Courseiva

CCNA Enumeration and System Hacking Questions

75 of 164 questions · Page 1/3 · Enumeration and System Hacking · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

During an SMTP enumeration, a penetration tester connects to the mail server on port 25 and issues the commands 'VRFY root', 'EXPN admin', and 'RCPT TO:unknown@domain.com'. The server responds with '252' for VRFY, '250' for EXPN, and '550' for RCPT TO. What does this indicate?

A.The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist
B.The server has open relay enabled
C.The server is vulnerable to SMTP injection
D.The server is not running SMTP
AnswerA

This option correctly interprets the standard SMTP response codes observed during enumeration. A VRFY command returning '252' indicates that the server recognizes the user (e.g., 'root') but cannot verify their status, often implying the account exists but is disabled or restricted. An EXPN command receiving a '250' response confirms the existence of a mailing list or alias (e.g., 'admin') and typically provides its expansion. Conversely, a RCPT TO command resulting in a '550' error explicitly signifies that the specified recipient (e.g., 'unknown@domain.com') does not exist on the server, providing clear non-existence confirmation.

Why this answer

The SMTP response code 252 for VRFY root typically indicates that the user exists but is disabled or cannot receive mail at this time (the server knows the user but restricts verification). A 250 response for EXPN admin confirms that the admin mailing list exists. The 550 response for RCPT TO:unknown@domain.com definitively indicates that the recipient does not exist on the server.

Therefore, option A correctly interprets these responses: root exists but is disabled, the admin list exists, and the unknown user does not exist.

Exam trap

EC-CEH often tests the misinterpretation of SMTP response codes, where candidates confuse 252 (cannot verify but not denying existence) with a definitive 'user exists' or 'user disabled' status, or assume any non-250 response indicates a server misconfiguration like open relay.

How to eliminate wrong answers

Option B is wrong because open relay is tested by sending a message to an external domain via the server, not by VRFY, EXPN, or RCPT TO responses; a 550 for an unknown local user does not indicate relay behavior. Option C is wrong because SMTP injection involves injecting malicious commands or headers into SMTP transactions, which is not indicated by standard response codes 252, 250, and 550. Option D is wrong because the server is clearly running SMTP, as it responds to SMTP commands on port 25 with valid SMTP status codes.

Practice this question →
2
MCQmedium

During a password cracking session, a pentester uses a wordlist combined with rules to generate variations of each word. This approach is called a hybrid attack. Which tool, when used with a rule file, can perform such an attack?

A.RainbowCrack
B.Ophcrack
C.Hydra
D.Hashcat
AnswerD

Hashcat is widely recognized as the world's fastest and most versatile password recovery tool, offering extensive support for various attack modes, including highly effective hybrid and rule-based attacks. Its `-a 6` (hybrid wordlist + mask) and `-a 7` (hybrid mask + wordlist) modes directly address hybrid cracking scenarios, while the `-r` option enables sophisticated rule-based modifications to dictionary words. This comprehensive capability makes Hashcat the ideal choice for dynamic, advanced password cracking sessions.

Why this answer

Hashcat is a powerful password recovery tool that supports hybrid attacks by combining a wordlist with rule-based mutations. When used with a rule file (e.g., best64.rule), Hashcat applies transformations like prefixing, suffixing, or character substitution to each word, enabling efficient generation of password variations. This directly matches the hybrid attack described in the question.

Exam trap

The trap here is that candidates confuse online brute-forcing tools like Hydra with offline hash-cracking tools like Hashcat, or mistakenly think rainbow-table tools (RainbowCrack, Ophcrack) can perform rule-based wordlist mutations.

How to eliminate wrong answers

Option A is wrong because RainbowCrack uses precomputed rainbow tables for time-memory trade-off attacks, not wordlist-based rule generation. Option B is wrong because Ophcrack is a Windows password cracker that relies on rainbow tables for LM/NTLM hashes, not hybrid wordlist+rule attacks. Option C is wrong because Hydra is a network authentication brute-forcing tool (e.g., SSH, FTP, HTTP), not a password hash cracker that applies rule-based wordlist mutations.

Practice this question →
3
MCQmedium

After successfully exploiting a system, an attacker uses the command 'wevtutil cl system' on a Windows target. What is the MOST likely purpose of this command?

A.To export event logs to a file
B.To disable Windows event logging
C.To clear the system event log
D.To create a new event log entry
AnswerC

The `wevtutil cl` command is the correct and primary method for clearing the contents of a designated Windows event log from the command line. When executed with a log name, such as `wevtutil cl System`, it effectively purges all recorded events from that specific log. This action is a common anti-forensics technique used by attackers to remove evidence of their activities and hinder incident response efforts.

Why this answer

The command 'wevtutil cl system' is used to clear the System event log on a Windows system. After successfully exploiting a target, an attacker would use this command to erase traces of their activities, such as log entries generated by their tools or actions, thereby hindering forensic analysis. The 'cl' parameter stands for 'clear log', and 'system' specifies the System log.

Exam trap

The trap here is that candidates may confuse 'wevtutil cl' with exporting or disabling logs, but the 'cl' parameter specifically means 'clear', and the command is a common post-exploitation anti-forensics technique tested in CEH.

How to eliminate wrong answers

Option A is wrong because 'wevtutil cl system' clears the log, not exports it; exporting logs would use 'wevtutil epl' or 'wevtutil export-log'. Option B is wrong because disabling Windows event logging would require stopping the Event Log service (e.g., 'net stop EventLog') or modifying registry settings, not clearing a log. Option D is wrong because creating a new event log entry is done with 'EventCreate' or 'wevtutil' with the 'epl' parameter, not the 'cl' parameter.

Practice this question →
4
MCQmedium

A penetration tester wants to enumerate user accounts on a Linux system running SMTP service. Which commands are commonly used for this purpose?

A.USER, PASS, QUIT
B.VRFY, EXPN, RCPT TO
C.AUTH LOGIN, STARTTLS, EHLO
D.HELO, MAIL FROM, DATA
AnswerB

The VRFY (Verify) and EXPN (Expand) commands are specifically designed to query an SMTP server about the existence of a user or the members of a mailing list, respectively, often revealing valid account names. Additionally, the RCPT TO (Recipient To) command, while primarily for specifying a mail recipient, can be leveraged for enumeration by observing the server's response: a '250 OK' or similar success code indicates a valid user, whereas a '550 No such user' or '551 User not local' signifies an invalid one. These three commands collectively provide robust methods for identifying valid user accounts on an SMTP server.

Why this answer

The VRFY command verifies whether a user mailbox exists on the SMTP server, EXPN expands a mailing list or alias to reveal individual member addresses, and RCPT TO specifies the recipient for a mail message and can be used to validate addresses during the SMTP conversation. These three commands are the standard SMTP enumeration techniques for discovering valid user accounts on a Linux system running an SMTP service.

Exam trap

The trap here is that candidates often confuse SMTP enumeration commands (VRFY, EXPN, RCPT TO) with SMTP session commands (HELO, MAIL FROM, DATA) or with authentication commands (AUTH LOGIN, STARTTLS), leading them to select options that are valid SMTP commands but not designed for user enumeration.

How to eliminate wrong answers

Option A is wrong because USER, PASS, and QUIT are POP3 commands used for mailbox access and authentication, not for SMTP user enumeration. Option C is wrong because AUTH LOGIN, STARTTLS, and EHLO are SMTP commands used for authentication negotiation and secure connection initiation, not for enumerating user accounts. Option D is wrong because HELO, MAIL FROM, and DATA are SMTP commands used to initiate a session, specify the sender, and begin message content transfer, respectively; they do not directly reveal user account existence.

Practice this question →
5
Multi-Selectmedium

Which TWO of the following are examples of privilege escalation on Linux? (Select 2)

Select 2 answers
A.Pass-the-Hash
B.Token impersonation
C.SUID bit abuse
D.Exploiting a local vulnerability in a setuid binary
E.DLL hijacking
AnswersC, D

SUID (Set User ID) bit abuse is a common Unix/Linux privilege escalation method. When the SUID bit is set on an executable file, it runs with the permissions of the file owner, rather than the user executing it. If a program owned by root has the SUID bit set and can be manipulated (e.g., through arguments or environment variables) to execute arbitrary commands, a low-privileged user can leverage this to execute commands as root, thereby escalating privileges.

Why this answer

SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.

Exam trap

EC-Council often tests the distinction between Windows and Linux privilege escalation techniques, and the trap here is that candidates confuse cross-platform attacks like token impersonation or DLL hijacking as applicable to Linux, when they are strictly Windows-based.

Practice this question →
6
Multi-Selecthard

A penetration tester obtains password hashes from a Windows system. Which TWO methods would be most efficient for cracking NTLM hashes offline? (Choose two.)

Select 2 answers
A.Using RainbowCrack with precomputed rainbow tables for NTLM
B.Performing an online brute-force against the SAM database
C.Using Ophcrack with rainbow tables for NTLM
D.Using Hashcat with a brute-force attack on GPU
E.Using John the Ripper with a dictionary and rules
AnswersD, E

Hashcat leverages GPU for high-speed cracking of NTLM hashes.

Why this answer

Hashcat, when used with a GPU, can perform massively parallel brute-force attacks against NTLM hashes, achieving billions of hash calculations per second. This makes it one of the most efficient tools for offline password cracking of NTLM hashes, especially when the password is not in a dictionary.

Exam trap

EC-Council often tests the distinction between tools optimized for LM vs. NTLM hashes, and candidates mistakenly choose Ophcrack (option C) because they confuse its LM rainbow table capability with NTLM support.

Practice this question →
7
MCQhard

A penetration tester uses `smbclient -L //192.168.1.30 -N` and receives a list of shares including a hidden administrative share (C$) and a user share named "Backup". What is the most immediate security concern?

A.The Backup share may contain sensitive data
B.SMB signing is not enabled
C.Null session enumeration is possible, allowing information gathering
D.The C$ share is a default administrative share
AnswerC

The command `smbclient -L 192.168.1.30 -N` explicitly attempts to perform a null session enumeration, meaning it tries to list shares without providing any credentials. If this command successfully returns a list of shares, it confirms that the target system permits unauthenticated access for information gathering. This vulnerability allows an attacker to discover available network resources, user accounts, and group information, which is crucial for subsequent attack phases.

Why this answer

The `-N` flag in the `smbclient` command suppresses password prompts, enabling a null session connection. The fact that the command successfully lists shares without authentication indicates that null session enumeration is permitted, which is a critical security flaw. This allows an attacker to gather sensitive information (share names, user lists, etc.) without any credentials, often serving as the first step in a targeted attack.

Exam trap

The trap here is that candidates focus on the existence of the C$ administrative share or the Backup share's name, rather than recognizing that the ability to enumerate any shares without authentication (null session) is the most critical and immediate vulnerability.

How to eliminate wrong answers

Option A is wrong because while the Backup share might contain sensitive data, the most immediate security concern is the ability to enumerate shares at all without authentication, not the content of a specific share. Option B is wrong because SMB signing is a separate security feature that prevents man-in-the-middle attacks; its absence is a concern but not directly indicated by the successful null session enumeration shown in the command output. Option D is wrong because the C$ share being a default administrative share is a known fact, but its presence alone is not the immediate security issue—the ability to list it via a null session is the real problem.

Practice this question →
8
MCQeasy

Which tool is specifically designed to perform SNMP enumeration by walking the MIB tree using a known community string?

A.enum4linux
B.SNMPwalk
C.nbtstat
D.smbclient
AnswerB

SNMPwalk is the quintessential utility for performing SNMP enumeration by systematically querying a target device's Management Information Base (MIB) tree. It operates by sending a sequence of SNMP GETNEXT requests, effectively 'walking' through the MIB and retrieving all available object identifiers (OIDs) and their corresponding values. This process allows security professionals to gather extensive system information, network interface details, and running process data from SNMP-enabled devices, making it the correct tool for this specific task.

Why this answer

SNMPwalk is the correct tool because it is specifically designed to perform SNMP enumeration by walking the Management Information Base (MIB) tree using a known community string (e.g., 'public' or 'private'). It sends successive GETNEXT requests to retrieve all OID values from the SNMP agent, effectively dumping the entire MIB tree for reconnaissance.

Exam trap

The trap here is that candidates often confuse SNMPwalk with enum4linux because both are enumeration tools, but enum4linux targets SMB/NetBIOS, not SNMP, and the question specifically requires walking the MIB tree with a community string.

How to eliminate wrong answers

Option A is wrong because enum4linux is a tool for enumerating information from Windows and Samba systems via SMB, RPC, and NetBIOS, not SNMP. Option C is wrong because nbtstat is a Windows command-line tool that displays NetBIOS over TCP/IP statistics and name tables, not SNMP MIB walking. Option D is wrong because smbclient is an FTP-like client for accessing SMB/CIFS shares on Windows systems, not for SNMP enumeration.

Practice this question →
9
MCQmedium

During an internal penetration test, you run 'smbclient -L //192.168.1.100 -N' and get an empty response. Which of the following is the MOST likely reason?

A.The target is not running SMB
B.Null sessions are disabled on the target
C.The target requires NTLM authentication
D.The target is a Linux server
AnswerB

The smbclient -L command, when executed without explicit credentials, attempts to establish an anonymous or "null" session with the target SMB server. Modern Windows operating systems, starting with Windows XP SP2, disable null sessions by default as a security measure. Consequently, if null sessions are disabled, the server will reject this unauthenticated connection attempt, preventing the enumeration of shares and resulting in an empty or access denied response from smbclient.

Why this answer

The `-N` flag in smbclient suppresses password prompts, attempting a null session. An empty response (no error, no output) typically indicates the SMB service is running but null sessions are explicitly disabled, often via the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous` set to 1 or 2. This prevents anonymous enumeration of shares and users, which is a common security hardening measure on Windows systems.

Exam trap

The trap here is that candidates assume an empty response means the service is down or not SMB, but CEH expects you to recognize that a silent empty output from `smbclient -L -N` is a classic indicator of null session restrictions being enabled.

How to eliminate wrong answers

Option A is wrong because if the target were not running SMB, smbclient would return a connection error (e.g., 'Connection refused' or 'NT_STATUS_CONNECTION_REFUSED'), not an empty response. Option C is wrong because NTLM authentication is the default for SMB on Windows; the `-N` flag attempts a null session without credentials, and if NTLM were required but null sessions disabled, the tool would still prompt for credentials or return an access denied error, not an empty response. Option D is wrong because a Linux server running Samba would typically respond to a null session attempt with either a share list or an explicit 'NT_STATUS_ACCESS_DENIED' error, not a completely empty response; the empty response is characteristic of a Windows target with RestrictAnonymous enforced.

Practice this question →
10
MCQeasy

Which type of password cracking attack uses a precomputed table of hash chains to reverse hashes quickly?

A.Rainbow table attack
B.Dictionary attack
C.Brute-force attack
D.Hybrid attack
AnswerA

A rainbow table attack leverages precomputed tables that store chains of hash-to-plaintext reductions. This method significantly reduces the time required to crack passwords by performing a time-memory trade-off, avoiding the need to recompute every possible hash during the attack. Instead of brute-forcing, it looks up the target hash within the table to find the corresponding original password or a chain leading to it.

Why this answer

A rainbow table attack is correct because it uses a precomputed table of hash chains to reverse hashes quickly. Rainbow tables reduce the time needed for cracking by storing chains of hash values that allow for efficient lookup, trading off storage space for computational speed. This technique is specifically designed to reverse cryptographic hash functions like LM, NTLM, or MD5 without performing brute-force or dictionary lookups for each attempt.

Exam trap

The trap here is that candidates confuse rainbow tables with dictionary attacks because both involve precomputed data, but rainbow tables specifically use hash chains with reduction functions to enable efficient reversal, not just a list of plaintext-to-hash mappings.

How to eliminate wrong answers

Option B is wrong because a dictionary attack uses a list of likely passwords (words from a dictionary) and hashes each one for comparison, not a precomputed table of hash chains. Option C is wrong because a brute-force attack systematically tries every possible combination of characters until the correct password is found, which is computationally intensive and does not rely on precomputed tables. Option D is wrong because a hybrid attack combines dictionary words with variations (e.g., appending numbers or symbols) but still hashes each candidate on the fly rather than using precomputed hash chains.

Practice this question →
11
MCQhard

After gaining initial access to a Linux server, an attacker runs `find / -perm -4000 -o -perm -2000 2>/dev/null`. What is the primary objective of this command?

A.Locate world-writable files for data exfiltration
B.List all files owned by the root user
C.Find configuration files containing passwords
D.Identify files with SUID or GUID bits set for privilege escalation
AnswerD

Identifying files with SUID (Set User ID) or GUID (Set Group ID) bits set is a critical step for privilege escalation on Linux systems. When a program with the SUID bit is executed, it runs with the permissions of its owner, typically root, regardless of the user who initiated it. This allows a low-privileged attacker to execute specific binaries with elevated privileges, potentially exploiting vulnerabilities within those programs to gain a root shell or execute arbitrary commands as root.

Why this answer

The command `find / -perm -4000 -o -perm -2000 2>/dev/null` searches the entire filesystem for files with the SUID (setuid, permission 4000) or SGID (setgid, permission 2000) bits set. These special permission bits allow a file to execute with the privileges of its owner (often root) or group, respectively. An attacker's primary objective is to identify such files because they can be exploited to escalate privileges from a low-privileged user to a higher-privileged user (e.g., root) by running a vulnerable SUID/SGID binary.

Exam trap

The trap here is that candidates confuse the permission masks for SUID/SGID (4000/2000) with world-writable (0002) or setuid root ownership, leading them to incorrectly select options about data exfiltration or root-owned files instead of recognizing the command's specific purpose for privilege escalation enumeration.

How to eliminate wrong answers

Option A is wrong because world-writable files are found using `-perm -0002` or `-o -perm -0002`, not the `-4000` (SUID) or `-2000` (SGID) permission masks; this command specifically targets setuid/setgid bits, not write permissions. Option B is wrong because the command does not filter by owner; it finds files based on permission bits, not the `-user root` predicate, so it will list SUID/SGID files owned by any user, not just root. Option C is wrong because configuration files containing passwords are typically found by searching for specific filenames (e.g., `*.conf`, `*.cfg`) or content with `grep`, not by checking for the SUID/SGID permission bits; this command has no string or pattern matching.

Practice this question →
12
MCQeasy

Which tool is specifically designed to enumerate SMB shares and user accounts on a Windows target by leveraging the SMB protocol?

A.Enum4linux
B.Wireshark
C.Nmap
D.Hydra
AnswerA

Enum4linux is a specialized command-line utility explicitly engineered for enumerating information from Windows and Samba hosts. It leverages NetBIOS and SMB protocols to extract details such as user lists, group memberships, share names, operating system versions, and security policies. This tool is invaluable during the reconnaissance phase of a penetration test, providing critical insights into potential attack surfaces.

Why this answer

Enum4linux is a tool specifically designed to enumerate SMB shares and user accounts on Windows targets by leveraging the SMB protocol. It uses the SMB/CIFS protocol to query services like the SAMR (Security Account Manager Remote) and LSARPC (Local Security Authority Remote Procedure Call) interfaces to extract user lists, share listings, and OS information. This makes it the correct choice for targeted SMB enumeration.

Exam trap

The trap here is that candidates may confuse Nmap's SMB enumeration scripts (like smb-enum-shares) with a dedicated tool, but Enum4linux is the specific tool designed for comprehensive SMB share and user enumeration, not just scanning for open ports.

How to eliminate wrong answers

Option B (Wireshark) is wrong because it is a network protocol analyzer that captures and inspects packets, not a tool that actively enumerates SMB shares or user accounts by sending SMB-specific queries. Option C (Nmap) is wrong because while it can scan for open SMB ports (139, 445) and run some SMB scripts via NSE, its primary purpose is port scanning and service discovery, not dedicated enumeration of SMB shares and user accounts. Option D (Hydra) is wrong because it is a password-cracking tool that performs brute-force attacks against authentication services, not an enumeration tool for listing SMB shares or user accounts.

Practice this question →
13
MCQmedium

A penetration tester runs `snmpwalk -c public -v2c 192.168.1.50 1.3.6.1.2.1.1` and receives a list of system descriptions, uptime, and contact information. Which type of information is the tester primarily gathering?

A.SMB share names and permissions
B.System information and version details
C.Network topology and routing tables
D.Active directory users and groups
AnswerB

The snmpwalk command, especially when targeting the default MIB tree or the "system" group (OID 1.3.6.1.2.1.1), is highly effective at retrieving fundamental device information. This includes critical details like the operating system description (sysDescr), device hostname (sysName), system uptime (sysUpTime), and administrative contact information (sysContact). This makes it a primary method for initial reconnaissance to identify the type and version of the target system.

Why this answer

The `snmpwalk` command with the OID `1.3.6.1.2.1.1` (the system group in MIB-II, defined in RFC 1213) queries the SNMP agent for system-level information. The output includes system description, uptime, contact, and version details, which are all part of the system group. This is a classic enumeration technique to gather system information and version details from a target device using SNMP with the default public community string.

Exam trap

The trap here is that candidates often confuse the system group OID (1.3.6.1.2.1.1) with other MIB branches like the interfaces group or IP group, leading them to incorrectly select network topology or routing tables, but the system group specifically returns device identity and version information.

How to eliminate wrong answers

Option A is wrong because SMB share names and permissions are enumerated using tools like `smbclient` or `enum4linux`, not via SNMP OID 1.3.6.1.2.1.1, which is the system group. Option C is wrong because network topology and routing tables are obtained from OIDs under 1.3.6.1.2.1.4 (IP group) and 1.3.6.1.2.1.4.21 (ipRouteTable), not the system group. Option D is wrong because Active Directory users and groups are typically enumerated via LDAP queries or tools like `ldapsearch`, not through SNMP, which does not expose AD object data via the system group OID.

Practice this question →
14
MCQmedium

During a penetration test, you successfully gain access to a web server with a low-privileged shell. You want to escalate privileges to root. Which of the following techniques is MOST likely to achieve privilege escalation on a misconfigured Linux system?

A.Use the `netcat` tool to establish a reverse shell back to the attacker
B.Search for and exploit a SUID binary that allows privilege escalation
C.Use a password cracking tool like John the Ripper on the system's shadow file
D.Perform a brute force attack on the root password
AnswerB

SUID (Set User ID) is a special permission bit on executable files that allows them to run with the permissions of the file's owner, rather than the user executing it. If a binary owned by root, like `find` or `nmap`, has SUID set and can be manipulated to execute arbitrary commands or spawn a shell, a low-privileged user can exploit this to gain root privileges. This is a highly effective and common method for local privilege escalation on Linux/Unix systems.

Why this answer

SUID (Set User ID) binaries execute with the privileges of the file owner, typically root. On a misconfigured Linux system, a low-privileged user can run a SUID-root binary (e.g., `find`, `vim`, `nmap`) to spawn a shell with root privileges, directly achieving privilege escalation without needing credentials or additional exploits.

Exam trap

The trap here is that candidates confuse establishing a reverse shell (which maintains the current privilege level) with privilege escalation, or they assume password cracking is feasible without first obtaining the hashed password file.

How to eliminate wrong answers

Option A is wrong because `netcat` is a network utility for establishing reverse shells or listening for connections; it does not escalate privileges—it only provides a remote shell at the current privilege level. Option C is wrong because John the Ripper cracking the shadow file requires read access to `/etc/shadow`, which a low-privileged shell typically does not have (shadow file is readable only by root or the shadow group). Option D is wrong because brute-forcing the root password is impractical: it requires network or console access, risks account lockout, and is noisy; moreover, the goal is to exploit a misconfiguration, not guess credentials.

Practice this question →
15
MCQmedium

During a penetration test, you run the command `enum4linux -a 192.168.1.10` and receive output containing user account names, group memberships, and share listings. Which protocol is primarily being enumerated?

A.NFS
B.SMB
C.SNMP
D.SMTP
AnswerB

Server Message Block (SMB) is the correct protocol targeted by enum4linux. This tool is specifically engineered to perform comprehensive enumeration against Windows systems, leveraging the SMB protocol to extract critical security-relevant information. It can identify user accounts, shared resources, group memberships, operating system versions, and even password policies, providing valuable insights for penetration testers. This makes SMB enumeration a foundational step in assessing Windows network security.

Why this answer

enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via the SMB (Server Message Block) protocol. The command `enum4linux -a 192.168.1.10` performs a comprehensive scan that retrieves user accounts, group memberships, and share listings, all of which are exposed through SMB's named pipe and RPC mechanisms. SMB is the correct protocol because it is the primary means for file and printer sharing in Windows networks, and enum4linux leverages SMB's IPC$ share and SAMR/LSA RPC services to extract this data.

Exam trap

The trap here is that candidates often confuse enum4linux with tools like 'showmount' for NFS or 'snmpwalk' for SNMP, but the key is that enum4linux is explicitly built for SMB enumeration, and the output of user accounts and shares is a hallmark of SMB, not NFS or SNMP.

How to eliminate wrong answers

Option A is wrong because NFS (Network File System) is a Unix/Linux-based file-sharing protocol that does not expose user account or group membership details via enum4linux; enum4linux is designed for SMB/CIFS environments, not NFS mounts. Option C is wrong because SNMP (Simple Network Management Protocol) is used for network device monitoring and management, not for enumerating user accounts or shares; enum4linux does not interact with SNMP agents. Option D is wrong because SMTP (Simple Mail Transfer Protocol) is an email delivery protocol and has no mechanism for listing user accounts, group memberships, or file shares; enum4linux targets SMB services, not mail servers.

Practice this question →
16
MCQeasy

A security analyst runs `nbtstat -A 192.168.1.10` and receives a response with the computer name, logged-in user, and domain. Which protocol is being queried?

A.NetBIOS
B.SNMP
C.LDAP
D.SMTP
AnswerA

The `nbtstat` command is a dedicated utility for querying NetBIOS over TCP/IP (NetBT) information, which provides name resolution and session services for legacy Windows networking components. When an analyst runs `nbtstat -a <IP_address>`, it specifically attempts to retrieve the NetBIOS name table from the specified remote host. This command directly interacts with the NetBIOS protocol to gather details like registered names and MAC addresses, making NetBIOS the correct answer.

Why this answer

The `nbtstat -A` command performs a NetBIOS name service query (NBNS) against the target IP address using UDP port 137. It retrieves the NetBIOS name table, which includes the computer name, logged-in user, and domain membership, directly from the NetBIOS over TCP/IP (NetBT) protocol stack.

Exam trap

The trap here is that candidates confuse `nbtstat -A` (which queries NetBIOS over TCP/IP) with `nbtstat -a` (which queries by name) or assume it uses a different protocol like SMB, but the command specifically targets the NetBIOS name service on UDP 137.

How to eliminate wrong answers

Option B is wrong because SNMP (Simple Network Management Protocol) uses UDP ports 161/162 and is queried with tools like `snmpget` or `snmwalk`, not `nbtstat`. Option C is wrong because LDAP (Lightweight Directory Access Protocol) operates over TCP port 389 and is used to query directory services like Active Directory, not to retrieve NetBIOS names. Option D is wrong because SMTP (Simple Mail Transfer Protocol) uses TCP port 25 for email transfer and has no role in NetBIOS name resolution or enumeration.

Practice this question →
17
MCQhard

A penetration tester runs the following command against a Linux server: `smbclient -L //192.168.1.10 -N`. The output lists shares including 'IPC$', 'ADMIN$', and 'data'. Which of the following is the BEST next step to enumerate the 'data' share?

A.Run `nmap --script smb-enum-shares -p 445 192.168.1.10`
B.Run `enum4linux -a 192.168.1.10` to gather more information
C.Use `rpcclient -U '' 192.168.1.10` to enumerate users
D.Use `smbclient //192.168.1.10/data -N` to attempt a null session connection
AnswerD

The `smbclient` utility is the standard command-line tool for interacting with SMB/CIFS shares, making it the most appropriate choice for this scenario. The syntax `//192.168.1.10/data` correctly specifies the target server and the known share name. The `-N` flag is crucial as it instructs `smbclient` to attempt a null session connection, meaning it tries to connect anonymously without requiring a username or password. This is the most direct and efficient method to test if the 'data' share is anonymously accessible, which is a common misconfiguration.

Why this answer

The command `smbclient -L //192.168.1.10 -N` performs a null session (no password) listing of SMB shares. The output shows that the 'data' share exists and is accessible without authentication (since the -N flag succeeded). The best next step is to attempt a null session connection to that specific share using `smbclient //192.168.1.10/data -N`, which will mount the share and allow file enumeration.

This directly leverages the null session already confirmed by the initial scan.

Exam trap

The trap here is that candidates often choose a broad enumeration tool like enum4linux or an nmap script, thinking they need more information first, when the direct connection to the already-discovered share is the logical and efficient next step in a penetration test.

How to eliminate wrong answers

Option A is wrong because `nmap --script smb-enum-shares -p 445` would re-enumerate shares, which is redundant after already discovering the 'data' share via smbclient. Option B is wrong because `enum4linux -a` is a comprehensive enumeration tool that gathers users, groups, shares, and policies, but it is a broader, slower step that does not directly access the 'data' share; the immediate goal is to connect to the share, not gather more metadata. Option C is wrong because `rpcclient -U ''` is used for RPC-based enumeration (e.g., users, SIDs) via the IPC$ share, not for accessing a file share like 'data'; it would not list or retrieve files from the 'data' share.

Practice this question →
18
MCQhard

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

A.Run nmap with the smb-enum-shares script
B.Perform a DNS zone transfer
C.Use ldapsearch to query the directory for all attributes
D.Use net view to list domain resources
AnswerC

ldapsearch can retrieve all objects and attributes from an LDAP directory, especially with anonymous bind.

Why this answer

`ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.

Exam trap

The trap here is that candidates confuse LDAP enumeration with SMB or DNS enumeration, assuming any network discovery tool will work, but only LDAP-specific queries (like `ldapsearch`) can extract directory structure from an LDAP server.

How to eliminate wrong answers

Option A is wrong because `nmap` with the `smb-enum-shares` script targets SMB (port 445) and enumerates Windows file shares, not LDAP directory structure on port 389. Option B is wrong because DNS zone transfer (using `dig` or `nslookup`) retrieves DNS records (A, MX, CNAME, etc.) from a DNS server, not LDAP directory attributes or objects. Option D is wrong because `net view` is a Windows command that lists SMB shared resources on a network, not LDAP directory entries.

Practice this question →
19
MCQhard

After gaining initial access, an attacker attempts to escalate privileges by exploiting a misconfigured service running as SYSTEM. They find that the service's binary path is writable by the Everyone group. Which privilege escalation technique is the attacker MOST likely using?

A.SUID/GUID abuse
B.Unquoted service path
C.Weak service permissions
D.Token impersonation
AnswerC

Weak service permissions refer to overly permissive access control lists (ACLs) on a Windows service executable or its configuration, allowing non-privileged users to modify or replace the service binary. If an attacker can write to the service executable, they can replace it with a malicious payload, which will then execute with the service's elevated privileges (often `SYSTEM`) upon the next service restart or system reboot. This direct manipulation of the service binary is a classic and highly effective privilege escalation method.

Why this answer

The attacker can exploit weak service permissions where the binary path of a service running as SYSTEM is writable by the Everyone group. This allows the attacker to replace the legitimate service binary with a malicious executable, and when the service restarts (or the system reboots), the malicious code executes with SYSTEM privileges, achieving privilege escalation.

Exam trap

The trap here is that candidates often confuse 'weak service permissions' (writable binary path) with 'unquoted service path' (missing quotes in the path), but the question explicitly states the binary path is writable, not that it contains spaces.

How to eliminate wrong answers

Option A is wrong because SUID/GUID abuse is a Linux/Unix privilege escalation technique involving setuid or setgid bits on executables, not applicable to Windows services. Option B is wrong because an unquoted service path exploits spaces in the service binary path to execute an attacker-controlled executable placed earlier in the path, not the writability of the binary itself. Option D is wrong because token impersonation involves stealing or duplicating access tokens (e.g., via SeImpersonatePrivilege) to assume another user's identity, not modifying a service binary.

Practice this question →
20
MCQmedium

A penetration tester is enumerating an SMTP server on port 25. They issue the command `VRFY root` and receive a 250 response, then `VRFY admin` also returns 250. What does this indicate about the SMTP server?

A.Both root and admin are valid email accounts on the server
B.The SMTP server supports password authentication
C.The command failed due to syntax errors
D.The SMTP server has disabled user verification
AnswerA

The 250 SMTP response code indicates that the requested mail action was successful and completed. In the context of the VRFY command, a 250 response explicitly confirms that the specified user, such as 'root' or 'admin', is a valid and existing account on the server. This direct confirmation of user existence is precisely what the penetration tester is looking for during enumeration, making both accounts valid.

Why this answer

The VRFY command is used to verify whether a specific user exists on an SMTP server. A 250 response code indicates that the user is valid and the mailbox exists. Since both `root` and `admin` returned 250, this confirms that both are valid email accounts on the server, making option A correct.

Exam trap

The trap here is that candidates may confuse the VRFY command's 250 success response with authentication success or syntax errors, when in fact it strictly indicates user existence on the server.

How to eliminate wrong answers

Option B is wrong because the VRFY command does not test password authentication; it only checks user existence, and SMTP authentication (AUTH) is a separate mechanism. Option C is wrong because a 250 response indicates success, not a syntax error; syntax errors would return a 5xx code (e.g., 500 or 501). Option D is wrong because a 250 response proves user verification is enabled and functional; if disabled, the server would return a 252 (cannot verify) or a 550 (no such user).

Practice this question →
21
MCQmedium

Which of the following tools is specifically designed to perform password cracking using rainbow tables?

A.John the Ripper
B.Ophcrack
C.RainbowCrack
D.Hashcat
AnswerC

RainbowCrack is a pioneering and highly specialized tool explicitly engineered for password cracking using the rainbow table technique. It not only performs efficient lookups against pre-computed rainbow tables but also includes functionalities for generating these large, memory-intensive tables for various hash algorithms. Its design is centered around the mathematical principles of rainbow tables, making it the definitive tool for both their creation and utilization in password recovery.

Why this answer

RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.

Exam trap

EC-Council often tests the distinction between tools that use rainbow tables (RainbowCrack) versus tools that use brute-force or dictionary methods (John the Ripper, Hashcat), and candidates mistakenly associate Ophcrack with general rainbow table cracking when it is actually limited to LM hashes.

How to eliminate wrong answers

Option A is wrong because John the Ripper is a password cracking tool that primarily uses dictionary, brute-force, and incremental modes, not rainbow tables. Option B is wrong because Ophcrack is a Windows password cracker that uses LM hash rainbow tables but is limited to Windows LAN Manager hashes and is not a general-purpose rainbow table tool like RainbowCrack. Option D is wrong because Hashcat is a high-speed password cracker that uses GPU acceleration for brute-force, dictionary, and rule-based attacks, but it does not natively use rainbow tables for cracking.

Practice this question →
22
MCQeasy

Which of the following commands is used to enumerate SNMP information from a network device using a specific community string?

A.ldapsearch -x -h 192.168.1.1 -b dc=domain,dc=com
B.enum4linux -a 192.168.1.1
C.snmpwalk -c public -v 2c 192.168.1.1
D.nbtstat -a 192.168.1.1
AnswerC

snmpwalk is the correct and standard command-line utility for enumerating SNMP (Simple Network Management Protocol) information from a target device. The `-c public` option specifies the community string, which acts as a password for accessing SNMP data, with "public" being a common default. The `-v 2c` flag designates SNMP version 2c, a widely supported version, while `192.168.1.1` is the target IP address from which to retrieve Management Information Base (MIB) data. This command systematically queries the entire MIB tree, revealing device configurations, network statistics, and system details.

Why this answer

`snmpwalk` is the standard command-line tool for enumerating SNMP (Simple Network Management Protocol) information from a network device. By specifying the community string (`-c public`) and SNMP version (`-v 2c`), it retrieves the entire Management Information Base (MIB) tree from the target IP address, allowing an attacker to discover system details, running processes, and network interfaces.

Exam trap

The trap here is that candidates confuse SNMP enumeration tools with other network enumeration tools (like LDAP, SMB, or NetBIOS), leading them to pick a command that targets a different protocol entirely.

How to eliminate wrong answers

Option A is wrong because `ldapsearch` is used for querying LDAP directories (port 389), not for SNMP enumeration; it requires a base DN and is unrelated to community strings. Option B is wrong because `enum4linux` is a tool for enumerating SMB/CIFS shares, users, and policies from Windows systems (port 445), not for SNMP queries. Option D is wrong because `nbtstat` is a Windows utility for NetBIOS over TCP/IP name resolution and cache management (port 137), not for SNMP enumeration.

Practice this question →
23
MCQmedium

A penetration tester wants to crack Windows NTLM hashes using rainbow tables. Which tool is specifically designed for this purpose?

A.Hashcat
B.John the Ripper
C.RainbowCrack
D.Ophcrack
AnswerC

RainbowCrack is a specialized tool explicitly designed to utilize precomputed rainbow tables for efficient password recovery. It leverages the space-time trade-off inherent in rainbow table methodology, where extensive precomputation allows for exceptionally fast lookup during the cracking phase. By using these tables, RainbowCrack can quickly reverse NTLM hashes into their original plaintexts, provided the plaintext exists within the table's precomputed range, making it the most direct and effective tool for this specific task.

Why this answer

RainbowCrack is specifically designed for cracking hashes using precomputed rainbow tables. It works by performing a lookup in a rainbow table to reverse a hash into its plaintext, which is the core mechanism described in the question. While Hashcat and John the Ripper can also crack NTLM hashes, they are not specifically designed for rainbow table attacks; they primarily use brute-force or dictionary-based methods.

Exam trap

In the CEH exam, candidates often confuse Ophcrack (which is also a rainbow table tool but limited to LM/NTLM on older Windows) with RainbowCrack (the general-purpose tool), or they assume Hashcat or John the Ripper are the primary tools for rainbow table attacks when they are not specifically designed for that purpose.

How to eliminate wrong answers

Option A is wrong because Hashcat is a GPU-accelerated password recovery tool that uses brute-force, dictionary, and rule-based attacks, not rainbow tables. Option B is wrong because John the Ripper is a password cracking tool that primarily uses dictionary and brute-force attacks, and while it can use rainbow tables via external plugins, it is not specifically designed for that purpose. Option D is wrong because Ophcrack is a tool specifically designed for cracking LM and NTLM hashes using rainbow tables, but it is limited to Windows XP/Vista/7 and is not the general-purpose rainbow table tool for NTLM hashes; the question asks for a tool specifically designed for this purpose, and RainbowCrack is the correct answer.

Practice this question →
24
MCQmedium

Which of the following commands would a tester use to enumerate NetBIOS names and their associated IP addresses on a local subnet?

A.nbtstat -n
B.nbtstat -c
C.nbtstat -a 192.168.1.10
D.nbtstat -A 192.168.1.10
AnswerD

The "nbtstat -A" command is specifically designed to perform a remote NetBIOS name table query against a target identified by its *IP address*. This command sends a NetBIOS Adapter Status Request to the specified IP, retrieving the NetBIOS names registered by that host, including workgroup/domain membership and services. This direct query capability makes "nbtstat -A 192.168.1.10" the correct choice for enumerating NetBIOS information from a remote system. It directly fulfills the requirement to enumerate a remote host using its IP.

Why this answer

The `nbtstat -A` command (with a capital 'A') performs a NetBIOS name table lookup against a remote IP address, listing the NetBIOS names registered by that host along with their associated IP addresses. This is the standard method for enumerating NetBIOS names on a specific target within a local subnet, as it queries the NetBIOS name service (UDP port 137) directly.

Exam trap

The trap here is that candidates often confuse the lowercase `-a` (which expects a hostname) with the uppercase `-A` (which expects an IP address), leading them to incorrectly select option C when the question specifies an IP address.

How to eliminate wrong answers

Option A is wrong because `nbtstat -n` displays only the local NetBIOS names registered on the tester's own machine, not names from other hosts on the subnet. Option B is wrong because `nbtstat -c` shows the local NetBIOS name cache, which contains recently resolved names and their IP addresses, but does not actively enumerate all hosts on the subnet. Option C is wrong because `nbtstat -a` (lowercase 'a') performs a NetBIOS name table lookup using a hostname, not an IP address, so it would fail or produce incorrect results when given an IP address.

Practice this question →
25
MCQhard

A security analyst runs `snmpwalk -v2c -c public 192.168.1.1` and receives extensive output about the device's configuration. Which of the following is the MOST effective countermeasure against this enumeration?

A.Disable SNMP entirely
B.Use SNMPv3 with encryption
C.Change the default community string and restrict SNMP access to specific IPs
D.Block ICMP echo requests
AnswerC

Changing the default community string, such as 'public', immediately invalidates the attacker's current enumeration attempt, as they would no longer possess the correct credential for SNMPv2c access. Simultaneously, restricting SNMP access to specific, authorized IP addresses through Access Control Lists (ACLs) provides an additional layer of defense. This combination ensures that only trusted management stations can even attempt to communicate with the SNMP agent, significantly reducing the attack surface and preventing unauthorized information disclosure.

Why this answer

The most effective countermeasure against SNMP enumeration via a default community string is to change the default 'public' (or 'private') string to a strong, non-guessable value and restrict SNMP access to trusted management IPs using an access control list (ACL). This prevents unauthorized querying of the MIB tree while still allowing legitimate SNMP monitoring.

Exam trap

The trap here is that candidates often choose SNMPv3 with encryption (Option B) because it sounds more secure, but the question specifically targets the misconfiguration of using the default 'public' community string on SNMPv2c, which is best remedied by changing the community string and restricting access, not by upgrading the protocol version alone.

How to eliminate wrong answers

Option A is wrong because disabling SNMP entirely may break legitimate network monitoring and management functions, making it an overly drastic and often impractical solution. Option B is wrong because while SNMPv3 with encryption provides authentication and privacy, the question specifies the attacker is using SNMPv2c with the 'public' community string; switching to SNMPv3 does not directly address the misconfiguration of using a default community string on v2c devices, and the question asks for the most effective countermeasure against this specific enumeration. Option D is wrong because blocking ICMP echo requests (ping) only prevents network discovery via ICMP, not SNMP enumeration over UDP port 161.

Practice this question →
26
MCQeasy

A security analyst wants to enumerate users and groups from a Windows domain controller using LDAP. Which of the following queries would return all objects of class 'user' from the domain 'example.com'?

A.ldapsearch -x -b "dc=example,dc=com" "(cn=*)"
B.ldapsearch -x -b "dc=example,dc=com" "(objectClass=user)"
C.ldapsearch -x -b "dc=example,dc=com" "(objectClass=person)"
D.ldapsearch -x -b "dc=example,dc=com" "(&(objectClass=user)(objectCategory=person))"
AnswerB

This is the correct and most precise filter for enumerating user objects within an LDAP directory, including Active Directory. The `(objectClass=user)` filter specifically targets entries classified as user accounts, ensuring that only relevant user objects are returned. This command effectively identifies and lists all user accounts under the specified base DN, fulfilling the requirement to enumerate users.

Why this answer

The LDAP filter (objectClass=user) specifically retrieves all entries where the objectClass attribute equals 'user', which in Active Directory corresponds to user objects. Option A is incorrect because it searches for any object with a common name, not limiting to users. Option C is incorrect because objectClass=person includes contact objects as well.

Option D is incorrect because it adds the condition objectCategory=person, which is a Microsoft-specific attribute and is redundant; it does not improve the query and may cause compatibility issues in standard LDAP environments.

Exam trap

The trap is that candidates often choose Option D thinking the combined filter is more precise, but they fail to realize that (objectClass=user) alone is sufficient and that objectCategory=person is a Microsoft-specific attribute that is redundant and can cause issues in standard LDAP environments.

How to eliminate wrong answers

Option A is wrong because `(cn=*)` matches any entry with a common name, including computers, groups, and organizational units, not just users. Option C is wrong because `(objectClass=person)` includes not only users but also contact objects and other entries that inherit from the 'person' class, such as inetOrgPerson. Option D is wrong because `(&(objectClass=user)(objectCategory=person))` is redundant—in Active Directory, all user objects already have objectCategory=person, so this filter is overly specific and may miss some user objects that don't have that category set, though it is functionally similar to B; however, the question asks for the query that returns all objects of class 'user', and B is the simplest and most direct correct answer.

Practice this question →
27
MCQmedium

An analyst observes repeated failed login attempts to a Windows server from an internal IP, followed by a successful login using the account 'admin' from the same IP. The analyst checks the Security log and finds Event ID 4624 with Logon Type 3. What type of attack is MOST likely occurring?

A.SMB relay attack
B.Kerberos golden ticket attack
C.Pass-the-hash attack
D.Dictionary attack on the admin account
AnswerD

A dictionary attack systematically attempts to log in using a predefined list of common passwords, often targeting specific user accounts like 'admin'. The observation of repeated failed login attempts to a Windows system is a classic indicator of such an attack in progress. Each incorrect password guess contributes to the failed attempt count, making this attack type directly align with the described scenario.

Why this answer

Event ID 4624 with Logon Type 3 indicates a network logon (typically SMB or other network resource access). The sequence of repeated failed attempts followed by a successful login from the same internal IP strongly suggests a dictionary (brute-force) attack against the 'admin' account. The attacker systematically tried passwords until one succeeded, which is the hallmark of a dictionary attack.

Exam trap

The trap here is that candidates see 'successful login' and 'Event ID 4624' and incorrectly assume a pass-the-hash or relay attack, but the presence of repeated failed attempts before success is the key indicator of a dictionary attack, not a credential theft technique.

How to eliminate wrong answers

Option A is wrong because an SMB relay attack intercepts and relays authentication traffic to impersonate a user, not by trying multiple passwords from a single IP; it would not produce repeated failed logins followed by a success from the same IP. Option B is wrong because a Kerberos golden ticket attack forges a Ticket Granting Ticket (TGT) using the KRBTGT hash, allowing domain-wide access without any failed login attempts; it would not generate Event ID 4624 with Logon Type 3 from a single IP. Option C is wrong because a pass-the-hash attack uses a stolen NTLM hash to authenticate without knowing the plaintext password, so it would not cause multiple failed login attempts; it typically succeeds on the first try if the hash is valid.

Practice this question →
28
MCQhard

During a security assessment, you find a Linux binary with the SUID bit set and owned by root. You execute it and obtain a root shell. This is an example of which privilege escalation technique?

A.DLL hijacking
B.Kernel exploit
C.Token impersonation
D.SUID abuse
AnswerD

SUID (Set User ID) abuse is the correct technique because the SUID permission bit, when set on an executable file in Linux, allows any user to execute that binary with the effective user ID (EUID) of the file's owner, rather than the user who invoked it. If a binary owned by root has the SUID bit set and contains a vulnerability (e.g., insecure command execution, buffer overflow), an attacker can exploit it to execute commands or gain a shell with root privileges. This directly matches the scenario of finding a Linux binary with the SUID bit during a security assessment.

Why this answer

The SUID (Set User ID) bit on a binary owned by root allows it to execute with root privileges regardless of the user running it. When you execute such a binary and it spawns a shell, that shell inherits the elevated privileges, effectively granting you a root shell. This is a classic example of SUID abuse, a common privilege escalation technique on Linux systems.

Exam trap

The trap here is that candidates may confuse SUID abuse with a kernel exploit, thinking any root shell from a binary must involve a kernel vulnerability, but SUID abuse is a misconfiguration-based technique that does not require exploiting kernel code.

How to eliminate wrong answers

Option A is wrong because DLL hijacking is a Windows-specific technique that exploits the search order for Dynamic Link Libraries to load a malicious DLL, which is not applicable to Linux binaries. Option B is wrong because a kernel exploit targets vulnerabilities in the operating system kernel to gain elevated privileges, whereas this scenario involves a legitimate SUID binary, not a kernel flaw. Option C is wrong because token impersonation is a Windows privilege escalation method that manipulates access tokens (e.g., using SeImpersonatePrivilege), which does not apply to Linux's SUID mechanism.

Practice this question →
29
MCQmedium

A security analyst notices that an attacker has gained SYSTEM privileges on a Windows server after compromising a service running as LOCAL SYSTEM. The attacker then uses `whoami /priv` and finds the SeTcbPrivilege (Act as part of the operating system) is enabled. Which privilege escalation technique might the attacker use next?

A.Sticky keys exploit
B.Token impersonation
C.DLL injection
D.Pass-the-hash
AnswerB

Token impersonation is a direct privilege escalation technique enabled by the `SeTcbPrivilege`, also known as 'Act as part of the operating system'. This powerful privilege allows a process to create a new access token for any user or even the SYSTEM account, effectively assuming their security context. An attacker with this privilege can create a token representing a higher-privileged user and then execute commands or access resources with those elevated permissions.

Why this answer

With SeTcbPrivilege enabled, the attacker can call the `CreateProcessAsUser` or `DuplicateTokenEx` API to impersonate any user token, including SYSTEM. This is a classic token impersonation attack, allowing the attacker to elevate from LOCAL SYSTEM to a higher-integrity context or move laterally by creating processes with arbitrary identities.

Exam trap

The trap here is that candidates confuse SeTcbPrivilege with SeDebugPrivilege or assume it only applies to kernel-level attacks, but CEH specifically tests that SeTcbPrivilege enables token impersonation via Windows API calls.

How to eliminate wrong answers

Option A is wrong because the Sticky Keys exploit (sethc.exe replacement) requires physical or RDP access to the login screen and targets accessibility features, not privilege escalation from a running service. Option C is wrong because DLL injection is a code execution technique used to load a malicious DLL into a process, but it does not directly leverage SeTcbPrivilege for token-based elevation. Option D is wrong because Pass-the-hash is a lateral movement technique that uses NTLM hashes to authenticate over the network, not a local privilege escalation method that exploits SeTcbPrivilege.

Practice this question →
30
MCQeasy

Which tool is specifically designed to crack Windows LM and NTLM password hashes using rainbow tables?

A.Hashcat
B.RainbowCrack
C.Ophcrack
D.John the Ripper
AnswerC

Ophcrack is a dedicated and highly effective tool specifically engineered for cracking Windows LM and NTLM password hashes by leveraging pre-computed rainbow tables. It comes pre-packaged with extensive rainbow tables optimized for various Windows password complexities, allowing for rapid password recovery without requiring significant computational power for brute-forcing. Its user-friendly interface and specialized focus make it the go-to solution for offline Windows password cracking using this method.

Why this answer

Ophcrack is specifically designed to crack Windows LM and NTLM password hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing each password individually, making it the correct choice for this targeted task.

Exam trap

EC-Council often tests the distinction between tools that use rainbow tables (Ophcrack) versus those that use brute-force or dictionary attacks (Hashcat, John the Ripper), leading candidates to mistakenly choose a general-purpose cracker for a rainbow-table-specific question.

How to eliminate wrong answers

Option A is wrong because Hashcat is a general-purpose password cracker that supports many hash types (including LM/NTLM) but relies on GPU-accelerated brute-force or dictionary attacks, not rainbow tables. Option B is wrong because RainbowCrack is a tool that generates and uses rainbow tables for various hash types, but it is not specifically designed for Windows LM/NTLM hashes; it requires separate table generation or download for those formats. Option D is wrong because John the Ripper is a versatile password cracking tool that uses dictionary, brute-force, and incremental modes, but it does not natively use rainbow tables for LM/NTLM cracking.

Practice this question →
31
MCQmedium

A security administrator notices repeated failed login attempts from a single IP address targeting the SSH service. The attempts use common usernames (root, admin, test) and a list of passwords from a dictionary. What type of password attack is being conducted?

A.Rainbow table attack
B.Dictionary attack
C.Hybrid attack
D.Brute-force attack
AnswerB

A dictionary attack involves systematically attempting to log in using a predefined list of common words, phrases, or previously leaked passwords against a target username or set of usernames. This method leverages the widespread use of weak, easily guessable passwords by users, making it a highly efficient strategy for gaining unauthorized access. It is particularly effective when systems lack robust password policies or account lockout mechanisms to deter repeated login failures.

Why this answer

This is a dictionary attack because the attacker uses a predefined list of common usernames and passwords (a dictionary) against the SSH service. Unlike a brute-force attack that tries all possible combinations, a dictionary attack only tests likely entries from a wordlist, making it faster but limited to the dictionary's contents.

Exam trap

The trap here is confusing a dictionary attack with a brute-force attack; CEH emphasizes that a dictionary attack uses a wordlist of likely passwords, while a brute-force attack exhaustively tries all possible character combinations, regardless of likelihood.

How to eliminate wrong answers

Option A is wrong because a rainbow table attack uses precomputed hash chains to reverse hashes, not live login attempts with plaintext passwords. Option C is wrong because a hybrid attack combines dictionary words with modifications (e.g., appending numbers or symbols), but the scenario describes only a static list of passwords without any mutation. Option D is wrong because a brute-force attack systematically tries every possible character combination (e.g., aaa, aab, aac), which is far more exhaustive and computationally expensive than using a predefined wordlist.

Practice this question →
32
MCQeasy

During a penetration test, you receive a list of password hashes from a Windows server. Which of the following tools would be BEST suited to perform a dictionary attack against these hashes?

A.Nmap
B.John the Ripper
C.Wireshark
D.Metasploit
AnswerB

John the Ripper is a dedicated, open-source password cracking tool specifically engineered to detect weak passwords in various systems. It excels at processing lists of password hashes, employing sophisticated techniques such as dictionary attacks, brute-force methods, and single crack modes to efficiently recover the original plaintext passwords from their hashed representations.

Why this answer

John the Ripper is a dedicated password cracking tool that supports dictionary attacks against various hash types, including Windows NTLM hashes. It takes the list of hashes and compares them against a wordlist of candidate passwords, making it the best choice for this task.

Exam trap

EC-Council often tests the distinction between tools that capture hashes (like Metasploit's hashdump) versus tools that crack them (like John the Ripper), leading candidates to mistakenly choose Metasploit for the cracking phase.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning tool used for port discovery and service enumeration, not for cracking password hashes. Option C is wrong because Wireshark is a packet analyzer used for network traffic inspection, not for offline hash cracking. Option D is wrong because Metasploit is an exploitation framework; while it can capture hashes via modules like psexec or hashdump, it is not designed for performing dictionary attacks against already-obtained hashes.

Practice this question →
33
MCQhard

A Linux system has a script named 'backup' owned by root with the SUID bit set and world-executable permissions. A standard user executes the script and discovers it runs a command that reads /etc/shadow and writes output to a world-readable file. What is the most likely intended exploitation path?

A.GUID abuse
B.LD_PRELOAD injection
C.SUID abuse to read sensitive files
D.Token impersonation
AnswerC

The SUID bit makes the script run as root, so it can read /etc/shadow. Users can exploit this to get hashes.

Why this answer

The SUID bit on the 'backup' script, owned by root and world-executable, allows any user to execute it with root privileges. If the script reads /etc/shadow (which is normally root-only) and writes the output to a world-readable file, an attacker can exploit this to exfiltrate password hashes. This is a classic SUID abuse scenario where a privileged binary or script is used to access sensitive files.

Exam trap

The trap here is that candidates may confuse SUID with SGID or think LD_PRELOAD works on scripts, but the key is recognizing that SUID on a root-owned executable enables privilege escalation to read /etc/shadow, while LD_PRELOAD only applies to dynamically linked binaries, not scripts.

How to eliminate wrong answers

Option A is wrong because GUID (Group ID) abuse would involve the SGID bit, which grants group-level privileges, not root-level access to /etc/shadow; the question specifies the SUID bit, not SGID. Option B is wrong because LD_PRELOAD injection requires the attacker to control environment variables and the target binary to be dynamically linked, but a script (not a compiled binary) does not honor LD_PRELOAD; it runs via an interpreter like bash, which ignores such environment overrides. Option D is wrong because token impersonation is a Windows-specific attack involving access tokens (e.g., SeImpersonatePrivilege), not applicable to Linux systems.

Practice this question →
34
MCQmedium

A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?

A.Use enum4linux -a 192.168.1.10 to enumerate users and policies
B.Attempt to crack the administrator password using a dictionary attack
C.Perform a port scan to check for open ports
D.Run snmpwalk to retrieve SNMP community strings
AnswerA

After discovering open SMB shares, the next logical step in a penetration test is to enumerate specific details about the SMB service. enum4linux is a specialized tool designed for this purpose, leveraging various SMB/Samba enumeration techniques. The -a flag instructs enum4linux to perform all available enumeration options, including listing users, groups, shares, and security policies, which provides critical information for subsequent exploitation attempts. This comprehensive enumeration helps identify valid usernames, potential weak policies, and further attack vectors.

Why this answer

The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.

Exam trap

The trap here is that candidates often jump to password cracking (Option B) or port scanning (Option C) because they assume administrative shares require credentials, but the question tests the understanding that null sessions allow further enumeration without authentication, making `enum4linux` the correct next step.

How to eliminate wrong answers

Option B is wrong because attempting a dictionary attack on the administrator password is premature at this stage; the penetration tester has not yet identified valid usernames or password policies, and null session enumeration should be exhausted first. Option C is wrong because a port scan was already implicitly performed (the tester knew to target SMB on port 445/139), and further port scanning would not leverage the null session access already obtained. Option D is wrong because `snmpwalk` is used to query SNMP MIB data, which requires SNMP community strings and is unrelated to SMB null session enumeration; it would be a separate reconnaissance step, not the immediate next step.

Practice this question →
35
Multi-Selectmedium

Which TWO of the following are valid enumeration techniques? (Select 2)

Select 2 answers
A.LDAP enumeration
B.NetBIOS enumeration using nbtstat
C.ARP poisoning
D.DNS cache poisoning
E.ICMP flooding
AnswersA, B

LDAP enumeration queries directory services.

Why this answer

LDAP enumeration is a valid enumeration technique because it involves querying a Lightweight Directory Access Protocol (LDAP) service to extract information about users, groups, computers, and other objects from a directory service like Microsoft Active Directory. Attackers use tools such as ldapsearch or ADExplorer to anonymously or authenticatedly browse the directory tree, revealing usernames, group memberships, and organizational units, which are critical for planning further attacks.

Exam trap

EC-Council often tests the distinction between active reconnaissance techniques (like enumeration) and attack techniques (like ARP poisoning or DoS), so candidates mistakenly select options that are network attacks rather than information-gathering methods.

Practice this question →
36
MCQmedium

An attacker attempts to enumerate valid email users by connecting to an SMTP server and issuing the following commands: EHLO example.com, VRFY root, VRFY admin, VRFY user1. Which SMTP enumeration technique is being used?

A.RCPT TO
B.MAIL FROM
C.EXPN
D.VRFY
AnswerD

The VRFY (Verify) command is an SMTP instruction specifically designed to query the mail server about the existence and validity of a particular mailbox name. A compliant server will respond by either confirming the user's full name and mailbox, or by indicating that the user does not exist. This direct feedback mechanism makes VRFY an ideal and explicit command for enumerating valid user accounts on a mail server.

Why this answer

The VRFY command is specifically designed to verify whether a mailbox exists on an SMTP server. By issuing VRFY followed by usernames (root, admin, user1), the attacker can enumerate valid email users based on the server's responses (e.g., 250 or 251 for valid, 550 for invalid). This is a classic SMTP user enumeration technique.

Exam trap

The trap here is that candidates confuse VRFY with EXPN, thinking both verify users, but EXPN expands aliases/groups while VRFY checks individual mailboxes.

How to eliminate wrong answers

Option A is wrong because RCPT TO is used to specify a recipient for a mail message during the SMTP DATA phase, not to verify user existence in isolation; it can be used for enumeration but requires a MAIL FROM first and is not the command shown. Option B is wrong because MAIL FROM identifies the sender of an email, not the recipient, and does not directly enumerate users. Option C is wrong because EXPN expands a mailing list or alias, returning membership details, not verifying individual user accounts like VRFY does.

Practice this question →
37
MCQmedium

A security analyst is investigating a potential SMB-based attack. They notice unusual traffic on port 445 from a host running `enum4linux`. Which of the following enumeration actions could `enum4linux` perform that would generate such traffic?

A.Scanning for open ports on the target system
B.Enumerating SMB shares and user accounts
C.Performing a DNS zone transfer
D.Querying SNMP MIB values using community strings
AnswerB

`enum4linux` is a dedicated Linux command-line utility specifically engineered to enumerate SMB (Server Message Block) information from Windows and Samba systems. It leverages the SMB protocol, primarily over TCP port 445, to gather critical intelligence such as user accounts, group memberships, available network shares, and password policies. This direct interaction with SMB services makes it the correct tool for detailed reconnaissance of SMB-based targets.

Why this answer

enum4linux is a tool specifically designed for enumerating information from Windows and Samba systems via the SMB protocol (port 445). It can list SMB shares, retrieve user account lists, and gather other system details by querying the SMB service, which directly generates traffic on port 445.

Exam trap

The trap here is that candidates may confuse enum4linux with a general-purpose scanning tool, but it is strictly an SMB enumeration utility that relies on SMB-specific RPC calls over port 445.

How to eliminate wrong answers

Option A is wrong because scanning for open ports is typically performed by tools like Nmap, not enum4linux, which operates on already discovered SMB services. Option C is wrong because DNS zone transfers use TCP/UDP port 53 and are performed by tools like dig or nslookup, not enum4linux. Option D is wrong because querying SNMP MIB values uses UDP port 161 and community strings, which is the function of SNMP enumeration tools like snmpwalk, not enum4linux.

Practice this question →
38
MCQmedium

During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?

A.ldapsearch
B.nbtstat
C.smbclient
D.snmpwalk
AnswerA

ldapsearch is the correct command-line utility for querying LDAP (Lightweight Directory Access Protocol) directories, which Active Directory heavily utilizes for storing user, group, and computer information. During a penetration test, it allows an attacker to enumerate users, groups, and their attributes by directly querying a domain controller. This tool is indispensable for mapping out an organization's user base and understanding its structure within an Active Directory environment.

Why this answer

ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.

Exam trap

The trap here is that candidates often confuse nbtstat or smbclient as tools for user enumeration because they associate them with Windows networking, but neither can query Active Directory's LDAP directory for user and group objects.

How to eliminate wrong answers

Option B (nbtstat) is wrong because it only resolves NetBIOS names to IP addresses and displays local NetBIOS name tables; it cannot enumerate users or groups from a domain controller. Option C (smbclient) is wrong because it is a file-sharing client for SMB/CIFS protocol, used to access shared files and printers, not to query directory services for user and group objects. Option D (snmpwalk) is wrong because it retrieves SNMP MIB data from network devices, which does not include Active Directory user or group information unless specifically configured with custom MIBs, which is not standard for domain controllers.

Practice this question →
39
MCQmedium

A penetration tester runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

A.Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
B.Perform a full TCP connect scan with UDP service detection on all ports
C.Perform an aggressive scan of all open ports and enumerate SMB shares
D.Perform a UDP scan on the four specified ports and identify running services
AnswerA

The `nmap -sS -sV -O -p 22,80,443,3389` command initiates a TCP SYN scan, often termed a 'stealth scan,' which sends SYN packets without completing the full TCP handshake to identify open ports. Concurrently, the `-sV` flag attempts to detect the specific service and its version running on these ports, while `-O` endeavors to fingerprint the target's operating system. The `-p` flag precisely limits this comprehensive reconnaissance to only ports 22, 80, 443, and 3389, making it a highly targeted information gathering effort.

Why this answer

The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection on open ports, and `-O` attempts OS fingerprinting. The scan is limited to ports 22, 80, 443, and 3389 across the 192.168.1.0/24 subnet. This combination performs a half-open scan on those four ports, identifies the versions of services running on them, and tries to determine the operating system of each host.

Exam trap

The trap here is that candidates confuse `-sS` (SYN scan) with a full connect scan or UDP scan, or assume that `-sV` and `-O` imply an aggressive scan (`-A`) that includes additional enumeration like SMB shares.

How to eliminate wrong answers

Option B is wrong because `-sS` performs a TCP SYN scan, not a full TCP connect scan (`-sT`), and there is no UDP service detection (`-sU`) specified. Option C is wrong because the command does not use the `-A` aggressive scan flag and does not include any SMB enumeration options (like `--script smb-enum-shares`). Option D is wrong because `-sS` is a TCP SYN scan, not a UDP scan (`-sU`), and the `-sV` flag detects service versions, not just identifies running services.

Practice this question →
40
MCQeasy

A security analyst runs the command `nbtstat -A 192.168.1.50` in a Windows environment. What information is the analyst attempting to retrieve?

A.The current routing table on the host
B.Active network connections and listening ports
C.DNS records for the host
D.NetBIOS names and services of the remote system
AnswerD

The `nbtstat -a 192.168.1.50` command correctly utilizes the `-a` (adapter status) flag to query the NetBIOS name table of the remote host at the specified IP address. This command enumerates the NetBIOS names registered by that system, including unique names, group names, and the services running on it, often revealing the computer name, workgroup/domain, and even the MAC address. This information is crucial for understanding the NetBIOS identity of a remote machine on the network.

Why this answer

The `nbtstat -A` command queries the NetBIOS name table of a remote system by its IP address. NetBIOS over TCP/IP (NBT) maintains a table of names and services (e.g., workstation, server, messenger) that the remote host has registered. This is a classic enumeration technique to discover shares, logged-in users, and other NetBIOS resources.

Exam trap

The trap here is confusing `nbtstat -A` (remote NetBIOS table) with `nbtstat -a` (local NetBIOS table) or with `netstat`, leading candidates to mistakenly choose active connections or routing information.

How to eliminate wrong answers

Option A is wrong because `nbtstat` does not display routing tables; the `route print` command is used for that purpose. Option B is wrong because active network connections and listening ports are retrieved with `netstat`, not `nbtstat`. Option C is wrong because DNS records are queried using `nslookup` or `dig`; `nbtstat` operates at the NetBIOS layer, not DNS.

Practice this question →
41
MCQeasy

Which of the following is a method of hiding files on a system using steganography?

A.Encrypting a file with AES
B.Renaming a file to a system filename
C.Embedding a secret message in an image file
D.Using a rootkit to hide processes
AnswerC

This method directly describes steganography, which is the art and science of hiding information within other non-secret messages or data. By embedding a secret message or an entire file within the seemingly innocuous data of a cover medium, such as an image, the existence of the hidden information is concealed. Techniques like Least Significant Bit (LSB) manipulation subtly alter the least significant bits of pixel data, making the embedded data visually imperceptible without specialized analysis tools.

Why this answer

Steganography is the practice of concealing a secret message within a non-secret file, such as an image, audio, or video file. By embedding data into the least significant bits (LSB) of pixel values in an image, the file appears unchanged to the casual observer, effectively hiding the secret message in plain sight.

Exam trap

The trap here is that candidates confuse encryption (which scrambles data) with steganography (which hides data's existence), leading them to select AES encryption as a hiding method rather than recognizing it as a confidentiality mechanism.

How to eliminate wrong answers

Option A is wrong because AES encryption transforms data into an unreadable ciphertext but does not hide the file's existence; it only protects its confidentiality. Option B is wrong because renaming a file to a system filename (e.g., 'svchost.exe') is a form of masquerading or file hiding via naming, not steganography, which requires embedding data within another medium. Option D is wrong because a rootkit hides processes, files, or registry keys from the operating system, but it is a tool for maintaining covert access, not a method of steganography.

Practice this question →
42
MCQhard

A security analyst examines a compromised Linux server and finds a hidden directory `/usr/share/.syslog` containing a modified version of `sshd` and a log cleaner script. This is indicative of which technique used to erase tracks?

A.Token impersonation
B.DLL injection
C.Rootkit installation
D.Steganography
AnswerC

Rootkit installation is a highly effective post-exploitation technique for maintaining persistent access and evading detection on a compromised Linux server. Rootkits often replace legitimate system binaries (like ls, ps, netstat) with malicious versions that filter out evidence of the attacker's activities, such as hidden processes or network connections. Concurrently, log cleaners are used to erase entries from system logs (e.g., /var/log/auth.log, /var/log/syslog) that would reveal the initial compromise or subsequent actions, ensuring the attacker's presence remains concealed.

Why this answer

The presence of a hidden directory containing a modified `sshd` binary and a log cleaner script is a classic sign of a rootkit installation. Rootkits replace core system binaries (like `sshd`) to maintain backdoor access and use log cleaners to erase evidence of their activity, directly aligning with the technique of erasing tracks.

Exam trap

EC-Council often tests the distinction between platform-specific techniques, and the trap here is that candidates may confuse rootkit installation with steganography because both involve 'hiding,' but steganography hides data, not system binaries or logs.

How to eliminate wrong answers

Option A is wrong because token impersonation is a Windows-specific privilege escalation technique that involves duplicating access tokens, not hiding files or modifying binaries on a Linux server. Option B is wrong because DLL injection is a Windows technique for injecting code into running processes via dynamic-link libraries, which does not apply to Linux systems that use shared objects (.so) and have no concept of DLLs. Option D is wrong because steganography hides data within other data (e.g., images or audio) and is not used to replace system binaries or clean logs to erase tracks.

Practice this question →
43
MCQmedium

Which of the following commands would a penetration tester use to enumerate SMB shares on a target Windows machine from a Linux system?

A.ldapsearch -x -h <IP>
B.smbclient -L //<IP> -N
C.snmpwalk -v2c -c public <IP>
D.nbtstat -A <IP>
AnswerB

-L lists shares, -N uses null session.

Why this answer

The `smbclient -L //<IP> -N` command lists SMB shares on a target Windows machine without requiring a password (null session). This is a standard enumeration technique because SMB uses TCP port 445 and the `-L` flag queries the share list, while `-N` suppresses the password prompt, allowing anonymous access if the target permits null sessions.

Exam trap

The trap here is that candidates may confuse `nbtstat` (a Windows-only command) with a Linux tool, or assume `ldapsearch` or `snmpwalk` can enumerate SMB shares because they are common enumeration commands, but they operate on entirely different protocols and services.

How to eliminate wrong answers

Option A is wrong because `ldapsearch -x -h <IP>` is used for LDAP directory queries (port 389/636), not for enumerating SMB shares. Option C is wrong because `snmpwalk -v2c -c public <IP>` queries SNMP MIB data (port 161) using the public community string, which enumerates system information but not SMB shares. Option D is wrong because `nbtstat -A <IP>` is a Windows command for NetBIOS name table lookups (port 137), not a Linux command, and it does not enumerate SMB shares; the Linux equivalent would be `nmblookup` or `nbtscan`.

Practice this question →
44
MCQhard

A security analyst is investigating a compromised Linux system. The /var/log/auth.log file appears to be truncated, and the timestamps on several binaries in /bin/ have been modified. Which of the following tools or techniques is the attacker MOST likely using to cover tracks?

A.Timestamp manipulation tool
B.Rootkit
C.Steganography
D.Log cleaner script
AnswerB

A rootkit is a collection of tools designed to obtain and maintain privileged access on a computer while actively hiding its presence from administrators and security software. It achieves this by replacing legitimate system binaries with malicious versions, hooking system calls to manipulate output (e.g., hiding processes or files), and modifying log files to erase traces of its activity. This comprehensive subversion of the operating system allows an attacker to maintain persistent, stealthy control over the compromised Linux system.

Why this answer

The attacker is most likely using a rootkit to cover tracks because rootkits are designed to hide malicious activity by intercepting system calls (e.g., via LD_PRELOAD or kernel modules) to hide processes, files, and network connections. The truncated auth.log and modified timestamps on binaries in /bin/ indicate the rootkit is actively tampering with system logs and file metadata to evade detection, which aligns with rootkit behavior rather than simpler tools.

Exam trap

The trap here is that candidates often confuse a simple log cleaner script (Option D) with the full capability of a rootkit, failing to recognize that only a rootkit can simultaneously hide processes, modify binary timestamps, and intercept log writes at the system call level.

How to eliminate wrong answers

Option A is wrong because timestamp manipulation tools (e.g., touch -t) can modify file timestamps but do not truncate logs or hide ongoing malicious activity; they are a one-off action, not a persistent concealment technique. Option C is wrong because steganography hides data within other files (e.g., images) and is unrelated to log truncation or binary timestamp modification; it is a data exfiltration or covert communication method, not a track-covering mechanism. Option D is wrong because a log cleaner script (e.g., logrotate abuse or sed on auth.log) can delete or truncate logs but cannot modify timestamps on system binaries or hide processes; it is a simpler tool that lacks the system-level interception capabilities of a rootkit.

Practice this question →
45
MCQmedium

An attacker has gained access to a system and wants to erase evidence of their activities. Which of the following actions is MOST effective for covering tracks on a Windows system?

A.Disabling the Windows Firewall
B.Installing a rootkit
C.Clearing the Security event log
D.Changing the administrator password
AnswerC

Clearing the Security event log directly addresses the goal of erasing evidence because this log specifically records critical system events, including successful and failed login attempts, privilege escalations, object access, and other security-relevant actions. By deleting these entries, an attacker effectively removes the digital breadcrumbs that forensic investigators would use to reconstruct the timeline and nature of the intrusion. This action significantly hinders incident response and attribution efforts.

Why this answer

Clearing the Security event log (C) is the most effective action for covering tracks on a Windows system because it removes all logged security events, such as logon attempts, privilege use, and audit failures, which are the primary records that would reveal an attacker's activities. The Security log is maintained by the Windows Event Log service and is the default location for audit records under the Local Security Policy; deleting it eliminates forensic evidence of unauthorized access or changes.

Exam trap

EC-Council often tests the distinction between covering tracks (erasing evidence) and maintaining access or evading detection; the trap here is that candidates confuse installing a rootkit (which hides ongoing activity) with clearing logs (which removes past evidence), leading them to choose B instead of C.

How to eliminate wrong answers

Option A is wrong because disabling the Windows Firewall does not erase existing evidence of an attack; it only removes a network defense layer, which may actually draw attention by breaking connectivity or triggering alerts. Option B is wrong because installing a rootkit is a method for maintaining persistent access and hiding files/processes, not for erasing existing logs or evidence; it does not clear the Security event log and may itself be detected by advanced anti-rootkit tools. Option D is wrong because changing the administrator password does not delete any logged events; it only prevents the original administrator from logging in, but the Security log still contains records of the attacker's previous actions.

Practice this question →
46
MCQhard

During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?

A.Perform an SMTP VRFY attack to enumerate users
B.Exploit the SUID binary to execute commands as root
C.Use enum4linux to enumerate SMB shares
D.Run 'sudo -l' to list sudo privileges
AnswerB

Exploiting a vulnerable SUID binary is a direct privilege escalation vector.

Why this answer

The SUID binary owned by root runs with root privileges regardless of the user executing it. Exploiting a vulnerable SUID binary (e.g., via command injection, buffer overflow, or misconfigured capabilities) allows the low-privileged user to execute arbitrary commands as root, directly escalating privileges. This is the most effective method because it leverages a known privilege escalation vector specific to Linux SUID binaries.

Exam trap

The trap here is that candidates confuse enumeration techniques (SMTP VRFY, enum4linux) or standard sudo checks with direct privilege escalation methods, overlooking the immediate root-level access provided by exploiting a vulnerable SUID binary.

How to eliminate wrong answers

Option A is wrong because SMTP VRFY is an email user enumeration technique used against SMTP servers (RFC 2821), not a method to escalate privileges on a Linux server. Option C is wrong because enum4linux is a tool for enumerating SMB shares and user information from Windows systems (via SMB/CIFS), not applicable to a Linux target without Samba services. Option D is wrong because 'sudo -l' lists sudo privileges for the current user, but the question states the user is low-privileged and does not mention any sudo access; relying on sudo is ineffective if the user has no sudo entries.

Practice this question →
47
MCQmedium

A penetration tester discovers a Linux server with the SUID bit set on the 'find' command. How could this be exploited for privilege escalation?

A.By using 'find' to delete log files
B.By using 'find' to search for files owned by root
C.By using 'find' to mount a remote share
D.By running 'find / -exec /bin/sh \;' to spawn a root shell
AnswerD

If find has SUID root, the -exec option runs commands with root privileges, spawning a root shell.

Why this answer

When the SUID bit is set on the 'find' command, it executes with the privileges of the file owner (typically root). The '-exec' option allows arbitrary command execution. Running 'find / -exec /bin/sh \;' spawns a shell with root privileges, enabling full system compromise.

Exam trap

The trap here is that candidates may think SUID only applies to obvious binaries like 'passwd' or 'sudo', but CEH tests the lesser-known fact that any binary with SUID and command execution capability (like 'find' with '-exec') can be exploited for privilege escalation.

How to eliminate wrong answers

Option A is wrong because deleting log files does not leverage the SUID bit for privilege escalation; it only removes audit trails and does not grant elevated privileges. Option B is wrong because searching for files owned by root is a normal operation that does not exploit the SUID bit to gain a root shell. Option C is wrong because 'find' does not have built-in functionality to mount remote shares; mounting requires the 'mount' command or similar utilities, and the SUID bit on 'find' does not enable network filesystem mounting.

Practice this question →
48
MCQhard

During a penetration test, an analyst uses enum4linux with the -a flag against a target. Which of the following is the MOST comprehensive set of information that can be obtained?

A.Only the domain admins and local admins
B.User list, share list, OS information, password policy, and group memberships
C.Only the SMB shares and open sessions
D.Only the NetBIOS name table
AnswerB

The '-a' (all) option in enum4linux is specifically designed to perform a full suite of enumeration functions against a target Windows or Samba system. This includes gathering a detailed user list, available SMB share names, operating system version information, the configured password policy, and comprehensive group memberships for identified users and groups. This comprehensive output provides critical intelligence for subsequent penetration testing phases.

Why this answer

enum4linux with the -a flag performs a comprehensive enumeration against a target, leveraging SMB, RPC, and NetBIOS over TCP/IP. It retrieves user lists, share lists, OS information, password policy details, and group memberships by querying the remote Windows system via SMB RPC calls (e.g., SAMR, LSA, SRVSVC). This makes it the most complete set of information obtainable from a single command, as the -a flag essentially runs all available enumeration modules.

Exam trap

The trap here is that candidates often assume enum4linux -a only retrieves shares or NetBIOS data, underestimating its full scope of SMB/RPC-based enumeration that includes users, groups, OS details, and password policy.

How to eliminate wrong answers

Option A is wrong because enum4linux -a retrieves far more than just domain admins and local admins; it enumerates all users, groups, shares, OS details, and password policy, not just administrative accounts. Option C is wrong because enum4linux -a does not limit itself to SMB shares and open sessions; it also retrieves user lists, OS information, password policy, and group memberships, making this option incomplete. Option D is wrong because enum4linux -a goes well beyond the NetBIOS name table; it performs deep SMB and RPC enumeration, including user and share enumeration, which is not captured by NetBIOS alone.

Practice this question →
49
MCQeasy

Which password cracking technique involves trying every possible combination of characters until the correct password is found?

A.Rainbow table attack
B.Dictionary attack
C.Brute force attack
D.Hybrid attack
AnswerC

A brute force attack is a systematic password cracking technique that attempts every possible character combination within a defined character set and length until the correct password is found. This method guarantees finding the password if given enough time and computational resources, as it exhaustively explores the entire search space. Its primary drawback is the immense computational power and time required, especially for longer and more complex passwords.

Why this answer

A brute force attack systematically tries every possible combination of characters from a defined character set (e.g., lowercase, uppercase, digits, special symbols) until the correct password is found. This method guarantees eventual success but is computationally expensive and time-consuming, especially for long or complex passwords. It is the most exhaustive form of password cracking, as it does not rely on any precomputed data or wordlists.

Exam trap

The trap here is that candidates often confuse 'brute force' with 'dictionary attack' because both involve guessing passwords, but the key distinction is that brute force exhaustively tries all combinations while dictionary attacks rely on a precompiled list of likely passwords.

How to eliminate wrong answers

Option A is wrong because a rainbow table attack uses precomputed hash chains to reverse cryptographic hash functions, not by trying every possible character combination. Option B is wrong because a dictionary attack uses a predefined list of likely passwords (e.g., common words, leaked passwords) rather than exhaustive character-by-character guessing. Option D is wrong because a hybrid attack combines dictionary words with common mutations (e.g., appending numbers or symbols) but does not attempt every possible combination of characters.

Practice this question →
50
MCQhard

An analyst detects an SMB enumeration attempt in network logs. Which of the following tools would MOST likely generate such traffic?

A.nmap -sT 192.168.1.1
B.enum4linux 192.168.1.1
C.snmpwalk -v 2c 192.168.1.1
D.ldapsearch -h 192.168.1.1
AnswerB

`enum4linux` is a wrapper script designed specifically for enumerating information from Windows and Samba hosts via NetBIOS and SMB. It leverages underlying tools like `rpcclient`, `net`, and `nmblookup` to extract a wide array of details. This includes user lists, group memberships, share names, password policies, and operating system information, making it highly effective for comprehensive SMB enumeration attempts.

Why this answer

enum4linux is a tool specifically designed to enumerate SMB (Server Message Block) shares, users, and other information from Windows systems using the SMB protocol. The analyst detected SMB enumeration traffic, which is exactly what enum4linux generates by querying NetBIOS and SMB services (ports 139 and 445).

Exam trap

The trap here is that candidates may confuse tools that scan ports (nmap) with tools that perform protocol-specific enumeration, leading them to choose nmap because it is a common scanning tool, but it does not generate SMB enumeration traffic itself.

How to eliminate wrong answers

Option A is wrong because nmap -sT performs a TCP connect scan, which can detect open ports but does not perform SMB enumeration; it only checks if ports are open, not extracting SMB-specific data. Option C is wrong because snmpwalk queries SNMP (Simple Network Management Protocol) on UDP ports 161/162, not SMB, and is used for retrieving MIB data from network devices. Option D is wrong because ldapsearch queries LDAP (Lightweight Directory Access Protocol) on TCP port 389, which is used for directory services like Active Directory, not for SMB enumeration.

Practice this question →
51
MCQeasy

In the context of system hacking methodology (CHPSET), which phase involves removing evidence of the attacker's activities from logs and system files?

A.Spying
B.Privilege escalation
C.Erasing tracks
D.Cracking passwords
AnswerC

Erasing tracks is the crucial final phase in the system hacking methodology, where an attacker meticulously removes all forensic evidence of their presence and activities from a compromised system. This involves clearing system logs, modifying file timestamps, deleting malicious tools, and altering audit trails to prevent detection by security analysts and incident responders. The objective is to maintain persistence and avoid attribution, making it appear as if no intrusion occurred.

Why this answer

In the CEH system hacking methodology (CHPSET), the 'Erasing tracks' phase is specifically defined as the step where attackers remove evidence of their activities, such as clearing logs, modifying timestamps, or deleting system files. This ensures that intrusion detection systems or system administrators cannot trace the attack back to the source.

Exam trap

The trap here is that candidates confuse 'Erasing tracks' with 'Privilege escalation' because both involve post-exploitation actions, but the key distinction is that erasing tracks is solely about covering forensic evidence, not gaining higher privileges.

How to eliminate wrong answers

Option A is wrong because 'Spying' is not a phase in the CHPSET methodology; it is a generic term for surveillance and does not involve log or file manipulation. Option B is wrong because 'Privilege escalation' is the phase focused on gaining higher-level access (e.g., root or Administrator) after initial compromise, not on removing evidence. Option D is wrong because 'Cracking passwords' is part of the initial access or privilege escalation phases, where attackers obtain credentials, not a phase dedicated to covering tracks.

Practice this question →
52
MCQhard

An attacker has compromised a Linux machine and wants to hide a rootkit by replacing system binaries with trojaned versions. Which technique is being used to maintain persistent access while evading detection?

A.Log manipulation
B.Token impersonation
C.Steganography
D.Rootkit installation via binary replacement
AnswerD

Rootkit installation via binary replacement is a common and effective method for an attacker to maintain persistent access and hide their activities on a compromised Linux system. This technique involves replacing legitimate system binaries (e.g., `ls`, `ps`, `netstat`, `login`) with trojanized versions that execute their original function while simultaneously concealing malicious files, processes, or network connections. By subverting core system utilities, the rootkit can manipulate what the operating system reports, effectively making the attacker's presence invisible to standard monitoring tools.

Why this answer

Replacing system binaries (e.g., `ls`, `ps`, `netstat`) with trojaned versions is a classic rootkit technique. The rootkit intercepts system calls or filters output to hide its own processes, files, and network connections, allowing the attacker to maintain persistent access while evading detection by standard administrative tools.

Exam trap

EC-CEH often tests the distinction between hiding a rootkit (binary replacement) and covering tracks (log manipulation), causing candidates to confuse post-exploitation cleanup with the rootkit's evasion mechanism.

How to eliminate wrong answers

Option A is wrong because log manipulation (e.g., clearing `/var/log/auth.log`) covers tracks after an intrusion but does not involve replacing system binaries to hide a rootkit; it is a separate post-exploitation step. Option B is wrong because token impersonation is a Windows-specific privilege escalation technique (e.g., using `SeImpersonatePrivilege` to impersonate a user token) and does not apply to hiding rootkits on Linux via binary replacement. Option C is wrong because steganography hides data within other files (e.g., images or audio) for covert communication, not for replacing system binaries to maintain persistent access.

Practice this question →
53
MCQmedium

During a penetration test, an analyst obtains a dump of password hashes from a Windows server. The hashes are in LM:NT format. The analyst wants to crack the NT portion using a brute-force attack on 8-character alphanumeric passwords. Which tool is BEST suited for this task?

A.Hashcat
B.John the Ripper
C.RainbowCrack
D.Ophcrack
AnswerA

Hashcat is the industry-standard password recovery tool, renowned for its unparalleled speed and efficiency in cracking various hash types, including NTLM, through highly optimized GPU-accelerated brute-force and dictionary attacks. Its ability to leverage modern graphics cards allows it to test billions of password candidates per second, making it the most effective choice for rapidly cracking password dumps obtained during a penetration test.

Why this answer

Hashcat is the best tool for this task because it is optimized for high-speed GPU-accelerated brute-force attacks, making it ideal for cracking 8-character alphanumeric NT hashes. It supports the LM:NT format natively and allows precise control over attack modes, including brute-force with custom character sets, which is essential for exhaustive enumeration of 62^8 possibilities.

Exam trap

CEH often tests the misconception that RainbowCrack or Ophcrack are suitable for brute-force attacks, when in fact they are primarily rainbow table tools, not brute-force engines, and are ineffective for exhaustive search without precomputed tables.

How to eliminate wrong answers

Option B (John the Ripper) is wrong because, while it can crack NT hashes, its brute-force performance is significantly slower than Hashcat on modern GPUs, and it lacks the same level of GPU optimization for high-speed attacks. Option C (RainbowCrack) is wrong because it relies on precomputed rainbow tables, not brute-force; it is designed for fast lookup attacks but cannot perform exhaustive brute-force on 8-character alphanumeric passwords without precomputed tables. Option D (Ophcrack) is wrong because it specializes in cracking LM hashes using rainbow tables, not NT hashes, and its brute-force capability is extremely limited and not suited for 8-character alphanumeric passwords.

Practice this question →
54
MCQeasy

Which of the following tools is used to crack Windows LAN Manager (LM) and NTLM password hashes using rainbow tables?

A.Ophcrack
B.Hashcat
C.John the Ripper
D.Hydra
AnswerA

Ophcrack is a specialized, open-source password cracker specifically designed for Windows LM and NTLM hashes, making it the correct tool for this task. It excels by employing precomputed rainbow tables, which are large datasets of hash chains, to quickly reverse the hashing process for these particular Windows authentication hashes. This method significantly reduces the time required to find the original password compared to traditional brute-force attacks, especially for weaker LM hashes.

Why this answer

Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It is optimized for Windows password hashes and provides an efficient time-memory trade-off by looking up hashes in sorted tables.

Exam trap

EC-Council often tests the distinction between tools specialized for Windows hashes (Ophcrack) versus general-purpose rainbow table tools (RainbowCrack), leading candidates to confuse the two.

How to eliminate wrong answers

Option B (Hashcat) is wrong because it is a GPU-accelerated password recovery tool that uses brute-force, dictionary, or rule-based attacks, not precomputed rainbow tables. Option C (John the Ripper) is wrong because it is a general-purpose password cracker that relies on CPU-based attacks and does not natively use rainbow tables for LM/NTLM hashes. Option D (Hydra) is wrong because it is a network authentication brute-forcing tool for protocols like SSH, FTP, and HTTP, not a hash-cracking tool.

Practice this question →
55
MCQeasy

Which of the following tools is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?

A.Hashcat
B.RainbowCrack
C.John the Ripper
D.Ophcrack
AnswerD

Ophcrack is a dedicated and highly effective password cracker specifically designed to recover Windows LM and NTLM hashes by leveraging precomputed rainbow tables. It comes with pre-generated tables optimized for these hash types, allowing for very fast lookups and password recovery, even from live systems or SAM files. Its primary strength lies in its specialized focus and efficient implementation of rainbow table technology for Windows authentication credentials.

Why this answer

Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted task.

Exam trap

The trap here is that candidates often confuse RainbowCrack (a generic rainbow table tool) with Ophcrack (which is specifically designed for Windows LM/NTLM hashes), leading them to select RainbowCrack despite Ophcrack being the correct answer due to its Windows-specific focus.

How to eliminate wrong answers

Option A is wrong because Hashcat is a general-purpose password recovery tool that uses GPU acceleration and supports many hash types, but it is not specifically designed for rainbow table attacks; it primarily uses brute-force, dictionary, and rule-based attacks. Option B is wrong because RainbowCrack is a generic rainbow table implementation that can crack various hash types, but it is not specifically tailored to Windows LM/NTLM hashes and lacks the integrated Windows-focused features of Ophcrack. Option C is wrong because John the Ripper is a versatile password cracking tool that supports many hash formats, but it does not natively use rainbow tables; its primary methods are dictionary and brute-force attacks.

Practice this question →
56
Multi-Selectmedium

Which TWO techniques are commonly used for privilege escalation on Linux systems? (Select two.)

Select 2 answers
A.Kernel exploits
B.SUID/GUID abuse
C.Token impersonation
D.DLL hijacking
E.Pass-the-hash
AnswersA, B

Exploiting kernel vulnerabilities to gain root.

Why this answer

Kernel exploits (A) are a common privilege escalation technique on Linux because they target vulnerabilities in the kernel itself, allowing an attacker to execute arbitrary code with root privileges. By exploiting flaws such as buffer overflows or race conditions in kernel modules, an attacker can elevate from a low-privileged user to full root access. This is a classic method because the kernel runs with the highest system privileges, and a successful exploit bypasses all user-level security controls.

Exam trap

EC-Council often tests the distinction between Windows-specific and Linux-specific privilege escalation techniques, and the trap here is that candidates may confuse token impersonation or pass-the-hash as cross-platform methods, when they are strictly tied to Windows authentication and security models.

Practice this question →
57
Multi-Selecteasy

Which THREE of the following are password cracking techniques? (Select 3)

Select 3 answers
A.Dictionary attack
B.Brute-force attack
C.Phishing
D.Steganography
E.Rainbow table attack
AnswersA, B, E

Uses a wordlist to guess passwords.

Why this answer

A dictionary attack is a password cracking technique where an attacker uses a precompiled list of likely passwords (a dictionary file) to attempt authentication against a target system. It relies on the fact that many users choose common words or phrases as passwords, making it effective against weak passwords but ineffective against strong, random ones.

Exam trap

The trap here is that candidates may confuse password cracking techniques with broader attack categories like social engineering (phishing) or data hiding (steganography), which are distinct concepts in the CEH exam's enumeration and system hacking domain.

Practice this question →
58
MCQhard

An attacker successfully escalates privileges on a Windows server using a known vulnerability in the Print Spooler service (PrintNightmare). Which type of privilege escalation does this represent?

A.Local exploit in a service
B.DLL hijacking
C.SUID abuse
D.Token impersonation
AnswerA

A local exploit in a service directly targets vulnerabilities within a running Windows service, such as the Print Spooler. These services often operate with elevated privileges, like SYSTEM, and a successful exploit can allow an attacker to execute arbitrary code with those higher permissions. This method directly leverages a flaw in the service's code or configuration to escalate privileges from a low-privileged user account. PrintNightmare is a prime example, exploiting a vulnerability in the Print Spooler service to achieve SYSTEM-level access.

Why this answer

The PrintNightmare vulnerability (CVE-2021-34527) allows an attacker to execute arbitrary code with SYSTEM privileges via the Windows Print Spooler service. Since the attacker exploits a vulnerability in a running service (spoolsv.exe) to elevate from a lower-privileged user to SYSTEM, this is a classic local exploit in a service. The attack does not involve hijacking DLLs, abusing SUID bits (a Unix concept), or impersonating tokens, making option A the correct classification.

Exam trap

The trap here is that candidates confuse 'service exploitation' with 'token impersonation' because both can achieve SYSTEM privileges, but PrintNightmare is specifically a service-level exploit, not a token manipulation attack.

How to eliminate wrong answers

Option B (DLL hijacking) is wrong because PrintNightmare exploits a vulnerability in the Print Spooler service itself, not by placing a malicious DLL in a path that the service loads. Option C (SUID abuse) is wrong because SUID is a Unix/Linux permission mechanism, not applicable to Windows privilege escalation. Option D (Token impersonation) is wrong because while token manipulation can be used in some privilege escalation techniques, PrintNightmare directly exploits a service vulnerability to gain SYSTEM access, not by stealing or impersonating an existing token.

Practice this question →
59
MCQmedium

An ethical hacker needs to crack a set of NTLM hashes obtained from a Windows system. Which tool would be MOST efficient for performing a dictionary attack with hybrid rules?

A.John the Ripper
B.Hashcat
C.Ophcrack
D.RainbowCrack
AnswerB

Hashcat is the industry-standard password recovery tool, highly optimized for cracking NTLM hashes due to its unparalleled support for GPU acceleration. It efficiently leverages modern graphics cards to perform millions of guesses per second, significantly reducing cracking time. Furthermore, Hashcat offers a wide array of attack modes, including dictionary, brute-force, mask, and sophisticated hybrid attacks, making it exceptionally versatile and fast for obtaining NTLM hashes.

Why this answer

Hashcat is the most efficient tool for performing a dictionary attack with hybrid rules because it is GPU-accelerated, supports the NTLM hash mode (1000), and allows the application of rule-based mutations (e.g., appending digits or special characters) directly to dictionary words. Its speed and flexibility in handling large wordlists with complex rule sets make it superior for cracking NTLM hashes in a professional penetration test.

Exam trap

EC-Council often tests the misconception that John the Ripper is the best all-around password cracker, but for GPU-accelerated hybrid dictionary attacks on NTLM hashes, Hashcat is the industry standard due to its speed and rule engine.

How to eliminate wrong answers

Option A is wrong because John the Ripper, while capable of dictionary and hybrid attacks, is primarily CPU-based and significantly slower than Hashcat for large-scale NTLM cracking, making it less efficient for this specific task. Option C is wrong because Ophcrack is designed specifically for LM and NTLM hashes using rainbow tables, not for dictionary attacks with hybrid rules; it lacks rule-based mutation capabilities. Option D is wrong because RainbowCrack is a tool for precomputed rainbow table attacks, not for dictionary attacks with hybrid rules; it requires tables to be generated beforehand and cannot apply real-time rule mutations.

Practice this question →
60
MCQmedium

A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?

A.Perform an SNMP walk to enumerate the remote host's MIB
B.Execute a dictionary attack against the remote host's passwords
C.Enumerate all SMB shares on the remote host
D.Perform a NetBIOS name table lookup of the remote host
AnswerD

The `nbtstat -a <IP_address>` (or `-A`) command is precisely used to perform a NetBIOS name table lookup of a remote host. This command queries the specified IP address for its registered NetBIOS names, which can reveal crucial information such as the computer's hostname, workgroup or domain membership, and potentially the username of the currently logged-on user, aiding in initial reconnaissance.

Why this answer

The command 'nbtstat -A' performs a NetBIOS name table lookup against a remote host using its IP address. It queries the NetBIOS over TCP/IP (NBT) service on UDP port 137 to retrieve the remote machine's NetBIOS name table, which includes the computer name and logged-in user. This is a standard enumeration technique to gather information about Windows hosts on a local network.

Exam trap

The trap here is that candidates confuse the 'nbtstat' command with SMB enumeration tools, but 'nbtstat' only reveals NetBIOS names and logged-in users, not shares or passwords.

How to eliminate wrong answers

Option A is wrong because an SNMP walk uses tools like 'snmpwalk' to query a device's MIB via SNMP (UDP 161), not the 'nbtstat' command which operates over NetBIOS. Option B is wrong because 'nbtstat' does not perform any authentication attempts or password cracking; it only reads the NetBIOS name table passively. Option C is wrong because enumerating SMB shares requires tools like 'net view' or 'smbclient' that interact with the SMB protocol (TCP 445), whereas 'nbtstat' only retrieves NetBIOS names and does not list shares.

Practice this question →
61
MCQhard

After compromising a Windows system, an attacker wants to cover tracks by deleting event logs. Which command would achieve this?

A.wevtutil cl Security
B.del *.log
C.rm -rf /var/log/*
D.clear-eventlog -Log Security
AnswerA

wevtutil cl clears the specified event log.

Why this answer

The wevtutil cl Security command clears the Windows Security event log, which is a standard method for an attacker to cover tracks by removing evidence of their activities. This command is built into Windows and can be executed from the command line with administrative privileges, making it a direct and effective way to delete event logs without relying on external tools.

Exam trap

The trap here is that candidates may confuse the Windows command wevtutil with the Linux command rm -rf or the PowerShell cmdlet Clear-EventLog, assuming any log-clearing command works across platforms, but the CEH exam tests knowledge of OS-specific utilities.

How to eliminate wrong answers

Option B (del *.log) is wrong because it attempts to delete files with a .log extension, but Windows event logs are stored in a proprietary format (Evtx files) in the C:\Windows\System32\winevt\Logs directory, not as simple .log files; this command would not target the correct files and would likely fail due to permissions. Option C (rm -rf /var/log/*) is wrong because it is a Linux/Unix command for removing logs from /var/log, which does not exist on a Windows system; this reflects a confusion between operating systems. Option D (clear-eventlog -Log Security) is wrong because it is a PowerShell cmdlet, not a native command-line tool, and while it can clear logs, the question asks for a command that would achieve this, and wevtutil is the more direct and commonly used utility in CEH contexts; however, the primary reason it is incorrect here is that the correct answer is A, and D is not the standard command for this purpose in exam scenarios.

Practice this question →
62
MCQhard

A forensic analyst finds a system where the user's password hash was obtained and cracked offline. The attacker then used stolen credentials to log in and run `wevtutil cl system`. What is the purpose of this command?

A.Remove scheduled tasks
B.Delete the SAM database
C.Disable Windows Defender
D.Clear the System event log
AnswerD

Clearing the System event log is a common anti-forensic technique used by attackers to remove traces of their activity. While specific password change events are typically found in the Security event log, the System log records critical operational events, errors, and warnings that could indirectly indicate system tampering or actions taken during an intrusion. Erasing this log directly removes a significant source of forensic evidence.

Why this answer

The `wevtutil cl system` command clears the System event log on Windows. After cracking the user's password hash offline, the attacker logs in with stolen credentials and runs this command to erase forensic evidence of their activities, such as logon events or service failures, from the System log. This is a common post-exploitation step to hinder incident response.

Exam trap

The trap here is that candidates may confuse `wevtutil cl system` with commands that delete system files or disable security features, but it specifically targets event logs, which is a key anti-forensics technique tested in the CEH exam.

How to eliminate wrong answers

Option A is wrong because `wevtutil cl system` does not affect scheduled tasks; scheduled tasks are managed with `schtasks` or `Task Scheduler`, and clearing event logs does not remove them. Option B is wrong because deleting the SAM database requires different commands (e.g., `del C:\Windows\System32\config\SAM` or using tools like `pwdump`), and `wevtutil` only operates on event logs. Option C is wrong because disabling Windows Defender is done via Group Policy, registry changes, or `Set-MpPreference` in PowerShell, not by clearing event logs.

Practice this question →
63
MCQmedium

A security analyst suspects an attacker has replaced system binaries with a rootkit to hide malicious processes. Which covering tracks technique is the attacker using?

A.Timestomping
B.Steganography
C.Rootkit installation
D.Log manipulation
AnswerC

Rootkits often replace system binaries to conceal their presence.

Why this answer

The attacker is using rootkit installation to replace system binaries (e.g., ps, ls, netstat) with trojaned versions that filter out malicious processes from system calls like readdir() or /proc listings. This is a classic covering tracks technique because the rootkit hides evidence of compromise by intercepting and modifying kernel or user-space output, making the attacker's activities invisible to standard monitoring tools.

Exam trap

EC-Council often tests the distinction between 'rootkit installation' as a covering tracks technique and 'log manipulation' as a separate method, trapping candidates who confuse hiding processes (rootkit) with hiding log entries (log manipulation).

How to eliminate wrong answers

Option A is wrong because timestomping is a technique to alter file timestamps (e.g., using touch -t or SetFileTime) to hide when files were created or modified, not to replace binaries or hide processes. Option B is wrong because steganography hides data within other media (e.g., images, audio) for covert communication, not for replacing system binaries to conceal processes. Option D is wrong because log manipulation involves deleting, modifying, or clearing log entries (e.g., using /var/log/messages or event log clearing) to remove evidence of intrusion, but it does not involve replacing system binaries to hide running processes.

Practice this question →
64
MCQeasy

Which of the following is a passive OS fingerprinting technique?

A.Using nmap -O
B.Performing a ping sweep
C.Sending SYN packets and analyzing responses
D.Capturing packets and analyzing TTL values
AnswerD

Capturing packets and analyzing TTL values is a classic passive OS fingerprinting technique because it involves observing existing network traffic without sending any new packets to the target system. By passively sniffing packets that the target has already transmitted as part of its normal communication, an analyst can examine the Time-To-Live (TTL) field in the IP header. Different operating systems initialize TTL to distinct default values (e.g., 64, 128, 255), allowing for OS identification without any direct interaction or traffic generation.

Why this answer

Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Exam trap

The trap here is that candidates confuse 'passive' with 'stealthy' scanning, often picking nmap -O with stealth flags (e.g., -sS) as passive, but any active packet injection, regardless of stealth, constitutes active fingerprinting.

How to eliminate wrong answers

Option A is wrong because nmap -O actively sends a series of probes (e.g., TCP SYN, ICMP echo) to the target and analyzes responses to determine the OS, which is active fingerprinting. Option B is wrong because a ping sweep sends ICMP Echo Request packets to multiple hosts to check liveness, which is an active scanning technique that generates traffic. Option C is wrong because sending SYN packets and analyzing responses (e.g., SYN/ACK vs RST) is the basis of active TCP stack fingerprinting, as it requires injecting packets into the network.

Practice this question →
65
MCQeasy

Which of the following tools is specifically designed to enumerate SMB shares and user information from Windows systems using the SMB protocol?

A.snmpwalk
B.nmap
C.enum4linux
D.hping3
AnswerC

enum4linux is a highly effective tool specifically designed for enumerating information from Windows and Samba hosts. It acts as a wrapper script, consolidating the functionality of various underlying utilities such as smbclient, rpcclient, and net to extract a wide array of details. This includes user lists, group memberships, share names, password policies, and even operating system information, making it an indispensable resource for comprehensive Server Message Block (SMB) enumeration during penetration tests.

Why this answer

enum4linux is a tool specifically designed to enumerate SMB shares, user lists, OS information, and other details from Windows systems by leveraging the SMB protocol (typically over TCP/445 or TCP/139). It automates queries using SMB RPC calls, such as those from the `samr` and `lsarpc` pipes, making it the correct choice for targeted SMB enumeration.

Exam trap

The trap here is that candidates confuse nmap's broad scanning capabilities (including SMB scripts) with a tool that is purpose-built for SMB enumeration, leading them to select nmap instead of enum4linux.

How to eliminate wrong answers

Option A is wrong because snmpwalk is an SNMP enumeration tool that queries MIB data over UDP/161, not SMB shares or user information. Option B is wrong because nmap is a general-purpose port scanner and service detection tool; while it can detect open SMB ports and perform basic SMB script scans (e.g., smb-os-discovery), it is not specifically designed for deep SMB share and user enumeration like enum4linux. Option D is wrong because hping3 is a packet crafting and network stress testing tool that manipulates TCP/IP packets (e.g., for firewall testing or DoS), and it has no capability to enumerate SMB shares or user accounts.

Practice this question →
66
MCQeasy

A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?

A.NetBIOS names and their associated service types
B.SMB share lists and open sessions
C.DNS records for the host and domain
D.ARP cache entries for the subnet
AnswerA

The `nbtstat -A` (or `-a`) command is specifically designed to query a remote host's NetBIOS name table, displaying the NetBIOS names registered by that host. Each NetBIOS name is 16 characters long, with the 16th character (the suffix) indicating the service or application type associated with that name, such as `<20>` for a file server or `<00>` for a workstation service. This allows an analyst to identify active NetBIOS services on the target IP address, providing crucial reconnaissance information.

Why this answer

The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.

Exam trap

The trap here is that candidates confuse `nbtstat -A` with commands that enumerate SMB shares or DNS records, but the key differentiator is the NetBIOS name table output with hex suffixes that explicitly indicate service types.

How to eliminate wrong answers

Option B is wrong because `nbtstat -A` does not list SMB share names or open sessions; those are obtained with commands like `net view` or `smbclient -L`. Option C is wrong because DNS records are queried via `nslookup` or `dig`, not through NetBIOS name resolution, which operates at a different layer (NetBIOS over TCP/IP, port 137). Option D is wrong because ARP cache entries are displayed with `arp -a`, not `nbtstat`, which deals with NetBIOS name tables, not MAC-to-IP mappings.

Practice this question →
67
MCQmedium

A security analyst captures the following SMTP conversation: 220 mail.example.com ESMTP; HELO client; 250 Hello; VRFY root; 250 Super-User; VRFY admin; 252 Cannot VRFY user; VRFY user1; 550 User unknown. Which attack is the analyst performing?

A.SMTP header injection
B.SMTP open relay testing
C.SMTP user enumeration via VRFY
D.SMTP DDoS attack
AnswerC

SMTP user enumeration via VRFY is a technique where an attacker uses the VRFY (verify) command to query the mail server for the existence of specific usernames. A successful VRFY command typically elicits a "250 OK" response along with the full name or email address of the user if the account exists, whereas an invalid user often results in a "550 No such user" or similar error. This differential response allows an attacker to systematically build a list of valid user accounts on the system, which can then be used for further attacks like brute-forcing or phishing.

Why this answer

The analyst is using the SMTP VRFY command to check if specific usernames (root, admin, user1) exist on the mail server. The responses '250 Super-User' and '252 Cannot VRFY user' confirm valid usernames, while '550 User unknown' indicates an invalid one. This is a classic SMTP user enumeration technique, often used in the reconnaissance phase to gather valid account names for further attacks like password guessing or phishing.

Exam trap

The trap here is that candidates may confuse VRFY enumeration with SMTP open relay testing, but open relay checks the server's willingness to forward mail for arbitrary domains, not the validity of local user accounts.

How to eliminate wrong answers

Option A is wrong because SMTP header injection involves inserting malicious headers into email messages (e.g., via CRLF injection in the DATA or MAIL FROM command), not using VRFY to probe for user existence. Option B is wrong because SMTP open relay testing checks if the server forwards emails from unauthorized sources (e.g., by sending a test email to an external domain), not by querying user accounts with VRFY. Option D is wrong because a DDoS attack aims to overwhelm the server with traffic (e.g., flooding with connections or messages), not by sending a few VRFY commands to enumerate users.

Practice this question →
68
MCQmedium

An attacker uses a tool that precomputes hash chains for common passwords to crack password hashes quickly. Which technique is the attacker employing?

A.Dictionary attack
B.Brute-force attack
C.Hybrid attack
D.Rainbow table attack
AnswerD

A rainbow table attack leverages large, precomputed tables containing hash chains generated using a specialized reduction function. These tables map hashes back to their original plaintext values by performing a lookup rather than real-time computation. When a target hash is found within the table, the corresponding chain is traversed to recover the original password, making it highly efficient for cracking hashes quickly without needing to recompute every possible password combination.

Why this answer

Rainbow table attack. This technique involves precomputing hash chains for common passwords and storing them in a table, allowing the attacker to reverse password hashes quickly by looking up the hash in the table rather than computing hashes on the fly. The tool described matches the core concept of a rainbow table, which uses a time-memory trade-off to crack hashes efficiently.

Exam trap

The trap here is that candidates confuse a rainbow table attack with a dictionary attack, because both involve lists of passwords, but the key distinction is precomputation versus real-time hashing.

How to eliminate wrong answers

Option A is wrong because a dictionary attack uses a list of plaintext passwords, hashing each one and comparing to the target hash in real time, not precomputed hash chains. Option B is wrong because a brute-force attack tries every possible combination of characters sequentially, without any precomputation or stored hash chains. Option C is wrong because a hybrid attack combines dictionary words with variations (e.g., appending numbers or symbols), but it still computes hashes on the fly rather than relying on precomputed chains.

Practice this question →
69
Multi-Selectmedium

During a penetration test, a tester runs enum4linux against a Windows server and receives the following output: 'S-1-5-21-3623811015-3361044348-30300820-500' and 'S-1-5-21-3623811015-3361044348-30300820-501'. Which TWO conclusions can be drawn from this output?

Select 2 answers
A.The Guest account is enabled
B.The Guest account SID was enumerated
C.The Administrator account SID was enumerated
D.The server is a domain controller
E.Password policy was retrieved
AnswersB, C

The enumeration of the Guest account SID is directly evidenced by the enum4linux output showing a Security Identifier (SID) ending with the Relative Identifier (RID) 501. RID 501 is a well-known, universal identifier for the Guest account on Windows systems. Successfully retrieving this specific SID confirms that the penetration tester has identified the unique identifier for the Guest account on the target machine, a key piece of reconnaissance information.

Why this answer

The SID ending in -500 is the well-known RID for the built-in Administrator account, and the SID ending in -501 is the RID for the built-in Guest account. Enum4linux enumerates user SIDs from the SAM database via SMB null sessions, confirming that both the Administrator and Guest account SIDs were retrieved. Therefore, options B and C are correct.

Exam trap

The trap here is that candidates assume the Guest account is enabled simply because its SID is listed, but enumeration only proves existence, not account status.

Practice this question →
70
MCQhard

A security team has collected a hash file from a compromised Windows server that contains NTLM hashes. They want to crack the passwords as quickly as possible using a precomputed lookup table. Which tool and technique combination is BEST suited for this task?

A.Use John the Ripper in incremental mode
B.Use Hydra with a dictionary of common passwords
C.Use RainbowCrack with precomputed rainbow tables
D.Use Hashcat with a rules-based attack
AnswerC

RainbowCrack is specifically engineered to utilize precomputed rainbow tables for rapid offline hash cracking. This technique capitalizes on a significant time-memory trade-off, where extensive upfront computation generates large tables that allow for near-instantaneous reversal of hashes back to their plaintext passwords. This makes it an exceptionally efficient method for processing large volumes of captured hashes, often yielding results in mere seconds.

Why this answer

RainbowCrack is specifically designed for fast password cracking using precomputed rainbow tables, which are lookup tables that store hash chains for rapid reversal of hashes. Since the team already has NTLM hashes and wants the quickest method, RainbowCrack with precomputed tables avoids the computational overhead of real-time hashing, making it the best fit for this scenario.

Exam trap

EC-Council often tests the distinction between offline hash cracking (RainbowCrack, Hashcat, John) and online brute-forcing (Hydra), and the trap here is that candidates confuse Hydra's online attack capability with offline hash cracking, or assume Hashcat's rules-based attack is faster than a precomputed lookup table.

How to eliminate wrong answers

Option A is wrong because John the Ripper in incremental mode performs brute-force or mask attacks in real time, which is slower than using precomputed tables for already-collected hashes. Option B is wrong because Hydra is an online password brute-forcing tool for network services (e.g., SSH, FTP), not for cracking offline hash files. Option D is wrong because Hashcat with a rules-based attack still requires real-time hashing of candidate passwords, which is slower than a precomputed lookup table approach.

Practice this question →
71
MCQmedium

A penetration tester uses the following command to extract the contents of a SAM file: 'samdump2 SYSTEM /mnt/windows/Windows/System32/config/SAM'. What is the primary purpose of this action?

A.To escalate privileges on the system
B.To enumerate users via LDAP
C.To capture NTLM hashes for offline cracking
D.To perform a pass-the-hash attack
AnswerC

This command's primary purpose is to extract NTLM password hashes from a compromised Windows system, typically targeting the Security Account Manager (SAM) database or the Local Security Authority Subsystem Service (LSASS) memory. Once extracted, these hashes can be transferred to an attacker-controlled machine for offline cracking using tools like Hashcat or John the Ripper. Offline cracking allows for brute-force or dictionary attacks without directly interacting with the target system, reducing detection risk and computational burden on the victim.

Why this answer

The `samdump2` tool extracts password hash data from the SAM (Security Account Manager) registry hive file. By providing the SYSTEM hive (which contains the boot key) and the SAM file, the tool decrypts and dumps the NTLM hashes of local user accounts. These hashes can then be used in offline cracking attacks (e.g., with John the Ripper or Hashcat) to recover plaintext passwords, making option C correct.

Exam trap

The trap here is that candidates may confuse the purpose of dumping hashes (offline cracking) with the subsequent attack technique (pass-the-hash), but the question asks for the primary purpose of the `samdump2` command itself, which is hash extraction for cracking, not immediate authentication.

How to eliminate wrong answers

Option A is wrong because `samdump2` does not perform privilege escalation; it simply reads already-obtained files from a compromised system. Option B is wrong because LDAP enumeration is used for querying Active Directory directory services, not for extracting local SAM database hashes. Option D is wrong because pass-the-hash attacks use captured NTLM hashes directly for authentication without cracking them, whereas the primary purpose of dumping hashes with `samdump2` is to obtain them for offline cracking.

Practice this question →
72
Multi-Selectmedium

A security analyst is investigating a compromised Linux system and finds the following: - A binary with SUID bit set owned by root that is not a standard system binary - The file /etc/ld.so.preload contains a reference to a shared object in /tmp - The system logs show gaps of several minutes during peak hours. Which TWO techniques has the attacker MOST likely used to maintain access and evade detection?

Select 2 answers
A.SUID privilege escalation
B.Password cracking
C.Kernel module rootkit
D.LD_PRELOAD rootkit
E.Steganography
AnswersA, D

SUID privilege escalation occurs when a root-owned executable has its SUID bit set, allowing any user to execute it with the effective privileges of the file owner, typically root. Attackers can exploit this by finding or creating such binaries, then using them to spawn a root shell or execute arbitrary commands with elevated privileges. This is a common post-exploitation technique for maintaining root access or escalating from a low-privileged user, making it a highly plausible method for a compromised Linux system.

Why this answer

The SUID bit set on a non-standard binary owned by root allows an attacker to execute that binary with root privileges, providing a persistent privilege escalation mechanism. The reference in /etc/ld.so.preload to a shared object in /tmp indicates an LD_PRELOAD rootkit, which forces the dynamic linker to load a malicious library before all others, enabling hooking of system calls to hide processes, files, or network connections.

Exam trap

EC-Council expects candidates to distinguish between user-space rootkits (like LD_PRELOAD) and kernel-level rootkits (like kernel modules); the trap here is that candidates may confuse the /etc/ld.so.preload mechanism with a kernel module rootkit, but the file path and preload technique are hallmarks of a user-space rootkit, not a kernel module.

Practice this question →
73
MCQmedium

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

A.Spying
B.Executing applications
C.Cracking passwords
D.Erasing tracks
AnswerD

Erasing tracks, also known as anti-forensics or covering one's tracks, is a critical post-exploitation phase where an attacker attempts to remove or alter evidence of their presence and activities on a compromised system. This often involves deleting or modifying system logs, clearing command history, manipulating timestamps, or using secure deletion tools to prevent forensic analysis and maintain stealth. The goal is to avoid detection and hinder incident response efforts by making it difficult to reconstruct the attack chain.

Why this answer

The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

Exam trap

The trap here is confusing 'Erasing tracks' with 'Spying' because both involve post-exploitation actions, but spying focuses on data collection while erasing tracks specifically targets log and evidence removal.

How to eliminate wrong answers

Option A is wrong because 'Spying' refers to passive monitoring or data exfiltration after access is established, not the act of removing forensic evidence. Option B is wrong because 'Executing applications' involves running tools or payloads to achieve objectives like privilege escalation or backdoor installation, not log manipulation. Option C is wrong because 'Cracking passwords' is part of the initial access phase (e.g., brute-forcing or hash cracking) and occurs before successful login, not after the attacker has already authenticated.

Practice this question →
74
MCQhard

An attacker has gained access to a Windows server and wants to crack the password hashes extracted from the SAM file. The attacker knows the passwords are complex but wants to maximize speed. Which tool is BEST suited for high-speed password cracking using GPU acceleration?

A.Ophcrack
B.RainbowCrack
C.John the Ripper
D.Hashcat
AnswerD

Hashcat is universally recognized as the world's fastest and most advanced password recovery utility, meticulously engineered to exploit the massive parallel processing power of modern Graphics Processing Units (GPUs). It supports an extensive and ever-growing list of hash algorithms and attack modes, including dictionary, brute-force, mask, and hybrid attacks, making it exceptionally efficient for high-speed cracking operations. Its highly optimized kernel code and ability to scale across multiple GPUs position it as the premier tool for rapid password hash analysis and recovery.

Why this answer

Hashcat is the correct answer because it is specifically designed for high-speed password cracking using GPU acceleration, leveraging OpenCL or CUDA to offload computation to the GPU. This allows it to achieve millions of hashes per second, making it ideal for cracking complex passwords from SAM hashes (NTLM) when speed is the priority.

Exam trap

The trap here is that candidates often confuse 'rainbow table' tools (Ophcrack, RainbowCrack) with GPU-accelerated crackers, or assume John the Ripper is always the fastest, but Hashcat is the explicit choice for maximum GPU speed in CEH scenarios.

How to eliminate wrong answers

Option A is wrong because Ophcrack uses rainbow tables (precomputed hash chains) and is CPU-based, not GPU-accelerated, so it is slower for complex passwords and less efficient for on-the-fly cracking. Option B is wrong because RainbowCrack also relies on rainbow tables and is primarily CPU-based; while it can use some GPU acceleration in newer versions, it is not optimized for high-speed GPU cracking like Hashcat and requires precomputation time. Option C is wrong because John the Ripper can use GPU acceleration (via its 'john-gpu' variant), but its default mode is CPU-based and it is generally slower and less feature-rich for GPU cracking compared to Hashcat, which is the industry standard for GPU-accelerated password recovery.

Practice this question →
75
MCQmedium

During a penetration test, a tester uses the SMTP VRFY command against a mail server. The server responds with '252 Cannot VRFY user, but will accept message' for most usernames. Which action should the tester take to enumerate valid email addresses more effectively?

A.Use the EXPN command to expand mailing lists and verify addresses
B.Use the NetBIOS nbtstat command to query the mail server
C.Run a brute-force attack on the SMTP service using Hydra
D.Switch to SNMP enumeration to gather email addresses
AnswerA

EXPN can reveal valid addresses from mailing lists; RCPT TO is another alternative.

Why this answer

The SMTP VRFY command is used to verify whether a specific user exists on the mail server. When the server responds with '252 Cannot VRFY user, but will accept message', it indicates that VRFY is disabled or restricted, but the server still supports the EXPN command. EXPN (Expand) reveals the actual members of a mailing list or alias, allowing the tester to enumerate valid email addresses indirectly by querying known or guessed list names.

Exam trap

The trap here is that candidates assume a '252' response to VRFY means the user does not exist, when in fact it indicates VRFY is disabled, and they overlook the EXPN command as an alternative enumeration method.

How to eliminate wrong answers

Option B is wrong because nbtstat is a NetBIOS over TCP/IP command used to query NetBIOS name tables and WINS servers, not SMTP servers; it cannot enumerate email addresses. Option C is wrong because a brute-force attack on SMTP with Hydra would target authentication credentials (e.g., SMTP AUTH), not enumerate valid usernames via VRFY/EXPN; it is also noisy and likely to trigger account lockouts. Option D is wrong because SNMP enumeration can gather system information (e.g., user lists from SNMP MIBs) but is not a direct or effective method for enumerating email addresses from an SMTP server; it requires SNMP to be enabled and accessible.

Practice this question →
Page 1 of 3 · 164 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Enumeration and System Hacking questions.

Start 20-question session