Enumeration and System Hacking practice questions

Execute applications to extract data

Why wrong: Initial access typically grants a low-privileged user context, which severely restricts the ability to execute sensitive applications or access critical data stores. Attempting data extraction prematurely without elevated permissions would likely result in permission denied errors, yielding minimal valuable information and potentially alerting security controls. Privilege escalation is a prerequisite for effective and comprehensive data extraction.

Hide files to conceal tools and data

Why wrong: While concealing tools and data is a crucial aspect of maintaining stealth, performing it immediately after initial, often low-privileged access is premature. The primary objective at this stage is to expand control over the system through privilege escalation, as many effective hiding techniques or the tools themselves might require elevated permissions to operate or be placed in system-level directories. Prioritizing control over immediate stealth is more strategic.

Erase event logs to avoid detection

Why wrong: Erasing event logs is a post-exploitation activity typically performed much later, as part of covering tracks after achieving primary objectives like data exfiltration or establishing persistence. Executing this action immediately after initial access is premature and risky, as it could prematurely trigger alerts or make it harder to troubleshoot if subsequent, more critical steps fail, potentially compromising the entire operation before significant impact is made.

Pass-the-hash

Why wrong: Pass-the-hash (PtH) is a post-exploitation technique primarily used for lateral movement within a network, not for local privilege escalation on the same machine. It involves authenticating to a remote system or service by using a user's NTLM hash, rather than their plaintext password. This allows an attacker to access other machines or resources as the compromised user, but it does not grant higher privileges on the initial compromised host itself.

SUID abuse

Why wrong: SUID abuse is a privilege escalation technique specific to Unix-like operating systems, such as Linux, and is not applicable to Windows environments. SUID (Set User ID) is a special permission bit that allows an executable to run with the permissions of the file's owner, typically root. If a SUID-enabled program is vulnerable, an attacker can exploit it to execute commands with elevated privileges, a mechanism entirely absent in Windows security models.

Token impersonation

Why wrong: Token impersonation is a potent Windows privilege escalation technique where a process assumes the security context of another, often higher-privileged, user or process. This is achieved by duplicating an existing access token from a target process (e.g., SYSTEM or an administrator) and then assigning it to the attacker's process. With sufficient privileges like SeDebugPrivilege or SeImpersonatePrivilege, an attacker can effectively 'become' the higher-privileged user, enabling arbitrary code execution with elevated rights.

HELO

Why wrong: The HELO command is a fundamental part of the SMTP session initiation, where the client identifies itself to the server. Its primary function is to establish communication and declare the client's domain name, not to query the server for information about existing user accounts or aliases. Therefore, while essential for mail transfer, HELO does not serve as an SMTP enumeration command for discovering valid recipients.

RCPT TO

Why wrong: The RCPT TO command specifies the intended recipient of an email message during an SMTP transaction, indicating where the mail should be delivered. While a server might respond with an error code (e.g., 550 User unknown) if the specified recipient does not exist, the command's inherent purpose is mail routing, not the systematic discovery or enumeration of valid user accounts. Its use for enumeration is an indirect side effect of error handling, not its direct function.

ATRN

Why wrong: The ATRN (Authenticated TURN) command is an SMTP extension primarily used in specific scenarios, such as authenticated mail retrieval for clients that are not always online, like dial-up users. It allows a client to request that the server 'turn' the connection around and send mail to it, but only after successful authentication. This command is focused on secure, authenticated mail transfer and does not provide any mechanism for enumerating user accounts or aliases on the server.

Token impersonation

Why wrong: Token impersonation is a post-exploitation technique where an attacker, having already gained initial access, leverages an existing security token from a legitimate user or process to elevate their privileges within the system. This method bypasses the need to crack a password entirely, as it relies on the operating system's trust in the token's authenticity for authorization. Therefore, it is a privilege escalation technique, not a method for discovering a user's plaintext password.

Rainbow table attack

Why wrong: A rainbow table attack utilizes precomputed tables of hash chains to reverse cryptographic hashes back into their original plaintext passwords without needing to perform the computationally intensive cracking process for each attempt. Instead of guessing passwords and hashing them, the attacker looks up the target hash in the table to find a matching chain and reconstruct the original password. This technique is highly effective against unsalted hashes but becomes ineffective when salts are used, as each salted hash would require a unique rainbow table.

SNMP with public community string

Why wrong: SNMP (Simple Network Management Protocol) is primarily used for monitoring and managing network devices, servers, and other IP-enabled equipment. While it can reveal system information like running processes, network interfaces, and installed software via Management Information Bases (MIBs), it does not directly query or enumerate Active Directory user accounts. Therefore, it is not an effective method for listing AD users.

SMB null session

Why wrong: An SMB (Server Message Block) null session involves connecting to a Windows server without authentication, often using the IPC$ share. Historically, this vulnerability allowed attackers to enumerate local user accounts, shares, and even some domain users from older Windows NT domains or standalone servers by querying the Security Account Manager (SAM) database. However, modern Active Directory environments and Windows server configurations typically restrict null session access to prevent such enumeration, making it an unreliable method for comprehensively listing AD users.

SMTP VRFY

Why wrong: The SMTP (Simple Mail Transfer Protocol) VRFY command is designed to verify the existence of a specific email address on a mail server. When a client sends a VRFY command with an email address, the mail server responds indicating whether that address is valid or not. While this can confirm the existence of *email-enabled* users, it does not provide a comprehensive list of all Active Directory users, nor does it directly query the directory service itself.

nslookup

Why wrong: nslookup is a network administration command-line tool used for querying the Domain Name System (DNS) to obtain domain name or IP address mapping or other DNS records. While it can resolve hostnames to IP addresses, it has no inherent capability to interact with or enumerate SMB shares or users directly. Its function is strictly limited to DNS resolution.

snmpwalk

Why wrong: snmpwalk is a utility that uses SNMP GETNEXT requests to query a network entity for a tree of information. It is designed to enumerate data from devices that support the Simple Network Management Protocol (SNMP), such as network devices and servers, to gather system information, network statistics, and more. It cannot interact with SMB services or enumerate SMB shares and users.

ldapsearch

Why wrong: ldapsearch is a command-line utility for querying directories that support the Lightweight Directory Access Protocol (LDAP), such as Active Directory or OpenLDAP. It allows users to search for entries, attributes, and organizational units within an LDAP directory. While it can enumerate users and groups stored in an LDAP directory, it does not directly interact with or enumerate SMB shares.

Social engineering

Why wrong: Social engineering is an initial access vector that manipulates individuals into divulging confidential information or performing actions that compromise security, rather than a direct system hacking technique. While it can lead to system compromise, it operates on human psychology and trust, preceding the technical actions performed on a system during the system hacking phase. It's distinct from the post-exploitation activities within a compromised host.

Network sniffing

Why wrong: Network sniffing involves passively capturing and analyzing data packets traversing a network segment. While it is a valuable reconnaissance and information gathering technique, often used to obtain credentials or sensitive data from the network, it is not considered a core system hacking technique. System hacking focuses on direct interaction and manipulation of the compromised host's operating system and applications, whereas sniffing primarily operates at the network layer.

enum4linux

Why wrong: enum4linux is a powerful wrapper script designed specifically for enumerating information from Windows and Samba hosts. It leverages tools like rpcclient, net, and nmblookup to extract details such as user lists, group memberships, and shared resources (SMB shares). Consequently, it lacks the functionality to interact with or enumerate Network File System (NFS) exports, making it irrelevant for this task.

smbclient

Why wrong: smbclient is a command-line utility specifically engineered to interact with Server Message Block (SMB) and Common Internet File System (CIFS) network shares. It functions as an SMB client, allowing users to browse, upload, and download files from Windows or Samba servers. Since NFS operates on a completely different protocol stack and port (typically UDP/TCP 2049), smbclient lacks the necessary protocol implementation to communicate with or enumerate NFS exports.

ldapsearch

Why wrong: ldapsearch is a command-line utility used for querying and displaying information from Lightweight Directory Access Protocol (LDAP) directories. It facilitates searching for entries, attributes, and values stored within an LDAP server, which typically manages user accounts, group policies, and network resources. As LDAP is a directory service protocol entirely distinct from network file sharing protocols like NFS, ldapsearch possesses no capability to enumerate NFS exports.

Spying, Erasing, Cracking, Hiding, Privilege escalation, Executing

Why wrong: Incorrect order.

Privilege escalation, Cracking, Hiding, Executing, Spying, Erasing

Why wrong: CHPSET starts with Cracking, not Privilege escalation.

Executing, Cracking, Spying, Hiding, Privilege escalation, Erasing

Why wrong: This order does not follow CHPSET.

Wireshark

Why wrong: Wireshark is a powerful network protocol analyzer used for capturing and interactively browsing network traffic. While it can be instrumental in identifying unencrypted credentials transmitted over a network, it does not possess the functionality to actively crack password hashes or perform brute-force attacks against authentication mechanisms. Its primary role is passive observation and analysis of network communications, not active password compromise.

Nmap

Why wrong: Nmap (Network Mapper) is a free and open-source utility for network discovery and security auditing, primarily used for host discovery, port scanning, and OS detection. While Nmap can identify services running on target systems that might be vulnerable to password attacks, it does not inherently perform password cracking or brute-force authentication attempts. Its function is reconnaissance and vulnerability assessment, not direct credential compromise.

Metasploit

Why wrong: Metasploit Framework is a powerful penetration testing platform that provides a comprehensive suite of tools for developing, testing, and executing exploits against remote targets. While it includes modules for credential harvesting, brute-forcing services like SSH or FTP, and post-exploitation password dumping, its core function is exploitation and payload delivery, not dedicated offline password hash cracking. It's an exploitation framework that can facilitate password-related attacks, but it is not a standalone password cracking utility in the same vein as John the Ripper or Hashcat.

Use the `attrib +h +s` command to set hidden and system attributes

Why wrong: Using `attrib +h +s` sets both the hidden and system file attributes, making the file invisible to standard directory listings (e.g., `dir` without the `/a` flag) and many graphical file explorers unless specific options to show hidden and system files are enabled. This method effectively conceals the file from casual user inspection, fulfilling the objective of hiding an executable post-compromise. While not foolproof against determined analysis, it significantly increases stealth against typical user interaction.

Rename the file to a system filename like svchost.exe and place it in C:\Windows\System32

Why wrong: Renaming an executable to a common system filename like `svchost.exe` and placing it in a legitimate system directory such as `C:\Windows\System32` attempts to blend it in with legitimate files. However, this approach does not actually *hide* the file; it remains fully visible in directory listings and can be easily discovered by simply browsing the directory or using file search tools. Furthermore, advanced detection methods can identify discrepancies like different file sizes, digital signatures, or process behavior compared to the legitimate `svchost.exe`.

Encrypt the file using EFS

Why wrong: Encrypting a file using the Encrypting File System (EFS) is designed to protect the confidentiality of its contents, ensuring that unauthorized users cannot read the data even if they gain access to the file. While EFS secures the information within the executable, it does not alter the file's visibility or attributes within the filesystem. The encrypted file will still appear in all directory listings and file explorers, making it readily discoverable and failing to achieve the objective of hiding the executable.

Event logs show repeated successful logins from unknown IPs

Why wrong: Repeated successful logins from unknown IP addresses primarily indicate a compromised user account, likely due to credential theft, brute-force attacks, or password reuse. While a system with a rootkit might also exhibit this symptom, it is not a direct or specific indicator of a rootkit's presence itself. This symptom points more directly to unauthorized access via legitimate credentials rather than the stealthy, low-level presence of a rootkit.

Increased disk space usage without explanation

Why wrong: An unexplained increase in disk space usage is a very general symptom that can result from numerous legitimate activities, such as large software updates, temporary file accumulation, or user data storage. While some malware might consume disk space, rootkits are specifically designed for stealth and often have a minimal footprint to avoid detection. Therefore, this symptom is too broad and non-specific to be a reliable indicator of a rootkit's presence.

Port scanning with nmap

Why wrong: Nmap is primarily a network discovery and service identification tool, used to determine which hosts are active on a network and what services they are running by probing various ports. While it can identify open ports like 25 (SMTP) or 445 (SMB), its core functionality does not directly enumerate user accounts or credentials. It provides the initial reconnaissance necessary to identify potential services that could be enumerated, but it is not an enumeration technique for users itself.

DNS zone transfer

Why wrong: A DNS zone transfer (AXFR) is a legitimate mechanism for replicating DNS database files from a primary DNS server to a secondary server. If successful due to misconfiguration, it can reveal a comprehensive list of hostnames, IP addresses, and other resource records within a domain, mapping out network infrastructure. However, this process is designed to provide network topology information, not to directly list or enumerate individual user accounts or credentials within an organization.

SNMPwalk of the entire MIB

Why wrong: SNMPwalk is a utility that queries a network device using the Simple Network Management Protocol (SNMP) to retrieve a tree of information from its Management Information Base (MIB). It can gather extensive system details such as network interfaces, running processes, and system uptime, providing valuable configuration data. However, SNMPwalk does not inherently enumerate user accounts or credentials unless specific, non-standard MIB objects are populated with such sensitive information, which is generally considered a severe security misconfiguration.

SUID bit abuse

Why wrong: The SUID (Set User ID) bit is a specific file permission in Unix-like operating systems that allows an executable to run with the permissions of its owner, rather than the user executing it. This mechanism is fundamentally absent in Windows security models, which rely on Access Control Lists (ACLs) and token-based privileges. Therefore, attempting to leverage SUID bit abuse for privilege escalation within a Windows environment is entirely ineffective and irrelevant, as the underlying functionality does not exist.

Pass-the-hash attack

Why wrong: A Pass-the-Hash (PtH) attack involves authenticating to a remote system or service using a user's NTLM hash instead of their plaintext password. While PtH is highly effective for lateral movement across a network, allowing an attacker to access other machines or services with the compromised user's credentials, it does not directly facilitate privilege escalation on the local machine from a low-privileged user to a higher-privileged user. It's primarily an authentication bypass technique for network access, not a local privilege escalation method.

Password cracking

Why wrong: Not related to password cracking.

Kernel exploit

Why wrong: Kernel exploit targets kernel vulnerabilities, not SUID files.

Token impersonation

Why wrong: Token impersonation is Windows-specific.

SMTP enumeration using VRFY

Why wrong: SMTP enumeration using the VRFY command attempts to verify the existence of user accounts on a mail server. While this can reveal valid email addresses, the Simple Mail Transfer Protocol (SMTP) is a generic application-layer protocol for email transmission, not specific to the Windows operating system. Therefore, this technique is not considered a Windows-specific enumeration method, as SMTP servers can run on various platforms.

LDAP enumeration using ldapsearch

Why wrong: LDAP enumeration, often performed with tools like ldapsearch, queries Lightweight Directory Access Protocol (LDAP) directories to retrieve information about users, groups, and network resources. Although Microsoft Active Directory heavily utilizes LDAP, the LDAP protocol itself is cross-platform and can be implemented on various operating systems, including Linux-based directory services. Consequently, this is not exclusively a Windows enumeration technique, as the target directory service might not be Windows-based.

NFS enumeration using showmount

Why wrong: NFS enumeration using showmount is a technique to identify shared directories on Network File System (NFS) servers. The showmount command specifically queries an NFS server to display its exported file systems and the clients allowed to access them. However, NFS is predominantly a distributed file system protocol used in Unix-like operating systems such as Linux and macOS, making it irrelevant for enumerating native Windows environments.

SQL injection

Why wrong: SQL injection is a code injection technique used to attack data-driven applications, where malicious SQL statements are inserted into an entry field for execution. It primarily targets the underlying database to retrieve, modify, or delete data, or even gain administrative control over the database server. While it can lead to the disclosure of password hashes stored in a database, it is a method of exfiltrating data, not a technique for computationally cracking those hashes to reveal the original passwords. Therefore, it is a database exploitation method, not a password cracking technique itself.

Phishing

Why wrong: Phishing is a social engineering technique where attackers attempt to trick individuals into divulging sensitive information, such as usernames and passwords, by masquerading as a trustworthy entity in an electronic communication. This method relies on deception and manipulation of human psychology rather than technical exploitation of cryptographic weaknesses or computational guessing. While it aims to obtain passwords, it does not involve the computational process of cracking a hash or encrypted password to discover its original form.

ARP spoofing

Why wrong: ARP spoofing, also known as ARP poisoning, is a man-in-the-middle (MITM) attack technique where an attacker sends falsified Address Resolution Protocol (ARP) messages over a local area network. This allows the attacker to associate their MAC address with the IP address of another host, such as the default gateway, causing traffic intended for the legitimate host to be redirected through the attacker's machine. While it can facilitate eavesdropping on network traffic to potentially capture password hashes or credentials, it is a network interception technique and not a method for computationally cracking those passwords.

Using token impersonation with SeDebugPrivilege

Why wrong: Using token impersonation with SeDebugPrivilege is a privilege escalation method exclusively found within the Windows operating system security model. Token impersonation allows a process to temporarily assume the security context of another user or process, often facilitated by privileges like SeDebugPrivilege. Since the investigation is focused on a compromised Linux server, these Windows-specific mechanisms are entirely inapplicable and cannot be leveraged for privilege escalation in this environment.

Performing a DDoS attack on the server

Why wrong: Performing a DDoS attack on the server is a denial-of-service technique aimed at disrupting the availability of a system or service by overwhelming it with traffic. While a successful DDoS attack can render a server inaccessible or unusable, it does not grant an attacker any elevated access rights, administrative privileges, or control over the system's internal functions. Therefore, it is not a method for privilege escalation.