CEH Enumeration and System Hacking Practice Question
A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?
⚠ Common exam trap
The trap here is that candidates often jump to password cracking (Option B) or port scanning (Option C) because they assume administrative shares require credentials, but the question tests the understanding that null sessions allow further enumeration without authentication, making `enum4linux` the correct next step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use enum4linux -a 192.168.1.10 to enumerate users and policies
The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use enum4linux -a 192.168.1.10 to enumerate users and policies
Why this is correct
After discovering open SMB shares, the next logical step in a penetration test is to enumerate specific details about the SMB service. enum4linux is a specialized tool designed for this purpose, leveraging various SMB/Samba enumeration techniques. The -a flag instructs enum4linux to perform all available enumeration options, including listing users, groups, shares, and security policies, which provides critical information for subsequent exploitation attempts. This comprehensive enumeration helps identify valid usernames, potential weak policies, and further attack vectors.
- ✗
Attempt to crack the administrator password using a dictionary attack
Why it's wrong here
Attempting to crack the administrator password at this stage is premature and inefficient. Without prior enumeration of valid usernames, password policies, or potential weak points, a dictionary attack against a generic 'administrator' account is often a low-probability endeavor. Comprehensive enumeration, such as identifying existing user accounts or discovering vulnerable services, should precede brute-force or dictionary attacks to increase the likelihood of success and focus efforts.
- ✗
Perform a port scan to check for open ports
Why it's wrong here
Performing another general port scan at this point is redundant and deviates from a focused enumeration strategy. The discovery of SMB shares implies that an initial port scan has already identified port 445 (or 139) as open, indicating the presence of the SMB service. The current objective should be to deeply enumerate the already identified SMB service for specific vulnerabilities, rather than re-scanning for other services that may or may not be present.
- ✗
Run snmpwalk to retrieve SNMP community strings
Why it's wrong here
Running snmpwalk to retrieve SNMP community strings is irrelevant to the current context of enumerating SMB shares. SNMP (Simple Network Management Protocol) operates on different ports (typically UDP 161/162) and is used for network device management, entirely separate from the Server Message Block (SMB) protocol. While SNMP enumeration can be valuable in other scenarios, it does not provide any information pertinent to exploiting or further understanding the identified SMB service.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.