administrative shares like C$ without requiring any user credentials. This vulnerability directly explains how a penetration tester could access C$ in the absence of explicit authentication, aligning with the scenario.
- ✗
The tester is using a pass-the-hash attack
Why it's wrong here
Pass-the-hash (PtH) is an attack technique where an attacker authenticates to a remote system using a stolen NTLM or LanMan hash of a user's password, rather than the plaintext password itself. This method fundamentally requires the possession of a valid, compromised password hash to succeed. The scenario explicitly states the tester is accessing the share 'without credentials,' which directly contradicts the prerequisite of having a user's hash for a PtH attack.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.