CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Token impersonation

  Why it's wrong here

  Token impersonation is a privilege escalation technique specific to Microsoft Windows operating systems. It involves an attacker stealing or duplicating an access token from a privileged process or user session to execute commands with elevated permissions. This method relies on the Windows security model's use of access tokens for authentication and authorization, a mechanism fundamentally different from how Linux handles user and process privileges. Therefore, it is irrelevant in a Linux server compromise scenario.

• ✗

  DLL injection

  Why it's wrong here

  DLL injection is a code injection technique predominantly used on Windows systems, where a malicious Dynamic Link Library (DLL) is forced to load into the address space of another running process. This allows the attacker to execute arbitrary code within the context and privileges of the target process. Linux systems utilize Shared Objects (.so files) instead of DLLs, and while similar code injection methods exist (e.g., LD_PRELOAD), the specific term "DLL injection" refers to a Windows-centric attack vector, making it inapplicable to a Linux server compromise.

• ✓

  Rootkit installation

  Why this is correct

  Rootkit installation is a highly effective post-exploitation technique for maintaining persistent access and evading detection on a compromised Linux server. Rootkits often replace legitimate system binaries (like ls, ps, netstat) with malicious versions that filter out evidence of the attacker's activities, such as hidden processes or network connections. Concurrently, log cleaners are used to erase entries from system logs (e.g., /var/log/auth.log, /var/log/syslog) that would reveal the initial compromise or subsequent actions, ensuring the attacker's presence remains concealed.

• ✗

  Steganography

  Why it's wrong here

  Steganography is the art and science of hiding information within other non-secret data or files, such that the existence of the hidden information is not apparent. For example, data might be embedded within an image, audio, or video file. While it can be used for covert communication or data exfiltration, steganography itself does not involve replacing system binaries or actively cleaning logs to hide an attacker's presence on a compromised server, which are actions characteristic of maintaining persistence and evading detection.

Go deeper

Related to this question