CEH Enumeration and System Hacking Practice Question
An attacker uses 'rpcclient -U '' -N 192.168.1.10' followed by 'enumdomusers' and 'enumdomgroups'. What type of enumeration is being performed, and which protocol does it rely on?
⚠ Common exam trap
Many candidates confuse the underlying protocol (SMB/RPC on port 445) with the older NetBIOS session service (port 139), or mistakenly associate user/group enumeration solely with LDAP, not realizing that `rpcclient` uses MS-RPC over SMB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SMB/RPC enumeration over port 445
The `rpcclient` tool with the `-U '' -N` flags performs a null session connection to a Windows system over the SMB protocol. The subsequent `enumdomusers` and `enumdomgroups` commands enumerate domain users and groups via MS-RPC (Remote Procedure Call) functions, which are transported over SMB. By default, modern Windows systems use SMB over port 445, making option B the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LDAP enumeration over port 389
Why it's wrong here
LDAP (Lightweight Directory Access Protocol) enumeration targets directory services, typically operating on TCP port 389 for cleartext or 636 for LDAPS. Tools such as `ldapsearch` (for Unix-like systems) or `adfind` (for Windows Active Directory) are specifically designed to query LDAP directories for information like user accounts, groups, and organizational units. The `rpcclient` utility, however, is not an LDAP client and cannot directly interact with LDAP services for enumeration.
- ✓
SMB/RPC enumeration over port 445
Why this is correct
The `rpcclient` utility is a powerful tool for interacting with Microsoft Remote Procedure Call (MS-RPC) services, which are commonly transported over Server Message Block (SMB) on TCP port 445. The command `rpcclient -U n 192.168.1.10` attempts to establish a null session (unauthenticated connection) to the target, allowing an attacker to enumerate various system details like user lists, share information, and group memberships by making RPC calls. This makes it a primary method for SMB/RPC enumeration.
- ✗
NetBIOS enumeration over port 139
Why it's wrong here
NetBIOS enumeration primarily involves querying NetBIOS Name Service (NBNS) on UDP port 137 or NetBIOS Session Service on TCP port 139 to discover hostnames, workgroup/domain names, and MAC addresses. Tools like `nbtstat` or `nmblookup` are specifically designed for this purpose, providing NetBIOS-specific information. While SMB can operate over NetBIOS, `rpcclient` directly leverages MS-RPC over raw SMB on port 445, rather than the older NetBIOS session layer, for its enumeration capabilities.
- ✗
SNMP enumeration over port 161
Why it's wrong here
SNMP (Simple Network Management Protocol) enumeration targets network devices to gather configuration and status information, typically communicating over UDP port 161. Specialized tools like `snmpwalk` or `snmpget` are used to query Management Information Bases (MIBs) for details such as system uptime, network interfaces, and running processes. The `rpcclient` utility is designed for Microsoft RPC interactions and lacks the necessary protocol support to perform SNMP-based enumeration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.