CEH Enumeration and System Hacking Practice Question
During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?
⚠ Common exam trap
A common mix-up: candidates confuse the `ldapsearch` command with other enumeration tools (like `snmpwalk` or `smtp-user-enum`) and fail to recognize that the specific command and output directly indicate LDAP enumeration with plaintext password exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk
The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NFS enumeration; it indicates that NFS shares are world-readable
Why it's wrong here
ldapsearch is a command-line utility specifically designed for querying LDAP directories, not for interacting with Network File System (NFS) shares. It lacks any functionality to enumerate NFS exports or determine their access permissions. NFS enumeration typically involves using tools like `showmount -e <IP>` to list exported shares and then attempting to mount them to check for world-readable access, a process entirely distinct from LDAP queries.
- ✓
LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk
Why this is correct
The `ldapsearch -x -h <host>` command initiates an anonymous or simple authenticated query against an LDAP server. If successful, it enumerates directory attributes. The discovery of plaintext passwords within the returned LDAP attributes signifies a critical security misconfiguration, as sensitive user credentials are directly exposed. This poses a severe risk of credential theft, allowing attackers to reuse these passwords for lateral movement or access to other systems.
- ✗
SNMP enumeration; it indicates that the community string is weak
Why it's wrong here
ldapsearch is exclusively designed for querying Lightweight Directory Access Protocol (LDAP) directories and cannot be used to interact with Simple Network Management Protocol (SNMP) agents. SNMP enumeration relies on tools such as `snmpwalk` or `snmpget` to query Management Information Bases (MIBs) on network devices. These tools attempt to discover or brute-force community strings to gain access to device configuration and status information, a function entirely separate from directory service queries.
- ✗
SMTP enumeration; it indicates that the mail server is misconfigured
Why it's wrong here
ldapsearch is a client for the Lightweight Directory Access Protocol and possesses no capability to communicate with Simple Mail Transfer Protocol (SMTP) servers. SMTP enumeration involves directly interacting with the mail server using specific SMTP commands like `VRFY` (verify user) or `EXPN` (expand mailing list) to discover valid user accounts. These commands are part of the SMTP protocol itself, distinct from any directory service query functionality.
Go deeper
Related to this question
Learn chapter
Denial of Service (DoS) and Distributed Denial of Service (DDoS)
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
Key term
LDAP Enumeration
LDAP Enumeration is the process of querying a Lightweight Directory Access Protocol server to gather information about users, groups, computers, and other network resources in an organization.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.