CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist

  Why this is correct

  This option correctly interprets the standard SMTP response codes observed during enumeration. A VRFY command returning '252' indicates that the server recognizes the user (e.g., 'root') but cannot verify their status, often implying the account exists but is disabled or restricted. An EXPN command receiving a '250' response confirms the existence of a mailing list or alias (e.g., 'admin') and typically provides its expansion. Conversely, a RCPT TO command resulting in a '550' error explicitly signifies that the specified recipient (e.g., 'unknown@domain.com') does not exist on the server, providing clear non-existence confirmation.

• ✗

  The server has open relay enabled

  Why it's wrong here

  The provided SMTP responses do not indicate that the server has open relay enabled. An open relay server would accept RCPT TO commands for recipients on external domains, allowing it to forward email for any sender to any destination. The responses shown, particularly the '550' error for 'unknown@domain.com', only confirm the existence or non-existence of local users or aliases, not whether the server would process and relay mail for arbitrary external addresses.

• ✗

  The server is vulnerable to SMTP injection

  Why it's wrong here

  The information presented does not suggest an SMTP injection vulnerability. SMTP injection involves inserting malicious commands or data into an SMTP session, typically by manipulating input fields like sender, recipient, or subject, to execute unintended actions on the server. The commands mentioned (VRFY, EXPN, RCPT TO) are standard SMTP enumeration commands, and no attempt to inject malformed input, extra commands, or exploit a parsing vulnerability is described.

• ✗

  The server is not running SMTP

  Why it's wrong here

  This statement is incorrect because the server clearly accepted and responded to standard SMTP commands like VRFY, EXPN, and RCPT TO. If the SMTP service were not running, the connection would likely be refused, or the commands would result in connection errors or non-SMTP specific responses. The '252', '250', and '550' codes are all valid SMTP responses, confirming the presence and functional operation of an SMTP service on the target host.

Go deeper

Related to this question