CEH Vulnerability Analysis and System Hacking Practice Question

Exhibit

netstat -ano | findstr :3389
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1234
  TCP    192.168.1.10:3389      10.0.0.5:49152        ESTABLISHED     1234
  TCP    192.168.1.10:3389      10.0.0.6:49153        ESTABLISHED     1234
netstat -ano | findstr :445
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       5678
  TCP    192.168.1.10:445       192.168.1.20:49154     ESTABLISHED     5678

Refer to the exhibit. An analyst runs netstat on a Windows server and observes multiple established connections to port 3389 from internal IPs. Which attack is most likely occurring?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

RDP brute-force attack

Multiple established RDP connections from different internal IPs suggest a brute-force or password-spraying attack against RDP. The established connections indicate successful authentication attempts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SMB relay attack
Why it's wrong here
An SMB relay attack involves an attacker intercepting SMB authentication requests and relaying them to another server to gain unauthorized access. The `netstat` output showing only a single established connection on port 445 (SMB) is insufficient evidence for an ongoing SMB relay attack. Such an attack would typically manifest with multiple authentication attempts, potentially failed connections, or connections to various resources as the attacker attempts to utilize relayed credentials.
✗
DDoS attack
Why it's wrong here
A Distributed Denial of Service (DDoS) attack aims to overwhelm a target system's resources, such as network bandwidth or processing power, by flooding it with an immense volume of traffic or requests from numerous sources. The provided `netstat` output does not exhibit the characteristic indicators of a DDoS, such as an exceptionally high number of connections in `SYN_RECEIVED` state, an overwhelming quantity of connections from a vast array of disparate IP addresses, or significant network interface saturation.
✓
RDP brute-force attack
Why this is correct
The `netstat` output clearly displays multiple established connections to port 3389, which is the standard port for Remote Desktop Protocol (RDP). The presence of numerous distinct remote IP addresses successfully establishing connections to this service strongly indicates a successful RDP brute-force attack. Each established connection signifies a successful login session, suggesting that attackers have either found valid credentials for multiple accounts or repeatedly logged in with compromised credentials.
✗
Man-in-the-middle attack
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an attacker secretly intercepting and potentially altering communication between two parties who believe they are communicating directly. Indicators of an MITM attack, such as ARP cache poisoning, DNS spoofing, or unusual routing table entries, are not discernible from a standard `netstat` output. While `netstat` shows active connections, it does not provide the granular network layer information necessary to detect traffic interception or redirection inherent in MITM scenarios.

Go deeper

CEH Vulnerability Analysis and System Hacking Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question