CCNA Ceh Enum System Hacking Questions — Page 2 of 3

MCQhard

A penetration tester discovers a service running on UDP port 161 with a default community string 'public'. They use `snmpwalk -v2c -c public 192.168.1.10` and retrieve extensive system information. Which enumeration technique is being performed?

A.SMB enumeration

B.LDAP enumeration

C.SMTP enumeration

D.SNMP enumeration

AnswerD

Simple Network Management Protocol (SNMP) is a foundational protocol for managing and monitoring network devices, and it predominantly uses UDP for its operations. SNMP agents typically listen for manager requests on UDP port 161, while managers receive asynchronous notifications (traps and informs) on UDP port 162. Enumeration tools like `snmpwalk` specifically target UDP port 161 to query and retrieve the entire Management Information Base (MIB) tree from compliant devices, confirming its relevance to a service on UDP 161.

Why this answer

The question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.

Exam trap

The trap here is that candidates may confuse SNMP enumeration with other enumeration techniques because they see 'enumeration' in the question, but the specific use of UDP port 161 and the `snmpwalk` command uniquely identifies SNMP enumeration.

How to eliminate wrong answers

Option A is wrong because SMB enumeration uses TCP ports 139 or 445 and tools like `enum4linux` or `smbclient`, not UDP port 161 or SNMP commands. Option B is wrong because LDAP enumeration uses TCP/UDP port 389 and queries directory services via `ldapsearch`, not SNMP or the `snmpwalk` command. Option C is wrong because SMTP enumeration uses TCP port 25 and commands like `VRFY` or `EXPN` to verify email users, not UDP port 161 or SNMP protocols.

Practice this question →

MCQmedium

An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?

A.Token impersonation using RottenPotato

B.Pass-the-hash attack

C.Kerberoasting

D.SUID abuse

AnswerA

Token impersonation using RottenPotato is a highly effective local privilege escalation technique on Windows systems. It exploits the `SeImpersonatePrivilege`, often held by services like IIS or SQL Server, by leveraging NTLM relay attacks against local COM/DCOM services. This allows an attacker to trick a privileged process, typically running as `NT AUTHORITY\SYSTEM`, into authenticating to a malicious listener, enabling the attacker to impersonate the resulting SYSTEM token and gain full administrative control.

Why this answer

The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.

Exam trap

EC-Council often tests the distinction between Windows token impersonation attacks (SeImpersonatePrivilege) and Linux SUID abuse, leading candidates to mistakenly select SUID abuse when the question explicitly mentions a Windows system.

How to eliminate wrong answers

Option B (Pass-the-hash) is wrong because it reuses NTLM hashes to authenticate as another user over the network, not to escalate from a local user to SYSTEM via token impersonation. Option C (Kerberoasting) is wrong because it targets service account Kerberos tickets for offline cracking, requiring domain credentials and not leveraging SeImpersonatePrivilege. Option D (SUID abuse) is wrong because it is a Linux/Unix privilege escalation technique involving set-user-ID executables, not applicable to Windows token manipulation.

Practice this question →

MCQmedium

A penetration tester runs `nbtstat -A 192.168.1.10` on a Windows machine. The output reveals the NetBIOS name table and shows a <20> entry. What does this indicate?

A.The target is a printer

B.The target is a file server

C.The target is a domain controller

D.The target is a workstation

AnswerB

The NetBIOS suffix <20> (hexadecimal) is specifically registered by a computer running the Server service, which is fundamentally responsible for sharing files and printers over the network. When `nbtstat -a` reveals a <20> entry for a target IP address, it strongly indicates that the machine is configured to act as a file server, making its shared resources available to other network clients. This is the definitive indicator for a file server role.

Why this answer

The <20> entry in the NetBIOS name table indicates that the target machine is running the File Server service, which is a NetBIOS service type for file sharing. The `nbtstat -A` command queries the remote NetBIOS name table, and the <20> hex code specifically maps to the 'File Server Service' (also known as the 'Server' service) in the NetBIOS naming convention, as defined in RFC 1001/1002. This service is essential for SMB-based file sharing, making the target a file server.

Exam trap

The trap here is that candidates often confuse the <20> entry with a general 'server' role, but the CEH exam specifically tests the mapping of NetBIOS suffixes to services, where <20> uniquely identifies the File Server Service, not a domain controller or workstation.

How to eliminate wrong answers

Option A is wrong because a printer typically has a <20> entry for the 'File Server Service' only if it also shares files, but the standard NetBIOS code for a printer is <00> or <03> for the workstation service, not <20>. Option C is wrong because a domain controller would show additional entries like <1C> (Domain Controller) or <1B> (Domain Master Browser), not just <20>. Option D is wrong because a workstation primarily has a <00> entry for the Workstation Service, not a <20> entry, which is specific to the Server Service for file sharing.

Practice this question →

Multi-Selecthard

Which THREE of the following are components of the CHPSET system hacking methodology?

Select 3 answers

A.Port scanning

B.Vulnerability scanning

C.Cracking passwords

D.Privilege escalation

E.Erasing tracks

AnswersC, D, E

Cracking passwords is a critical component of system hacking, often employed to gain initial unauthorized access to a system or to elevate privileges once inside. This involves using various techniques like brute-force, dictionary attacks, or rainbow tables against hashed credentials obtained from a target. Successful password cracking directly facilitates unauthorized authentication, enabling an attacker to impersonate legitimate users and access system resources.

Why this answer

Cracking passwords is a core phase in the CHPSET (Cracking, Hacking, Privilege escalation, System hacking, Erasing tracks, Tunneling) system hacking methodology. After gaining initial access, the attacker extracts password hashes (e.g., from SAM or LSASS) and uses tools like John the Ripper or Hashcat to crack them offline, enabling further access or lateral movement.

Exam trap

The CEH exam often tests candidates by mixing pre-exploitation steps (like scanning) with post-exploitation phases (like cracking and privilege escalation), so the trap is assuming that all enumeration activities are part of the CHPSET methodology, when in fact CHPSET only covers actions after initial access.

Practice this question →

Multi-Selectmedium

Which TWO of the following are common techniques for covering tracks after compromising a system? (Select 2)

Select 2 answers

A.Increasing the frequency of password changes

B.Enabling verbose logging for future attacks

C.Manipulating event logs to remove evidence of intrusion

D.Using steganography to hide exfiltrated data in image files

E.Setting up a honeypot to distract defenders

AnswersC, D

Attackers often clear or modify logs to hide their activities.

Why this answer

Manipulating event logs (e.g., clearing, modifying, or deleting entries in Windows Event Log or syslog) is a standard post-exploitation step to remove traces of unauthorized access, such as failed login attempts or privilege escalation events. Attackers often use tools like `wevtutil` or `clearlogs` to erase evidence, making forensic reconstruction difficult.

Exam trap

EC-CEH often tests the distinction between post-exploitation cover-up actions (log manipulation, steganography) and pre-emptive or defensive measures (password changes, honeypots), so candidates mistakenly select options that sound security-related but are not attacker cover-up techniques.

Practice this question →

MCQmedium

An analyst observes the following SNMP walk output on a network device: `SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.5.1 = STRING: "cisco"`. Which finding is most significant?

A.The SNMP community string is "cisco" and likely weak

B.The SNMP service is using version 2c

C.The device is running Cisco IOS version 12.0

D.The device is configured for read-write access

AnswerA

An SNMP walk often reveals the community string, especially if it's a default or commonly used value. The string "cisco" is a well-known default or weak community string, making it highly susceptible to discovery by attackers. Gaining access with such a string allows an attacker to perform extensive reconnaissance, retrieve sensitive device configuration, and potentially monitor network traffic. This represents a significant security vulnerability that should be remediated immediately.

Why this answer

The SNMP walk output reveals the community string 'cisco' in the OID `enterprises.9.9.23.1.2.1.1.5.1`, which corresponds to the SNMP community string (ciscoSnmpCommunityString) in Cisco's private MIB. A default or easily guessable community string like 'cisco' is a critical security weakness because it allows unauthorized read or read-write access to the device, enabling enumeration of system information or configuration changes. This finding is the most significant because it directly indicates a weak authentication mechanism that can be exploited for further enumeration or system compromise.

Exam trap

The trap here is that candidates often focus on the SNMP version or device model, but the most critical finding is the weak community string 'cisco', which is a direct authentication bypass vulnerability that enables enumeration and potential system compromise.

How to eliminate wrong answers

Option B is wrong because the SNMP walk output does not explicitly indicate the SNMP version; the OID prefix 'SNMPv2-SMI' refers to the SMI (Structure of Management Information) for SNMPv2, but the actual SNMP version used in the walk could be v1, v2c, or v3, and the presence of a community string suggests v1 or v2c, but this is not the most significant finding. Option C is wrong because the OID `enterprises.9.9.23.1.2.1.1.5.1` does not correspond to Cisco IOS version information; IOS version is typically found under OIDs like `1.3.6.1.2.1.1.1.0` (sysDescr) or `enterprises.9.9.23.1.2.1.1.1` (ciscoImageString), not the community string OID. Option D is wrong because the SNMP walk output only shows a read operation (walking the MIB tree) and does not indicate whether the community string provides read-write or read-only access; the string 'cisco' could be configured for either, but the walk itself does not confirm write capability.

Practice this question →

MCQmedium

A security analyst observes repeated attempts to validate user accounts via SMTP using VRFY commands from an external IP. What is the BEST immediate action to mitigate this reconnaissance?

A.Upgrade to the latest version of the SMTP server

B.Enable SMTP authentication for all incoming connections

C.Block the external IP address at the firewall

D.Disable VRFY and EXPN commands in the SMTP server configuration

AnswerD

This prevents the enumeration technique entirely.

Why this answer

The VRFY command is an SMTP protocol feature (RFC 821) that allows a client to verify whether a specific email address exists on the server. Attackers use VRFY and EXPN to enumerate valid user accounts during the reconnaissance phase. Disabling these commands in the SMTP server configuration directly stops this enumeration technique without affecting legitimate mail delivery.

Exam trap

The trap here is that candidates often choose to block the IP address (Option C) as a quick fix, failing to recognize that the root cause is the enabled VRFY/EXPN commands, which must be disabled at the server configuration level for a permanent mitigation.

How to eliminate wrong answers

Option A is wrong because upgrading the SMTP server version does not disable VRFY/EXPN by default; the commands remain functional unless explicitly configured otherwise. Option B is wrong because SMTP authentication applies to mail submission (port 587) or after the initial connection, but VRFY is typically processed before authentication, so enabling auth does not block unauthenticated VRFY queries. Option C is wrong because blocking a single external IP is a temporary, reactive measure; the attacker can easily switch IPs, and the underlying vulnerability (enabled VRFY/EXPN) remains unaddressed.

Practice this question →

MCQmedium

A security analyst runs `ldapsearch -x -h 10.0.0.3 -b "dc=company,dc=com"` and receives a large number of entries including user objects. What type of information is being collected?

A.SMB share listings

B.SNMP MIB values

C.NetBIOS names and MAC addresses

D.Active Directory users and attributes

AnswerD

The ldapsearch command is the primary utility for querying LDAP-compliant directories, including Microsoft Active Directory. The provided syntax ldapsearch -x -h 10.0.0.3 -b dc=co specifically targets an LDAP server at IP 10.0.0.3 for anonymous (simple) bind, searching within the base distinguished name dc=co. This operation is precisely how security analysts enumerate Active Directory users, groups, computers, and their associated attributes, making it the correct method for this task.

Why this answer

The `ldapsearch` command with the `-x` flag (simple authentication) and `-b` base DN `"dc=company,dc=com"` performs an LDAP query against the specified server (10.0.0.3). LDAP is the protocol used to query and retrieve directory services, and in a Windows environment, Active Directory exposes user objects, groups, and their attributes via LDAP. Therefore, the output contains Active Directory users and their associated attributes, making D correct.

Exam trap

The trap here is that candidates may confuse LDAP enumeration with other network discovery protocols (SMB, SNMP, NetBIOS) because all are used in the enumeration phase, but each uses distinct commands and ports—LDAP specifically targets directory services, not file shares or network device management.

How to eliminate wrong answers

Option A is wrong because SMB share listings are obtained using tools like `smbclient` or `enum4linux` with SMB protocol commands (e.g., `smbclient -L`), not via LDAP queries. Option B is wrong because SNMP MIB values are collected using SNMP tools like `snmpwalk` or `snmpenum` with community strings, not through LDAP. Option C is wrong because NetBIOS names and MAC addresses are gathered using `nbtstat` or `nbtscan` (NetBIOS over TCP/IP), not via LDAP directory queries.

Practice this question →

MCQhard

An attacker has obtained password hashes from a Windows system. They plan to use rainbow tables to crack them. Which tool would be most appropriate for generating and using rainbow tables?

A.Hashcat

B.Ophcrack

C.John the Ripper

D.RainbowCrack

AnswerD

RainbowCrack is the definitive and specialized tool explicitly designed for the generation and utilization of rainbow tables. It implements the time-memory tradeoff technique to precompute cryptographic hash chains, allowing for rapid lookup of plaintext passwords from their corresponding hashes. This makes RainbowCrack the standard choice when an attacker intends to leverage or create rainbow tables for efficient password cracking.

Why this answer

RainbowCrack is the tool specifically designed for generating and using rainbow tables, which are precomputed hash chains used to reverse cryptographic hash functions. The question explicitly asks for the tool most appropriate for generating and using rainbow tables, and RainbowCrack directly supports both creating rainbow tables (with rtgen) and performing lookups (with rcsort and rcrack).

Exam trap

EC-Council often tests the distinction between tools that crack passwords via brute-force/dictionary (Hashcat, John the Ripper) versus tools that specifically leverage precomputed rainbow tables (RainbowCrack, Ophcrack), and candidates mistakenly choose Hashcat because it is the most popular GPU cracker, ignoring the explicit 'rainbow tables' requirement.

How to eliminate wrong answers

Option A is wrong because Hashcat is a GPU-accelerated password cracker that uses brute-force, dictionary, or rule-based attacks, not rainbow tables; it does not generate or use precomputed rainbow tables. Option B is wrong because Ophcrack is a specialized tool for cracking Windows LM and NTLM hashes using its own precomputed rainbow tables, but it is not designed for generating custom rainbow tables; it relies on tables from the Ophcrack project. Option C is wrong because John the Ripper is a versatile password cracker that supports multiple attack modes (dictionary, brute-force, incremental) but does not natively generate or use rainbow tables; its 'john --format=nt --make-charset' is for Markov mode, not rainbow tables.

Practice this question →

Multi-Selecthard

Which THREE of the following are methods attackers use to cover their tracks after compromising a system?

Select 3 answers

A.Modifying file timestamps

B.Deleting event logs

C.Installing a rootkit

D.Performing a dictionary attack

E.Running a vulnerability scanner

AnswersA, B, C

Attackers utilize tools like `touch` on Linux or specialized utilities on Windows to meticulously alter the MAC (Modification, Access, Change) times of files and directories. This technique, known as timestomping, aims to blend malicious files with legitimate system files by making them appear older or newer than their actual creation or modification, thereby evading detection during forensic analysis and obscuring the true timeline of compromise or data exfiltration.

Why this answer

Modifying file timestamps (A) is a common anti-forensic technique used to hide the evidence of file creation, modification, or access. Attackers use tools like `touch` on Linux or `SetFileTime` on Windows to alter the MAC (Modify, Access, Change) timestamps, making malicious files appear as legitimate system files. This prevents forensic investigators from identifying when the compromise occurred or which files were altered.

Exam trap

EC-Council often tests the distinction between attack phases, so candidates mistakenly associate dictionary attacks and vulnerability scanning with post-exploitation activities, when they actually belong to the enumeration and system hacking phases, not the covering tracks phase.

Practice this question →

MCQeasy

Which enumeration technique would be MOST effective for gathering usernames from an SMTP server that supports the VRFY command?

A.SNMP enumeration using SNMPwalk

B.SMTP VRFY enumeration

C.NetBIOS enumeration using nbtstat

D.LDAP anonymous queries

AnswerB

The SMTP VRFY command is specifically designed to verify the existence of a user on the mail server without actually sending an email. When an attacker sends a VRFY request with a potential username, the server responds by indicating whether the user exists, often revealing the full name or email address if present. This direct query capability makes VRFY an extremely effective and straightforward technique for enumerating valid user accounts on an SMTP server, provided the server has not been configured to disable or restrict this command.

Why this answer

The VRFY command is an SMTP protocol command (RFC 821) that allows a client to verify whether a specific mailbox exists on the server. Since the question explicitly states the SMTP server supports VRFY, sending VRFY requests with common usernames or using a wordlist directly enumerates valid usernames, making SMTP VRFY enumeration the most effective technique.

Exam trap

The trap here is that candidates may confuse VRFY with EXPN (which expands mailing lists) or assume any enumeration technique (like SNMP or LDAP) can be adapted to SMTP, but the question specifically ties the technique to the protocol command supported by the server.

How to eliminate wrong answers

Option A is wrong because SNMP enumeration using SNMPwalk targets SNMP-enabled devices to extract MIB data (e.g., system information, running processes), not SMTP usernames; it requires SNMP community strings and has no relation to the SMTP VRFY command. Option C is wrong because NetBIOS enumeration using nbtstat works over NetBIOS (port 137) to gather computer names, shares, and logged-in users on Windows networks, not SMTP mailboxes. Option D is wrong because LDAP anonymous queries target LDAP directories (port 389) to enumerate users, groups, and objects in a directory service like Active Directory, not an SMTP server's mailbox list.

Practice this question →

MCQmedium

During a penetration test, a tester gains a low-privilege shell on a Linux server. The command `sudo -l` reveals that the user can run `/usr/bin/find` as root. Which technique can the tester use to escalate privileges?

A.Abuse the SUID bit on find

B.Use find with the -exec flag to spawn a shell

C.Exploit a kernel vulnerability

D.Run a buffer overflow on the find binary

AnswerB

This is a well-known and highly effective privilege escalation vector. If the `find` binary has the SUID (Set User ID) bit set, or if a low-privilege user can execute `find` with `sudo` privileges without a password, the `-exec` flag can be leveraged to execute arbitrary commands as the owner of the `find` binary (typically root). For example, `find . -exec /bin/sh -p \;` would spawn a privileged shell, effectively escalating privileges from the low-privilege shell.

Why this answer

The `sudo -l` output shows the user can run `/usr/bin/find` as root without a password. The `find` command has a built-in `-exec` flag that allows executing arbitrary commands on each found file. By running `sudo find / -exec /bin/sh \;`, the tester can spawn a root shell, escalating privileges because the command runs with sudo (root) privileges.

Exam trap

The trap here is that candidates may think the SUID bit (Option A) is the only way to escalate with find, but the question explicitly states the user has sudo access to find, making the `-exec` flag the correct and immediate vector.

How to eliminate wrong answers

Option A is wrong because the SUID bit is a file permission that allows a binary to run with the owner's privileges, but here the privilege escalation is via sudo, not the SUID bit; the find binary may not have the SUID bit set, and even if it did, the sudo rule is the direct vector. Option C is wrong because exploiting a kernel vulnerability is unnecessary when a valid sudo misconfiguration already provides a direct path to root; kernel exploits are risky, noisy, and should be a last resort. Option D is wrong because running a buffer overflow on the find binary is an overly complex and unreliable technique; the find binary is not known to have a trivial buffer overflow, and the `-exec` flag provides a clean, intended method for command execution.

Practice this question →

Multi-Selecteasy

Which TWO of the following are common tools used for SMB enumeration? (Select 2)

Select 2 answers

A.ldapsearch

B.snmpwalk

C.enum4linux

D.nbtstat

E.smbclient

AnswersC, E

enum4linux is a powerful wrapper script built upon Samba tools, specifically designed for enumerating information from Windows and Samba hosts. It automates the process of extracting user lists, group memberships, share names, password policies, and other critical data via the SMB/NetBIOS protocols. This comprehensive tool leverages various SMB enumeration techniques, making it highly effective for reconnaissance against Windows systems.

Why this answer

enum4linux is a wrapper tool that leverages SMB/CIFS operations (via smbclient, rpcclient, and net) to enumerate user lists, share listings, OS information, and password policies from Windows and Samba targets. It directly queries the SMB protocol (port 445/139) and is a standard tool for SMB enumeration in penetration testing.

Exam trap

EC-Council often tests the distinction between tools that operate at different protocol layers—candidates confuse NetBIOS name resolution tools (nbtstat) with SMB enumeration tools, or mistake LDAP/SNMP tools for SMB-specific ones.

Practice this question →

MCQmedium

During a penetration test, you execute the command `enum4linux -a 192.168.1.20`. The output reveals that the 'backup' account has a blank password and belongs to the 'Domain Admins' group. Which phase of the CHPSET methodology does identifying this vulnerability belong to?

A.Privilege escalation

B.Cracking passwords

C.Spying

D.Executing applications

AnswerB

Cracking passwords refers to the process of discovering or bypassing authentication credentials, often through brute-force, dictionary attacks, or exploiting weak password policies. The `enum4linux` tool can enumerate user accounts and sometimes directly reveal blank or easily guessable passwords for services like SMB, or provide usernames that are crucial for subsequent offline or online password cracking attempts. Identifying a blank password is a direct form of credential compromise, making it a discovery within the realm of password cracking.

Why this answer

The command `enum4linux -a` enumerates SMB shares, users, and password policies from a Windows target. Discovering that the 'backup' account has a blank password directly identifies a weak or missing credential, which falls under the 'Cracking passwords' phase of the CHPSET methodology. This phase involves identifying and exploiting weak, default, or blank passwords to gain unauthorized access.

Exam trap

The trap here is confusing the 'Cracking passwords' phase with 'Privilege escalation' because discovering a blank password on a high-privilege account seems like a privilege escalation vector, but the CHPSET methodology defines password cracking as the phase where weak or blank credentials are identified and exploited.

How to eliminate wrong answers

Option A is wrong because privilege escalation occurs after initial access is obtained, not during the identification of a blank password vulnerability. Option C is wrong because spying refers to monitoring or eavesdropping on network traffic or user activity, not discovering account credentials. Option D is wrong because executing applications involves running tools or payloads to achieve a specific goal, whereas this step is about identifying a credential weakness.

Practice this question →

MCQmedium

A security team discovers that an attacker has been using steganography to exfiltrate data from the corporate network. The attacker hid data inside image files and uploaded them to a public image hosting site. Which of the following is the BEST method to detect this type of exfiltration?

A.Compare file hashes of uploaded images to known-good baselines

B.Deploy a steganography detection tool that analyzes image pixel patterns for statistical anomalies

C.Block all image uploads to external sites

D.Use network-based DLP to inspect image file headers for hidden data

AnswerB

Deploying a steganography detection tool, also known as a steganalysis tool, is the most effective approach as these specialized utilities are designed to identify the subtle statistical anomalies introduced into image pixel patterns by embedded data. These tools analyze various image properties, such as Least Significant Bit (LSB) distributions or Discrete Cosine Transform (DCT) coefficients, to detect deviations from expected statistical models of 'clean' images. By identifying these irregularities, they can reliably flag images likely containing hidden information.

Why this answer

Steganography detection tools analyze statistical anomalies in pixel patterns (e.g., LSB embedding, DCT coefficient deviations) that are invisible to the human eye but detectable via algorithms like chi-square analysis or RS analysis. This directly identifies hidden payloads without relying on file hashes or headers, which steganography does not alter.

Exam trap

The trap here is that candidates confuse steganography detection with file integrity checking (Option A) or assume header inspection (Option D) can find hidden data, when in fact steganography operates at the pixel or transform coefficient level, not in metadata.

How to eliminate wrong answers

Option A is wrong because comparing file hashes to known-good baselines only detects unauthorized file modifications, not steganographic embedding that preserves the original hash if the attacker uses a copy or modifies metadata; steganography changes pixel data without altering the file's overall hash if the attacker uses a different file. Option C is wrong because blocking all image uploads to external sites is a draconian policy that disrupts legitimate business operations and does not detect exfiltration—it only prevents it, and attackers can use other channels (e.g., email, FTP). Option D is wrong because network-based DLP inspecting image file headers (e.g., EXIF, IHDR) cannot detect hidden data embedded in pixel values; steganography hides data in the image's raw pixel data, not in headers, so header inspection misses the payload entirely.

Practice this question →

MCQmedium

After gaining access to a system, an attacker modifies log files to remove evidence of their activities. This action is part of which phase of the system hacking methodology?

A.Spying

B.Executing applications

C.Hiding files

D.Erasing tracks

AnswerD

Erasing tracks is a critical post-exploitation phase where an attacker systematically removes or alters forensic evidence of their presence and activities on a compromised system. This encompasses various anti-forensic techniques, including clearing system logs (e.g., Windows Event Logs, `auth.log`), modifying timestamps, deleting temporary files, and removing command history. Modifying log files directly falls under this comprehensive objective, aimed at hindering incident response and forensic investigations.

Why this answer

'Erasing tracks,' because after gaining access, the attacker's goal is to cover their footprints by modifying or deleting log files, clearing event logs, or using tools like `wevtutil` or `clearev` to remove evidence of their activities. This phase ensures the system administrator cannot detect the intrusion or trace the attacker's actions.

Exam trap

The trap here is that candidates confuse 'Hiding files' (option C) with 'Erasing tracks,' but hiding files focuses on concealing payloads, while erasing tracks specifically targets log files and audit trails to cover the attacker's digital footprint.

How to eliminate wrong answers

Option A is wrong because 'Spying' is not a recognized phase in the CEH system hacking methodology; it is a vague term that does not correspond to any specific phase like reconnaissance or maintaining access. Option B is wrong because 'Executing applications' refers to running tools or payloads during the 'Gaining Access' or 'Maintaining Access' phases, not the post-exploitation cleanup of logs. Option C is wrong because 'Hiding files' involves concealing malicious files using techniques like NTFS alternate data streams or rootkits, which is part of the 'Maintaining Access' phase, not the specific act of erasing log evidence.

Practice this question →

MCQeasy

A security analyst suspects an attacker has used a rainbow table to crack password hashes from a compromised system. Which password cracking technique involves precomputed hash chains?

A.Rainbow table attack

B.Dictionary attack

C.Brute force attack

D.Hybrid attack

AnswerA

A rainbow table attack leverages large, precomputed tables containing chains of hash values and their corresponding plaintext passwords. This method significantly speeds up the process of reversing cryptographic hashes to recover the original password, bypassing the need for real-time computation for each guess. Attackers use these tables to quickly find passwords from stolen hash databases by looking up the hash and tracing back the chain. This precomputation makes it highly effective against unsalted hashes.

Why this answer

A rainbow table attack is the correct answer because it specifically uses precomputed hash chains to reverse cryptographic hash functions. Rainbow tables are a form of time-memory trade-off where chains of hashes are computed and stored, allowing an attacker to look up a hash and quickly find the original plaintext without recomputing all possible hashes. This technique is distinct from other methods because it relies on precomputation rather than real-time guessing or dictionary lookups.

Exam trap

The trap here is that candidates often confuse 'precomputed hash chains' with a dictionary attack, thinking that a dictionary file is a form of precomputation, but a dictionary attack still requires real-time hashing of each word, whereas rainbow tables store the chain endpoints for instant lookup.

How to eliminate wrong answers

Option B (Dictionary attack) is wrong because it uses a list of likely passwords (words from a dictionary) and hashes each in real time, not precomputed hash chains. Option C (Brute force attack) is wrong because it tries every possible combination of characters sequentially, without any precomputation or stored chains. Option D (Hybrid attack) is wrong because it combines dictionary words with variations (e.g., appending numbers or symbols) but still performs real-time hashing, not precomputed chains.

Practice this question →

MCQmedium

A tester runs 'snmpwalk -v2c -c public 192.168.1.1' and receives a large amount of system information. What does this command do?

A.It walks the SNMP MIB tree using version 2c and the public community string.

B.It performs a brute-force attack on SNMP community strings.

C.It enumerates users on a Windows domain.

D.It sets SNMP values using the private community string.

AnswerA

The `snmpwalk` command is specifically designed to query a network device and retrieve all information available within its Management Information Base (MIB) tree, starting from a specified OID (or the root if none is given). The `v2c` flag explicitly dictates the use of SNMP version 2c, which offers improved security and data types over v1. The `c public` argument specifies "public" as the community string, acting as a password for read-only access to the device's SNMP agent at IP address 192.168.1.1. This effectively performs a comprehensive enumeration of the device's configuration and status.

Why this answer

The `snmpwalk` command is used to retrieve a subtree of management values from an SNMP agent. The `-v2c` flag specifies SNMP version 2c, which uses community-based security, and `-c public` provides the community string 'public' (often the default read-only community). The command walks the entire MIB tree starting from the root, returning all available OID values, which explains the large amount of system information received.

Exam trap

The trap here is that candidates may confuse `snmpwalk` with a brute-force tool or think it can modify SNMP values, but the command strictly performs read-only enumeration using the specified community string.

How to eliminate wrong answers

Option B is wrong because `snmpwalk` does not perform brute-force attacks; tools like `onesixtyone` or `hydra` are used for brute-forcing SNMP community strings. Option C is wrong because `snmpwalk` enumerates SNMP MIB objects, not Windows domain users; tools like `enum4linux` or `ldapsearch` are used for domain user enumeration. Option D is wrong because `snmpwalk` only reads values (GET/GETNEXT requests) and does not set or write SNMP values; setting values requires `snmpset` with a read-write community string like 'private'.

Practice this question →

MCQhard

A penetration tester is attempting to escalate privileges on a Linux target. The tester runs `find / -perm -4000 -type f 2>/dev/null` and discovers that `/usr/bin/pkexec` has the SUID bit set. The target runs Ubuntu 20.04 with default configurations. Which of the following is the MOST likely next step?

A.Exploit the pkexec vulnerability (CVE-2021-4034) to gain root access

B.Change the ownership of the pkexec binary to root:root

C.Use pkexec to execute a command as root directly

D.Remove the SUID bit from pkexec to prevent misuse

AnswerA

This option is correct because CVE-2021-4034, known as "PwnKit," is a critical local privilege escalation vulnerability in the `pkexec` utility. It allows an unprivileged local attacker to gain full root privileges on a vulnerable Linux system by exploiting a memory corruption bug (out-of-bounds write) in how `pkexec` handles command-line arguments. This specific exploit path directly provides the means to achieve root access, fulfilling the objective of privilege escalation.

Why this answer

CVE-2021-4034 (PwnKit) is a memory corruption vulnerability in pkexec that allows unprivileged users to escalate privileges to root by exploiting an out-of-bounds write in the argument parsing logic. On Ubuntu 20.04 with default configurations, the pkexec binary is SUID root and vulnerable to this exploit, making it the most direct and effective next step for privilege escalation.

Exam trap

The trap here is that candidates may assume pkexec requires a password for all commands (Option C) or think that removing the SUID bit is a valid escalation step (Option D), when in fact the vulnerability bypasses authentication entirely and the goal is exploitation, not hardening.

How to eliminate wrong answers

Option B is wrong because changing ownership of the pkexec binary to root:root is already the default state and does not aid in privilege escalation; it would actually require root privileges to perform. Option C is wrong because pkexec does not allow arbitrary command execution as root without proper authorization; it enforces PolicyKit authentication and will prompt for a password unless the user has specific polkit rules. Option D is wrong because removing the SUID bit from pkexec would prevent any exploitation of the binary, but this is a remediation step, not an escalation step, and the tester's goal is to gain root access, not to harden the system.

Practice this question →

MCQeasy

Which of the following is the PRIMARY purpose of steganography in the context of covering tracks after a system compromise?

A.To hide data within other files to avoid detection

B.To create a backdoor for future access

C.To delete system logs permanently

D.To encrypt log files so they cannot be read

AnswerA

Steganography's core purpose is to embed secret information within seemingly innocuous digital media, such as images, audio, or video files. This technique aims to conceal the very existence of the hidden data, making it difficult for an observer to even suspect that secret communication is taking place. Unlike encryption, which scrambles data, steganography focuses on covert communication by making the data appear as part of a benign carrier file, thereby avoiding detection.

Why this answer

The primary purpose of steganography in covering tracks is to hide stolen data or malicious payloads within innocuous files (e.g., images, audio, video) so that forensic tools and analysts do not detect the exfiltration or persistence. Unlike encryption, which makes data unreadable but still visible, steganography conceals the very existence of the hidden data, allowing an attacker to bypass network monitoring and file inspection. This aligns with the CEH objective of covering tracks by avoiding detection of unauthorized data transfers.

Exam trap

The trap here is that candidates confuse steganography with encryption or log manipulation, mistakenly thinking its primary purpose is to secure data (like encryption) or to remove evidence (like log deletion), rather than to conceal the existence of the data itself.

How to eliminate wrong answers

Option B is wrong because creating a backdoor is a separate post-exploitation activity (e.g., using netcat or Meterpreter) and not a function of steganography, which focuses on hiding data rather than providing access. Option C is wrong because permanently deleting system logs is typically achieved with log-wiping tools (e.g., `wevtutil` on Windows or `shred` on Linux), not steganography, which does not delete files. Option D is wrong because encrypting log files (e.g., with AES) makes them unreadable but still visible as encrypted blobs, whereas steganography hides data within other files to avoid suspicion entirely.

Practice this question →

MCQhard

An attacker uses 'rpcclient -U '' -N 192.168.1.10' followed by 'enumdomusers' and 'enumdomgroups'. What type of enumeration is being performed, and which protocol does it rely on?

A.LDAP enumeration over port 389

B.SMB/RPC enumeration over port 445

C.NetBIOS enumeration over port 139

D.SNMP enumeration over port 161

AnswerB

The `rpcclient` utility is a powerful tool for interacting with Microsoft Remote Procedure Call (MS-RPC) services, which are commonly transported over Server Message Block (SMB) on TCP port 445. The command `rpcclient -U n 192.168.1.10` attempts to establish a null session (unauthenticated connection) to the target, allowing an attacker to enumerate various system details like user lists, share information, and group memberships by making RPC calls. This makes it a primary method for SMB/RPC enumeration.

Why this answer

The `rpcclient` tool with the `-U '' -N` flags performs a null session connection to a Windows system over the SMB protocol. The subsequent `enumdomusers` and `enumdomgroups` commands enumerate domain users and groups via MS-RPC (Remote Procedure Call) functions, which are transported over SMB. By default, modern Windows systems use SMB over port 445, making option B the correct choice.

Exam trap

The trap here is that candidates confuse the underlying protocol (SMB/RPC on port 445) with the older NetBIOS session service (port 139), or mistakenly associate user/group enumeration solely with LDAP, not realizing that `rpcclient` uses MS-RPC over SMB.

How to eliminate wrong answers

Option A is wrong because LDAP enumeration typically uses `ldapsearch` or similar tools over port 389, not `rpcclient` commands like `enumdomusers`. Option C is wrong because NetBIOS enumeration uses `nbtstat` or `nbtscan` over port 139, and while older SMB could run over NetBIOS, the given command targets port 445 directly (default for modern SMB). Option D is wrong because SNMP enumeration uses tools like `snmpwalk` over UDP port 161, and `rpcclient` does not interact with SNMP at all.

Practice this question →

MCQeasy

Which tool is specifically designed to crack Windows LM and NTLM hashes using rainbow tables?

A.Hashcat

B.Ophcrack

C.RainbowCrack

D.John the Ripper

AnswerB

Ophcrack is a specialized tool explicitly engineered for cracking Windows LM and NTLM hashes by utilizing precomputed rainbow tables. It comes bundled with these tables, which significantly accelerate the process of recovering passwords, especially shorter or less complex ones, from these specific Windows authentication protocols. Its design is entirely centered around the time-memory tradeoff inherent in rainbow table attacks, making it highly effective for its intended purpose.

Why this answer

Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted use case.

Exam trap

The trap here is that candidates often confuse RainbowCrack (a general rainbow table tool) with Ophcrack (the Windows-specific rainbow table cracker), or assume that any GPU-based cracker like Hashcat is equally suited for this specific task.

How to eliminate wrong answers

Option A is wrong because Hashcat is a general-purpose password cracker that uses GPU acceleration and supports many hash types, but it is not specifically designed for rainbow table attacks on Windows LM/NTLM hashes. Option C is wrong because RainbowCrack is a tool that generates and uses rainbow tables for various hash algorithms, but it is not exclusively focused on Windows LM/NTLM hashes and lacks the integrated Windows-specific features of Ophcrack. Option D is wrong because John the Ripper is a versatile password cracking tool that supports many hash formats and modes (including brute-force and dictionary attacks), but it is not purpose-built for rainbow table attacks on Windows LM/NTLM hashes.

Practice this question →

MCQeasy

A security analyst uses the nbtstat -a command against a target IP address. What information is the analyst MOST likely attempting to retrieve?

A.Active directory domain controllers

B.List of all open TCP ports

C.NetBIOS name table of the remote machine

D.The MAC address of the target

AnswerC

The `nbtstat -a <IP_address>` command is specifically used to query and display the NetBIOS name table of a remote machine. This table contains a list of NetBIOS names registered by the target host, including unique names (e.g., workstation name, messenger service) and group names (e.g., domain/workgroup name), along with their associated types and registration status. This information is crucial for understanding the remote machine's NetBIOS identity and services.

Why this answer

The nbtstat -a command is used to query the NetBIOS name table of a remote machine by its IP address. This table contains the NetBIOS names registered by the remote host, such as the computer name, workgroup/domain, and any services running over NetBIOS (e.g., file sharing). The analyst is most likely attempting to enumerate these names for reconnaissance or to identify potential targets for further exploitation.

Exam trap

The trap here is that candidates often confuse nbtstat -a with retrieving only the MAC address, because the output does display a MAC address line, but the command's primary function is to enumerate the NetBIOS name table.

How to eliminate wrong answers

Option A is wrong because nbtstat does not query Active Directory domain controllers; that would require tools like nslookup or dsquery. Option B is wrong because nbtstat does not list open TCP ports; port scanning is done with tools like Nmap or netstat. Option D is wrong because while nbtstat can display the MAC address in its output (under the 'MAC Address' field), the primary purpose of the -a switch is to retrieve the NetBIOS name table, not just the MAC address.

Practice this question →

MCQmedium

A penetration tester has obtained a copy of the SAM database from a Windows system. The hashes extracted include both LM and NTLM hashes. Which of the following tools would be MOST efficient to crack the NTLM hashes using a dictionary attack with GPU acceleration?

A.John the Ripper

B.Ophcrack

C.Hashcat

D.RainbowCrack

AnswerC

Hashcat is the industry-standard tool for high-performance password recovery, leveraging highly optimized GPU acceleration to crack a vast array of hash types, including NTLM (mode 1000). Its architecture is specifically designed to maximize parallel processing on graphics cards, enabling exceptionally fast dictionary attacks, brute-force, and hybrid attacks. This unparalleled efficiency makes Hashcat the optimal choice for rapidly cracking NTLM hashes obtained from a SAM database dump, significantly reducing the time required compared to CPU-based or rainbow table methods.

Why this answer

Hashcat is the most efficient tool for GPU-accelerated dictionary attacks against NTLM hashes because it is purpose-built for high-speed password cracking using OpenCL and CUDA, directly leveraging GPU parallelism. It supports the NTLM hash mode (1000) and can process millions of hashes per second, far outperforming CPU-based tools like John the Ripper for this specific task.

Exam trap

The trap here is that candidates confuse Ophcrack's LM hash rainbow table capability with NTLM cracking, or assume John the Ripper's general-purpose nature makes it equally efficient for GPU-accelerated tasks, when Hashcat is the de facto standard for GPU-based password cracking.

How to eliminate wrong answers

Option A is wrong because John the Ripper, while capable of cracking NTLM hashes, primarily runs on CPU and does not natively support GPU acceleration as efficiently as Hashcat; its GPU support is limited and requires separate builds or patches. Option B is wrong because Ophcrack is a specialized tool for cracking LM hashes using rainbow tables, not NTLM hashes, and it does not support GPU acceleration or dictionary attacks. Option D is wrong because RainbowCrack is designed for rainbow table attacks, not dictionary attacks, and while it can use GPU acceleration, it is not optimized for NTLM hash cracking via dictionary methods.

Practice this question →

100

MCQmedium

During a network assessment, you use SNMPwalk against a target. Which of the following is a prerequisite for successful SNMP enumeration?

A.An open TCP port 161

B.The target must be running Linux

C.Knowledge of the SNMP community string

D.A valid username and password

AnswerC

For SNMPv1 and SNMPv2c, the community string serves as a clear-text password or authentication credential required to access the SNMP agent's Management Information Base (MIB). Without knowing the correct read-only or read-write community string, an `snmpwalk` utility cannot successfully query the device for its managed objects. This string effectively controls access permissions, allowing or denying the retrieval of system information and acting as the primary security mechanism for these older SNMP versions.

Why this answer

SNMP enumeration relies on the SNMP community string, which acts as a password-like credential for read or read/write access to MIB data. Without the correct community string (defaults are often 'public' for read-only and 'private' for read-write), SNMPwalk cannot authenticate with the target agent and will fail to retrieve any OID values.

Exam trap

The trap here is that candidates often confuse SNMP's UDP port 161 with TCP or assume SNMP requires a username/password like SSH, but the CEH exam emphasizes that the community string is the sole authentication token for SNMPv1/v2c enumeration.

How to eliminate wrong answers

Option A is wrong because SNMP uses UDP port 161, not TCP, for agent communication; SNMPwalk sends UDP packets, so an open TCP port 161 is irrelevant. Option B is wrong because SNMP enumeration is platform-agnostic—it works against any device running an SNMP agent, including Windows, routers, switches, and printers. Option D is wrong because SNMP does not use usernames and passwords; it uses community strings as a simple authentication mechanism, and valid credentials would only apply to protocols like SSH or Telnet, not SNMP.

Practice this question →

101

MCQmedium

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

A.Information disclosure; read sensitive files

B.Privilege escalation; gain root access

C.Denial of service; crash the system

D.Buffer overflow; execute arbitrary code

AnswerB

A SUID (Set User ID) bit on an executable allows it to run with the permissions of its owner, regardless of the user executing it. If a binary is owned by the root user and has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that execution. This mechanism is specifically designed for privilege escalation, enabling a low-privileged user to perform actions typically reserved for root, such as gaining a root shell or modifying system configurations.

Why this answer

A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

Exam trap

EC-Council often tests the distinction between a vulnerability (like a buffer overflow) and an indicator of a completed exploit (like a SUID binary), causing candidates to confuse the attack vector with the attacker's objective.

How to eliminate wrong answers

Option A is wrong because information disclosure typically involves reading sensitive files via misconfigured permissions or services (e.g., world-readable /etc/shadow), not a custom SUID binary. Option C is wrong because a denial of service attack aims to crash or exhaust system resources, whereas a SUID binary is specifically designed to grant elevated privileges, not disrupt availability. Option D is wrong because a buffer overflow exploits memory corruption to execute arbitrary code, but the presence of a suspicious SUID binary itself does not indicate a buffer overflow; it indicates a pre-placed privilege escalation mechanism.

Practice this question →

102

MCQhard

During a penetration test, you enumerate a Linux NFS server and discover that the /export directory is mounted with 'no_root_squash' and 'world_readable' permissions. Which of the following actions would allow you to escalate to root access on the NFS client?

A.Create a symbolic link to /etc/shadow on the server from the client

B.Use 'showmount -e' to list exports and then mount the share with 'mount -t nfs -o vers=3'

C.Mount the share, create a setuid binary owned by root, then execute it on the client

D.Run 'sudo nmap --script nfs-ls' to list files on the export

AnswerC

If the NFS server's export configuration includes `no_root_squash`, a client logged in as root can create files on the mounted share that retain root ownership on the server. By compiling a simple C program with the SUID bit set on this share, and then executing it on the client, the program will run with root privileges. This effectively escalates privileges on the client system by leveraging the server's trust in the client's root user, allowing arbitrary commands to execute as root.

Why this answer

Mounting an NFS export with 'no_root_squash' means that root on the client is treated as root on the server. By creating a setuid binary owned by root on the mounted share, any user on the client can execute that binary and gain root privileges on the client system, effectively escalating from a regular user to root.

Exam trap

The trap here is that candidates often confuse 'no_root_squash' with allowing direct access to sensitive files like /etc/shadow, but the actual exploit requires creating a setuid binary to escalate privileges on the client, not just reading server files.

How to eliminate wrong answers

Option A is wrong because creating a symbolic link to /etc/shadow on the server from the client would only allow reading the shadow file if the client user has appropriate permissions, but it does not provide root escalation on the client; the link is resolved on the server, not the client. Option B is wrong because 'showmount -e' and mounting with 'mount -t nfs -o vers=3' are standard enumeration and mounting steps that do not by themselves escalate privileges; they only provide access to the exported filesystem. Option D is wrong because 'sudo nmap --script nfs-ls' is used to list files on the NFS export, but it does not create a setuid binary or exploit the 'no_root_squash' setting to gain root on the client.

Practice this question →

103

Multi-Selectmedium

Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)

Select 2 answers

A.smbclient -L //target -U ''

B.snmpwalk -v2c -c public target

C.nmap -sU -p 445 target

D.nbtstat -A target

E.enum4linux -a target

AnswersA, E

smbclient -L lists available shares.

Why this answer

`smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.

Exam trap

The trap here is that candidates often confuse NetBIOS enumeration (using `nbtstat`) with SMB share enumeration, or they mistakenly think UDP scans on port 445 (which is TCP-only) are valid for SMB discovery.

Practice this question →

104

MCQmedium

A penetration tester uses the SMTP commands VRFY and EXPN on a mail server. What is the tester MOST likely trying to accomplish?

A.To enumerate valid email addresses and distribution lists

B.To extract email content from the server

C.To perform a mail relay attack

D.To test for open relay

AnswerA

The SMTP commands VRFY (Verify) and EXPN (Expand) are powerful reconnaissance tools for penetration testers. VRFY is used to confirm the existence of a specific user or mailbox on the target mail server, returning either a valid user name or an error. EXPN, conversely, is designed to reveal the full membership of a mailing list or alias, providing a list of all individual recipients. Both commands, if not properly restricted, allow an attacker to enumerate valid email addresses and distribution lists, which is invaluable for targeted phishing, spam campaigns, or further social engineering efforts.

Why this answer

The VRFY command asks the mail server to verify whether a given email address exists, while EXPN requests the members of a mailing list or alias. By issuing these commands, the tester can enumerate valid user accounts and distribution lists on the server, which is a key step in building a target list for further attacks such as password guessing or phishing.

Exam trap

The trap here is that candidates confuse VRFY/EXPN with open relay testing, but open relay is verified using the RCPT TO command with an external domain, not address verification or list expansion.

How to eliminate wrong answers

Option B is wrong because VRFY and EXPN only return address existence or list membership, not the content of stored emails; extracting email content would require protocols like IMAP or POP3 with valid credentials. Option C is wrong because a mail relay attack involves using the server to send unauthorized email to external domains, which is tested with the SMTP 'RCPT TO' command, not VRFY or EXPN. Option D is wrong because testing for open relay is done by sending a test email with a RCPT TO pointing to an external domain and observing if the server accepts it without authentication; VRFY and EXPN do not test relay behavior.

Practice this question →

105

MCQhard

After gaining initial access to a Windows server, a penetration tester wants to escalate privileges. The tester finds that the current user has the 'SeImpersonatePrivilege' enabled. Which attack technique could the tester use to abuse this privilege?

A.SUID bit abuse

B.Pass-the-Hash attack

C.Token impersonation via Juicy Potato

D.Log manipulation to hide tracks

AnswerC

Juicy Potato is a well-known Windows privilege escalation tool that exploits the SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege often held by services running as SYSTEM. It leverages specific COM server CLSIDs and a local NTLM relay attack to force a high-privileged process (e.g., BITS, Print Spooler) to authenticate back to a listener controlled by the low-privileged attacker. This process allows the attacker to capture and impersonate the SYSTEM user's security token, thereby escalating privileges to SYSTEM.

Why this answer

The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. Juicy Potato (and its variants like RoguePotato) exploits this by coercing the SYSTEM account to connect to a malicious named pipe, capturing its token, and using it to spawn a process with SYSTEM privileges. This is a well-known privilege escalation technique on Windows systems where the user has the SeImpersonatePrivilege.

Exam trap

The trap here is that candidates confuse SeImpersonatePrivilege with other Windows privileges (like SeDebugPrivilege) or mistakenly associate it with Linux-based SUID attacks, leading them to choose option A or B.

How to eliminate wrong answers

Option A is wrong because SUID bit abuse is a Linux/Unix privilege escalation technique that relies on the set-user-ID permission bit, which has no equivalent on Windows. Option B is wrong because Pass-the-Hash is a lateral movement or credential reuse attack that uses NTLM hashes to authenticate, not a technique to abuse the SeImpersonatePrivilege for local privilege escalation. Option D is wrong because log manipulation is a post-exploitation stealth technique to cover tracks, not a method to escalate privileges using a specific user right.

Practice this question →

106

MCQmedium

A security analyst observes repeated log entries showing `EXPN` commands from an external IP address to the company's mail server. What is the MOST likely objective of this activity?

A.Testing SMTP authentication mechanisms

B.Attempting to perform a denial-of-service attack

C.Enumerating valid email addresses and mailing list members

D.Delivering spam emails through open relay

AnswerC

The `EXPN` (Expand) command in SMTP is specifically designed to request the server to return the actual delivery addresses for a given mailing list, alias, or even a single user. By issuing `EXPN <address>`, a security analyst or attacker can determine if an address is valid and, if it represents a list or alias, retrieve all the individual email addresses associated with it, aiding in reconnaissance and target identification.

Why this answer

The `EXPN` command is part of the SMTP protocol (RFC 5321) and is used to expand a mailing list or alias, revealing the individual email addresses that belong to it. By repeatedly issuing `EXPN` commands, an attacker can enumerate valid email addresses and mailing list members, which is a reconnaissance technique for gathering targets for phishing or social engineering. This aligns with the enumeration phase of system hacking, where the goal is to extract user and service information.

Exam trap

The trap here is that candidates confuse `EXPN` with `VRFY` (which verifies a single user) or assume any SMTP command is part of an attack delivery mechanism, rather than recognizing it as a reconnaissance technique for user enumeration.

How to eliminate wrong answers

Option A is wrong because `EXPN` does not test SMTP authentication; authentication is handled by commands like `AUTH` (e.g., LOGIN, PLAIN), and `EXPN` is typically available before or without authentication. Option B is wrong because a denial-of-service attack would involve flooding the server with high-volume traffic or exploiting resource exhaustion, not sending `EXPN` commands which are low-bandwidth and designed for information retrieval. Option D is wrong because delivering spam through open relay requires the server to accept mail for arbitrary recipients via `RCPT TO`, not `EXPN`; `EXPN` only expands aliases and does not inject messages.

Practice this question →

107

MCQhard

A forensic analyst discovers that an attacker used a rootkit to hide malicious processes and files on a compromised Linux system. The rootkit also intercepts system calls to `open()` and `stat()` to return clean results. Which of the following techniques is the rootkit using to cover its tracks?

A.Steganography to conceal malicious files in image metadata

B.Token impersonation to gain administrator privileges

C.Syscall hooking to modify the return values of userland commands

D.Log manipulation by clearing entries in /var/log

AnswerC

Syscall hooking is a sophisticated technique employed by kernel-mode rootkits to achieve stealth by intercepting and modifying the behavior of system calls. When userland commands like `ls`, `ps`, or `netstat` attempt to query system information (e.g., `open()`, `read()`, `stat()`, `getdents()`), the rootkit's hook diverts these calls to its own code. It then filters out any references to its own files, processes, or network connections before returning manipulated, "clean" data to the calling application, effectively making its presence invisible to standard system utilities.

Why this answer

The rootkit intercepts system calls like `open()` and `stat()` to return clean results, which is a classic example of syscall hooking. By hooking these kernel-level functions, the rootkit can filter out any information about its own malicious files and processes, making them invisible to userland commands such as `ls`, `ps`, or `cat`. This technique operates at the kernel level, not in user space, allowing it to control what data is returned to any process that makes those syscalls.

Exam trap

The trap here is that candidates may confuse syscall hooking with log manipulation or steganography, not realizing that the question specifically describes intercepting system calls to return clean results, which is the hallmark of kernel-level rootkit hiding, not file-level or log-level concealment.

How to eliminate wrong answers

Option A is wrong because steganography hides data within other files (e.g., image metadata) but does not intercept system calls or hide running processes; it is a data concealment technique, not a rootkit hiding mechanism. Option B is wrong because token impersonation is a Windows-specific privilege escalation technique that involves duplicating access tokens, not a Linux rootkit method for hiding files or processes via syscall interception. Option D is wrong because log manipulation (clearing /var/log entries) removes evidence from log files but does not intercept system calls or hide active processes and files from commands like `ps` or `ls`; it is a post-exploitation cleanup step, not the core hiding technique described.

Practice this question →

108

MCQhard

A penetration tester captures the following output from a command: 'smb: \> ls \\192.168.1.20\C$'. The tester is able to list the contents of the C$ share without providing credentials. Which of the following is the MOST likely reason for this access?

A.The C$ share is intentionally shared with Everyone

B.The target is running a Samba server with weak permissions

C.The target has a null session vulnerability that allows access to admin shares

D.The tester is using a pass-the-hash attack

AnswerC

A null session is an unauthenticated connection to a Windows IPC$ share, primarily intended for anonymous enumeration of system information. In older Windows versions (e.g., NT, 2000, XP) or systems with specific misconfigurations, these null sessions could be exploited to gain unauthorized access to administrative shares like C$ without requiring any user credentials. This vulnerability directly explains how a penetration tester could access C$ in the absence of explicit authentication, aligning with the scenario.

Why this answer

The output shows the tester successfully listing the C$ share (a default administrative share) without providing credentials. This is a classic indicator of a null session vulnerability, where Windows allows unauthenticated access to IPC$ and, in some configurations, admin shares via SMB. The tester is leveraging the default null session to enumerate or access these shares, which is a well-known weakness in older Windows systems or misconfigured Samba servers.

Exam trap

The trap here is that candidates often confuse null session access with pass-the-hash or weak permissions, but the key clue is the absence of any credential usage in the command, which directly points to the null session vulnerability.

How to eliminate wrong answers

Option A is wrong because the C$ share is a hidden administrative share that is not shared with Everyone by default; it is only accessible to members of the Administrators group. Option B is wrong because while a Samba server with weak permissions could allow unauthorized access, the specific command accessing C$ without credentials points to a null session vulnerability, not merely weak permissions. Option D is wrong because a pass-the-hash attack requires a captured NTLM hash and is used to authenticate as a specific user, not to gain unauthenticated access to admin shares; the tester did not provide any credentials or hashes.

Practice this question →

109

Multi-Selectmedium

Which TWO of the following are valid methods for enumerating users on a SMTP server? (Select 2)

Select 2 answers

A.EXPN

B.MAIL FROM

C.RCPT TO

D.VRFY

E.AUTH

AnswersA, D

The SMTP EXPN (Expand) command is a valid method for enumerating users by requesting the expansion of a mailing list or alias. When a server processes an EXPN command for a known list, it typically returns the individual email addresses of all members, thereby revealing valid user accounts on the system. This direct disclosure of recipient lists makes it a powerful tool for reconnaissance during the enumeration phase.

Why this answer

EXPN (Expand) and VRFY (Verify) are SMTP commands defined in RFC 821 that allow an attacker to enumerate valid email addresses and mailing list members on a mail server. EXPN reveals the members of a mailing list, while VRFY confirms whether a specific mailbox exists. Both commands are often disabled in production to prevent user enumeration.

Exam trap

The trap here is that candidates confuse RCPT TO (which can indirectly reveal user existence through response codes) with a dedicated enumeration command, but the CEH exam specifically expects VRFY and EXPN as the two valid SMTP enumeration methods.

Practice this question →

110

MCQmedium

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

A.EXPN enumeration

B.SMTP banner grabbing

C.RCPT TO enumeration

D.VRFY enumeration

AnswerD

The VRFY command verifies whether a mailbox exists, and the response codes confirm this technique.

Why this answer

The VRFY command is an SMTP command defined in RFC 821 that asks the server to verify whether a given email address exists. When the server responds with '250 OK' for a valid address and '550 No such user' for an invalid one, the attacker is directly using the VRFY command to enumerate valid users. This is explicitly known as VRFY enumeration.

Exam trap

The trap here is that candidates confuse VRFY with RCPT TO, but the question explicitly states the VRFY command is used, making 'VRFY enumeration' the only correct answer.

How to eliminate wrong answers

Option A is wrong because EXPN (Expand) is used to list members of a mailing list or alias, not to verify individual email addresses. Option B is wrong because SMTP banner grabbing involves reading the server's initial greeting banner to identify software/version, not sending VRFY commands. Option C is wrong because RCPT TO enumeration uses the RCPT TO command during the mail transaction to verify recipients, not the standalone VRFY command.

Practice this question →

111

MCQhard

A forensic analyst examining a compromised Linux system finds the following entry in /var/log/auth.log: `Mar 15 10:23:45 server sshd[1234]: Accepted password for root from 10.0.0.5 port 54321 ssh2`. However, the analyst also notices that /var/log/auth.log has been truncated and the /etc/ssh/sshd_config file contains `LogLevel QUIET`. Which attack phase is most likely being obscured?

A.Privilege escalation

B.Executing applications

C.Spying

D.Erasing tracks

AnswerD

Erasing tracks is a critical post-exploitation phase where an attacker attempts to remove or obscure any evidence of their presence and activities on a compromised system. This directly involves manipulating system logs, such as /var/log/auth.log or ~/.bash_history, by truncating, deleting, or modifying entries. Reducing logging levels or disabling logging services are also common techniques to prevent future actions from being recorded, thereby making forensic analysis significantly more challenging and hindering incident response efforts.

Why this answer

The presence of `LogLevel QUIET` in sshd_config suppresses all authentication log entries, and the truncation of /var/log/auth.log indicates an attempt to remove evidence of unauthorized access. Together, these actions are classic examples of erasing tracks, as the attacker is modifying logs and configuration to hide their activities from forensic analysis.

Exam trap

The trap here is that candidates may confuse log manipulation with privilege escalation or execution phases, but the CEH exam specifically tests the 'Erasing Tracks' phase (part of the System Hacking domain) where attackers modify or delete logs, alter timestamps, or disable auditing to avoid detection.

How to eliminate wrong answers

Option A is wrong because privilege escalation involves gaining higher-level permissions (e.g., via SUID exploits or kernel vulnerabilities), not manipulating SSH logging or truncating auth logs. Option B is wrong because executing applications refers to running malicious code or tools on the system, which is a separate phase after access is obtained. Option C is wrong because spying (or exfiltration) involves covertly monitoring or stealing data, whereas the evidence here points to covering up the intrusion itself, not ongoing surveillance.

Practice this question →

112

Multi-Selecthard

During a penetration test, the tester successfully cracks a password hash using a hybrid attack. Which THREE characteristics describe a hybrid attack? (Select three.)

Select 3 answers

A.Applies mutations like appending numbers or symbols

B.Tries every possible combination of characters

C.Combines dictionary and brute-force mutations

D.Relies on precomputed hash chains

E.Uses a wordlist as a base

AnswersA, C, E

This technique involves taking words from a dictionary or wordlist and systematically modifying them using predefined rulesets. Common mutations include appending numbers (e.g., "password123"), prepending or appending special characters (e.g., "!password", "password!"), or changing case (e.g., "Password"). This method significantly expands the attack surface beyond simple dictionary words, effectively targeting users who create passwords by slightly altering common terms.

Why this answer

A hybrid attack applies mutations such as appending numbers or symbols to dictionary words, which is a core characteristic of this attack type. This technique combines the efficiency of a wordlist with the flexibility of brute-force modifications, making it effective against passwords that follow common patterns like 'password123'.

Exam trap

The trap here is that candidates often confuse hybrid attacks with pure brute-force or rainbow table attacks, failing to recognize that hybrid attacks specifically combine a wordlist with rule-based mutations.

Practice this question →

113

MCQhard

An attacker has gained access to a Linux server and wants to cover their tracks. They edit the `.bash_history` file, modify system logs in `/var/log`, and install a kernel module that hides their processes. Which two steps of the system hacking methodology (CHPSET) are being performed?

A.Erasing tracks and Privilege escalation

B.Cracking passwords and Covering tracks

C.Erasing tracks and Spying

D.Executing applications and Spying

AnswerC

"Erasing tracks" accurately describes the act of cleaning logs and command history, which are critical steps for an attacker to remove evidence of their presence and activities on a compromised system. Simultaneously, "Spying" precisely characterizes the installation of a kernel module designed to hide processes. This module enables the attacker to maintain a stealthy, persistent foothold, allowing for undetected monitoring and control, effectively 'spying' on the system's operations without revealing their malicious presence.

Why this answer

The attacker is performing 'Erasing tracks' by editing .bash_history and modifying logs in /var/log, and 'Spying' by installing a kernel module to hide processes, which allows continued covert monitoring. These correspond to the 'Erasing tracks' and 'Spying' steps in the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Executing applications, Erasing tracks) methodology.

Exam trap

The trap here is confusing 'Erasing tracks' with 'Covering tracks' (they are the same step) and failing to recognize that installing a kernel module to hide processes is a spying/monitoring activity, not privilege escalation or executing applications.

How to eliminate wrong answers

Option A is wrong because privilege escalation involves gaining higher-level permissions (e.g., via SUID exploits or kernel vulnerabilities), not modifying logs or hiding processes. Option B is wrong because cracking passwords is a separate step involving tools like John the Ripper or hashcat, and while 'Covering tracks' is synonymous with 'Erasing tracks', the pair does not match the two actions described (spying is also performed). Option D is wrong because executing applications refers to running malware or payloads (e.g., backdoors), not hiding processes with a kernel module, and spying is only one of the two actions.

Practice this question →

114

MCQmedium

A penetration tester obtains a list of password hashes and uses RainbowCrack. Which statement BEST describes how RainbowCrack works?

A.It uses a dictionary attack with word mangling rules

B.It uses online password guessing against the target service

C.It uses a brute-force attack by trying all possible character combinations

D.It uses time-memory trade-off with precomputed hash chains

AnswerD

This option is correct because rainbow tables are a prime example of a time-memory trade-off technique in cryptography. They involve a significant upfront investment in computational time to precompute vast tables (requiring substantial memory storage) containing chains of hashes and their corresponding plaintext values. This extensive precomputation allows for extremely rapid lookup and cracking of captured password hashes later, as the system avoids the need to recompute every possible password combination for each target hash.

Why this answer

RainbowCrack implements a time-memory trade-off attack by precomputing hash chains for a given set of passwords and storing them in rainbow tables. When a password hash is provided, the tool looks up the hash in these tables to reverse it, avoiding the need to recompute hashes for every possible password. This makes it far faster than brute-force for cracking hashes, provided the password is covered by the precomputed chains.

Exam trap

EC-Council often tests the distinction between offline hash-cracking tools (like RainbowCrack) and online password-guessing attacks, so the trap here is confusing a precomputed table attack (time-memory trade-off) with a brute-force or dictionary attack that computes hashes in real time.

How to eliminate wrong answers

Option A is wrong because a dictionary attack with word mangling rules (e.g., using John the Ripper or Hashcat with rules) does not rely on precomputed tables; it generates candidate passwords on the fly and hashes them. Option B is wrong because RainbowCrack works offline against captured hashes, not by guessing passwords against a live service (that would be an online brute-force or password spraying attack). Option C is wrong because a brute-force attack tries all possible character combinations sequentially, which is computationally expensive and does not use the time-memory trade-off or precomputed hash chains that define RainbowCrack.

Practice this question →

115

MCQmedium

A security analyst runs the following command: 'smbclient -L //192.168.1.50 -N'. What is the purpose of this command?

A.Connect to the remote host's SMB share with a null password

B.Perform a dictionary attack on SMB passwords

C.Enumerate users via SMB

D.List available SMB shares on the remote host anonymously

AnswerD

The `smbclient -L <hostname>` command is precisely used to query a remote SMB server and list all available shares, printers, and other network resources it is exporting. When executed without specifying a username or password, it defaults to attempting an anonymous or guest login, effectively listing shares without requiring authentication. This is a common reconnaissance technique to discover potential targets and map out the network's shared infrastructure.

Why this answer

The `smbclient -L` command lists the available SMB shares on a remote host. The `-N` flag suppresses the password prompt, effectively performing an anonymous (null session) enumeration of shares. This is a standard technique in the enumeration phase to discover accessible resources without authentication.

Exam trap

The trap here is confusing the `-L` (list shares) option with connecting to a share (`//server/share`), leading candidates to mistakenly think the command is attempting an anonymous login to a specific share.

How to eliminate wrong answers

Option A is wrong because `-L` lists shares, it does not connect to a specific share; connecting would use `//server/share` without `-L`. Option B is wrong because `smbclient` does not perform dictionary attacks natively; tools like `hydra` or `medusa` are used for that purpose. Option C is wrong because while SMB null sessions can enumerate users (e.g., via `enum4linux` or `rpcclient`), `smbclient -L` specifically lists shares, not users.

Practice this question →

116

MCQmedium

A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?

A.Perform a reverse DNS lookup

B.Display the NetBIOS name table of the remote host

C.Test connectivity to the remote host using ICMP

D.Enumerate DNS records for the domain

AnswerB

The `nbtstat -a <IP_address>` command is precisely used to display the NetBIOS name table of a remote host identified by its IP address. This utility queries the specified remote machine directly to retrieve the NetBIOS names it has registered, including its computer name, workgroup or domain name, and any services actively listening for NetBIOS connections. This functionality directly matches the described action of querying a remote host's NetBIOS name table.

Why this answer

The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.

Exam trap

The trap here is that candidates confuse `nbtstat -A` with DNS-related commands or ICMP-based tools, because they see an IP address in the command and assume it is performing a reverse lookup or connectivity test, rather than recognizing it as a NetBIOS-specific enumeration technique.

How to eliminate wrong answers

Option A is wrong because `nbtstat -A` does not perform a reverse DNS lookup; reverse DNS lookups are done with `nslookup` or `dig -x` and query PTR records in DNS, not NetBIOS names. Option C is wrong because testing connectivity using ICMP is the function of the `ping` command, not `nbtstat`, which operates at the NetBIOS session layer over TCP/UDP ports 137-139. Option D is wrong because enumerating DNS records for a domain is performed with tools like `nslookup`, `dig`, or `dnsrecon`, not with `nbtstat`, which only deals with NetBIOS names and their associated IP addresses on a local network segment.

Practice this question →

117

Multi-Selectmedium

Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)

Select 2 answers

A.Restrict SNMP access to trusted IP addresses using ACLs

B.Disable SNMP on all devices

C.Change default community strings to strong, unique values

D.Enable SNMPv3 with default passwords

E.Use SNMPv1 with community string 'private'

AnswersA, C

Correct: Restricting SNMP access via ACLs limits the attack surface by allowing only trusted IP addresses to query SNMP agents, thwarting enumeration from unauthorized hosts.

Why this answer

Effective SNMP enumeration countermeasures include (A) restricting SNMP access to trusted IP addresses via ACLs, which prevents unauthorized hosts from querying SNMP agents, and (C) changing default community strings to strong, unique values, making it harder for attackers to guess them. Option B (disabling SNMP) is impractical in many environments because SNMP is needed for network monitoring. Option D (enabling SNMPv3 with default passwords) is ineffective because default passwords are easily guessed.

Option E (using SNMPv1 with community string 'private') is the default and well-known, making enumeration trivial. Therefore, A and C are the correct choices.

Exam trap

Candidates often select 'Disable SNMP' (option B) as a universal solution, but the CEH exam expects recognition that SNMP is often necessary for monitoring; realistic countermeasures are restrictive ACLs and strong community strings. Also, avoid confusing 'changing community strings' alone as sufficient—ACLs are equally important.

Practice this question →

118

MCQhard

A penetration tester finds that a Linux binary has the SUID bit set and is owned by root. Which of the following does this indicate?

A.The binary is immutable and cannot be deleted

B.The binary can be executed only by the root user

C.The binary is a symbolic link to a root-owned file

D.The binary will run with root privileges when executed by any user

AnswerD

When the SUID (Set User ID) bit is set on an executable file, and that file is owned by the root user, any user who executes this binary will temporarily assume the effective user ID of the file owner. This means the program will run with root privileges for the duration of its execution, allowing it to perform actions that would normally require root access. This mechanism is crucial for system utilities that need elevated permissions to function correctly for all users.

Why this answer

When the SUID (Set User ID) bit is set on a binary owned by root, the binary executes with the effective user ID of the file owner (root), regardless of which user runs it. This allows any user to run the binary with root privileges, which is why option D is correct. The SUID bit is represented by an 's' in the owner's execute position (e.g., -rwsr-xr-x).

Exam trap

The trap here is that candidates often confuse the SUID bit with execution restrictions (option B) or file immutability (option A), but the SUID bit specifically grants privilege escalation, not access control or file protection.

How to eliminate wrong answers

Option A is wrong because the SUID bit does not make a file immutable; immutability is controlled by the 'chattr +i' command, which sets the immutable attribute (i flag) on a Linux filesystem. Option B is wrong because the SUID bit allows any user to execute the binary, not just root; execution restrictions are enforced by file permissions (e.g., 700 for owner-only execute). Option C is wrong because the SUID bit is a permission attribute on the binary itself, not a property of symbolic links; symbolic links inherit the permissions of the target file, but the SUID bit is set on the binary, not the link.

Practice this question →

119

MCQmedium

During a penetration test, you run `smtp-user-enum -M VRFY -U users.txt -t 10.0.0.10` and receive responses '252 2.5.2 User <username>' for some users and '550 5.1.1 User unknown' for others. What does this indicate?

A.The SMTP server is using EXPN instead of VRFY

B.The SMTP server is revealing valid usernames via the VRFY command

C.The SMTP server is vulnerable to command injection

D.The SMTP server is properly configured to prevent enumeration

AnswerB

The differing server responses to the VRFY command—typically a '250 OK' for valid users and a '550 No such user' or similar for invalid ones—unambiguously confirm the server is revealing valid usernames. This behavior allows an attacker to systematically enumerate existing user accounts on the system. Such information is a critical vulnerability, enabling subsequent attacks like brute-force password attempts or targeted phishing campaigns.

Why this answer

The VRFY command in SMTP (RFC 821) asks the server to verify whether a mailbox exists. A response starting with '252' indicates the user is valid, while '550 5.1.1' means the user does not exist. By comparing these responses, the attacker can enumerate valid usernames on the mail server, which is exactly what the output shows.

Exam trap

EC-Council often tests the distinction between VRFY and EXPN, where candidates mistakenly think EXPN is being used when the output clearly shows VRFY responses, or they assume any non-250 response means the server is secure.

How to eliminate wrong answers

Option A is wrong because EXPN (expand) returns mailing list members, not individual user verification, and the tool explicitly used the VRFY command, not EXPN. Option C is wrong because command injection would require the server to execute arbitrary commands from the input, which is not indicated by standard VRFY responses. Option D is wrong because a properly configured server to prevent enumeration would either disable VRFY entirely or return a generic response (e.g., '252' for all users) to avoid revealing which users exist.

Practice this question →

120

MCQeasy

A penetration tester obtains a hash dump from a compromised Windows system and wants to crack LM and NTLM hashes quickly using precomputed tables. Which tool would be most efficient for this task?

A.Hashcat

B.John the Ripper

C.Ophcrack

D.RainbowCrack

AnswerC

Ophcrack is a dedicated password cracker specifically designed to recover Windows LM and NTLM hashes by employing precomputed rainbow tables. This tool efficiently performs lookups within its extensive tables to reverse hashes back into their original plaintext passwords, making it exceptionally fast for common password sets. Its specialized focus on these hash types, combined with its user-friendly graphical interface, positions it as the optimal choice for this particular hash cracking method in a penetration testing scenario.

Why this answer

Ophcrack is the most efficient tool for quickly cracking LM and NTLM hashes using precomputed tables because it is specifically designed to leverage rainbow tables (precomputed hash chains) for these hash types. It can crack LM hashes almost instantly and NTLM hashes with high success rates when paired with the correct rainbow tables, making it ideal for fast offline password recovery from a hash dump.

Exam trap

CEH often tests the distinction between tools that use precomputed tables (rainbow tables) versus those that use brute-force or dictionary attacks; candidates mistakenly choose Hashcat or John the Ripper because they are more well-known, but Ophcrack is the only option specifically optimized for LM/NTLM rainbow table cracking.

How to eliminate wrong answers

Option A is wrong because Hashcat is a GPU-accelerated password cracker that uses brute-force, dictionary, or rule-based attacks, not precomputed tables; it is slower for LM/NTLM when rainbow tables are available. Option B is wrong because John the Ripper is a versatile cracker that supports many hash types but does not natively use precomputed rainbow tables; it relies on wordlists and brute-force, which are less efficient for this specific task. Option D is wrong because RainbowCrack is a tool that generates and uses rainbow tables, but it is a command-line utility that requires separate table generation or download and is less user-friendly than Ophcrack, which has a GUI and bundled tables for LM/NTLM.

Practice this question →

121

Multi-Selectmedium

A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)

Select 2 answers

A.John the Ripper

B.SNMPwalk

C.Nmap

D.enum4linux

E.smbclient

AnswersD, E

enum4linux is a comprehensive tool specifically designed for enumerating information from Windows and Samba hosts. It automates the process of extracting user lists, group memberships, shared resources, password policies, and other critical details by querying NetBIOS and SMB services. This makes it highly effective for gathering intelligence on a Windows target, going beyond simple port identification to deep service enumeration.

Why this answer

enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.

Exam trap

The trap here is that candidates may select Nmap because it has SMB scripts, but the question asks for tools 'specifically designed' for SMB enumeration, which excludes general-purpose scanners like Nmap.

Practice this question →

122

MCQmedium

A penetration tester is attempting to enumerate user accounts on a mail server. They connect to port 25 and issue the commands `VRFY root` and `EXPN support`. Which protocol is being targeted?

A.LDAP

B.SMTP

C.SMB

D.SNMP

AnswerB

The Simple Mail Transfer Protocol (SMTP) is the correct answer because it includes specific commands like `VRFY` (verify) and `EXPN` (expand) that can be leveraged for user enumeration. The `VRFY` command attempts to validate a specific email address or username on the target mail server, often returning a 250 OK response if the account exists. Similarly, `EXPN` can reveal members of a mailing list or alias, indirectly confirming valid user accounts. When not disabled or restricted, these commands provide a direct method for attackers to identify valid user accounts on a system.

Why this answer

The commands VRFY and EXPN are SMTP (Simple Mail Transfer Protocol) commands defined in RFC 821 and RFC 5321. VRFY is used to verify whether a mailbox exists on the server, while EXPN expands a mailing list alias to reveal its members. Since the tester connected to port 25 (the default SMTP port) and issued these commands, SMTP is the protocol being targeted.

Exam trap

The trap here is that candidates may confuse SMTP commands with other protocol operations, such as associating VRFY with LDAP directory lookups or EXPN with SNMP expansion, because they focus on the word 'enumerate' rather than the specific port and command syntax.

How to eliminate wrong answers

Option A is wrong because LDAP (Lightweight Directory Access Protocol) uses port 389 or 636 for directory queries, not port 25, and its commands are based on LDAP operations like bind, search, and compare, not SMTP commands like VRFY or EXPN. Option C is wrong because SMB (Server Message Block) uses ports 139 and 445 for file and printer sharing, and its enumeration involves commands like net use or smbclient, not SMTP mail commands. Option D is wrong because SNMP (Simple Network Management Protocol) uses ports 161 and 162 for network device management via GET, SET, and TRAP operations, not SMTP commands on port 25.

Practice this question →

123

MCQeasy

Which tool is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?

A.John the Ripper

B.RainbowCrack

C.Hashcat

D.Ophcrack

AnswerD

Ophcrack is a free, open-source password cracker specifically designed for Windows passwords, making it the correct answer. It leverages precomputed rainbow tables, often distributed as a live CD or USB, which are highly optimized for cracking LM (LAN Manager) and NTLM hashes. Its primary function and user-friendly interface are tailored to exploit the known weaknesses of these Windows authentication protocols, providing an efficient and straightforward solution for recovering Windows user passwords.

Why this answer

Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where rainbow tables allow rapid reversal of hashes without brute-forcing each password individually. This makes it the correct choice for the scenario described.

Exam trap

The trap here is that candidates confuse 'rainbow table' tools with general hash crackers like Hashcat or John the Ripper, but the question specifically asks for a tool designed for Windows LM/NTLM hashes using rainbow tables, which is Ophcrack's unique niche.

How to eliminate wrong answers

Option A is wrong because John the Ripper is a general-purpose password cracker that supports many hash types and modes (dictionary, brute-force, incremental), but it does not natively use rainbow tables as its primary attack vector. Option B is wrong because RainbowCrack is a tool that generates and uses rainbow tables for hash cracking, but it is not specifically designed for Windows LM/NTLM hashes; it supports multiple hash algorithms (e.g., MD5, SHA1) and requires separate table generation. Option C is wrong because Hashcat is a high-speed GPU-accelerated password recovery tool that supports many hash modes (including NTLM), but it relies on dictionary, brute-force, or rule-based attacks, not precomputed rainbow tables.

Practice this question →

124

Multi-Selectmedium

Which THREE of the following are common techniques used in the 'Cracking passwords' phase of system hacking? (Select 3)

Select 3 answers

A.Brute force attack

B.Rainbow table attack

C.Keylogging

D.Social engineering

E.Dictionary attack

AnswersA, B, E

A brute force attack is an exhaustive password cracking method that systematically attempts every possible character combination (letters, numbers, symbols) of a specified length until the correct password or key is discovered. While computationally intensive, especially for long and complex passwords, it guarantees success given sufficient time and processing resources. This makes it a fundamental and powerful technique in a cracker's arsenal.

Why this answer

A brute force attack systematically tries every possible combination of characters until the correct password is found. This is a fundamental technique in the password cracking phase, often used when no prior knowledge of the password exists. It is computationally expensive but guaranteed to succeed given enough time.

Exam trap

The trap here is confusing password capturing techniques (like keylogging or social engineering) with password cracking techniques that operate on captured hashes or encrypted passwords.

Practice this question →

125

MCQmedium

During a penetration test, you gain access to a Linux server as a low-privileged user. Which of the following is an effective technique to escalate privileges by exploiting misconfigured file permissions?

A.Pass-the-hash

B.Token impersonation

C.SUID/GUID abuse

D.Kerberoasting

AnswerC

SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow an executable to run with the privileges of the file's owner or group, respectively, rather than the user executing it. If a program with SUID permissions is owned by root and can be manipulated (e.g., by executing arbitrary commands or writing to sensitive files), it can be abused for privilege escalation. This is a common and effective technique on Linux systems.

Why this answer

SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.

Exam trap

The trap here is that candidates may confuse SUID/GUID abuse with Windows-specific techniques like token impersonation or pass-the-hash, because the CEH exam often intermixes cross-platform attack vectors to test your ability to match the technique to the correct operating system.

How to eliminate wrong answers

Option A is wrong because pass-the-hash is a Windows-based attack that reuses NTLM hashes to authenticate to remote systems; it does not apply to Linux file permission misconfigurations. Option B is wrong because token impersonation is a Windows privilege escalation technique that manipulates access tokens (e.g., SeImpersonatePrivilege) to assume another user's identity; it is not relevant to Linux SUID/GUID abuse. Option D is wrong because Kerberoasting is an Active Directory attack that requests Kerberos service tickets to crack service account passwords; it targets Windows domain environments, not local Linux file permissions.

Practice this question →

126

Multi-Selectmedium

During a penetration test, an analyst detects that an SNMP agent on a network device is using the default community string 'public'. Which TWO actions can the analyst perform using this information? (Choose TWO.)

Select 2 answers

A.Enumerate user accounts and system details

B.Extract encrypted passwords from the device

C.Write new configuration to the device

D.Perform SNMPwalk to enumerate the MIB tree

E.Disable the SNMP agent remotely

AnswersA, D

SNMP Management Information Bases (MIBs) are structured databases that store a wealth of information about network devices. Many standard MIB objects, such as those under the `host` or `users` branches, are designed to expose system details like operating system versions, running services, and even lists of local user accounts. This information, often accessible with a default read-only community string, is invaluable for attackers performing reconnaissance to identify potential vulnerabilities or valid login names.

Why this answer

The default SNMP community string 'public' typically grants read-only access to the SNMP agent. With read-only access, the analyst can perform an SNMPwalk (using tools like snmpwalk or MIB browsers) to enumerate the entire Management Information Base (MIB) tree, which often includes system details, user accounts, running processes, and network configurations. This enumeration is a key step in the Enumeration phase of a penetration test, as it can reveal sensitive information without authentication.

Exam trap

The trap here is that candidates often assume that a default read‑only community string like 'public' provides full administrative control over the device, but it only grants read‑only access. Therefore, actions such as writing configurations or disabling the agent are not possible without a read‑write community string.

Practice this question →

127

MCQhard

During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?

A.NFS enumeration; it indicates that NFS shares are world-readable

B.LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk

C.SNMP enumeration; it indicates that the community string is weak

D.SMTP enumeration; it indicates that the mail server is misconfigured

AnswerB

The `ldapsearch -x -h <host>` command initiates an anonymous or simple authenticated query against an LDAP server. If successful, it enumerates directory attributes. The discovery of plaintext passwords within the returned LDAP attributes signifies a critical security misconfiguration, as sensitive user credentials are directly exposed. This poses a severe risk of credential theft, allowing attackers to reuse these passwords for lateral movement or access to other systems.

Why this answer

The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.

Exam trap

The trap here is that candidates may confuse the `ldapsearch` command with other enumeration tools (like `snmpwalk` or `smtp-user-enum`) and fail to recognize that the specific command and output directly indicate LDAP enumeration with plaintext password exposure.

How to eliminate wrong answers

Option A is wrong because NFS enumeration uses commands like `showmount -e` or `rpcinfo`, not `ldapsearch`, and the output would show exported shares, not user objects with passwords. Option C is wrong because SNMP enumeration uses tools like `snmpwalk` with community strings, and the output would contain OIDs and MIB values, not LDAP directory entries. Option D is wrong because SMTP enumeration uses commands like `VRFY` or `EXPN` to verify email addresses, and the output would be SMTP response codes, not LDAP attributes.

Practice this question →

128

MCQhard

During a penetration test, you discover a Windows service running with SYSTEM privileges that has a weak file permission allowing the 'Everyone' group to modify its executable. Which privilege escalation technique is MOST directly applicable here?

A.Token impersonation

B.Weak service binary permissions

C.DLL hijacking

D.Unquoted service path

AnswerB

Weak service binary permissions represent a critical privilege escalation vulnerability where an attacker possesses write access to the executable file of a Windows service. By replacing the legitimate service binary with a malicious payload, such as a reverse shell or a user-creation script, the attacker can achieve elevated privileges. When the compromised service is subsequently started or restarted by the operating system, it will execute the attacker's code, typically under the SYSTEM account, granting full control over the machine.

Why this answer

The scenario describes a Windows service executable with weak file permissions that allow the 'Everyone' group to modify it. This directly enables an attacker to replace the legitimate executable with a malicious one, which will then be executed with SYSTEM privileges when the service starts. This is the classic 'weak service binary permissions' privilege escalation vector, often exploited using tools like `icacls` or `accesschk` to identify the vulnerability.

Exam trap

EC-Council often tests the distinction between modifying the service binary itself (weak binary permissions) versus exploiting path parsing (unquoted service path) or dependency loading (DLL hijacking), so candidates must focus on the specific permission weakness described.

How to eliminate wrong answers

Option A is wrong because token impersonation typically requires an existing token (e.g., from a named pipe or RPC) to steal or duplicate, not a writable service binary. Option C is wrong because DLL hijacking involves placing a malicious DLL in a path where the service searches for missing DLLs, not modifying the service's primary executable. Option D is wrong because an unquoted service path exploits spaces in the service binary path to execute an unintended executable, not the modification of the existing binary itself.

Practice this question →

129

MCQmedium

An attacker modifies system logs to remove entries related to their activities. Which technique is being used to cover tracks?

A.Token impersonation

B.Steganography

C.Log manipulation

D.Rootkit installation

AnswerC

Log manipulation precisely describes the act of an attacker altering, deleting, or fabricating entries within system logs to obscure their malicious activities. This technique is crucial for covering tracks, evading detection by security monitoring systems, and hindering forensic investigations by removing evidence of unauthorized access or actions. Modifying log files directly addresses the scenario of removing specific entries.

Why this answer

Log manipulation is the correct answer because it directly involves altering or deleting log entries to hide evidence of unauthorized activities. Attackers often use this technique to remove traces of their actions from system logs, such as event logs in Windows or syslog files in Linux, thereby covering their tracks and avoiding detection.

Exam trap

The trap here is that candidates may confuse rootkit installation with log manipulation, as rootkits can hide logs, but the question specifically asks about modifying logs to remove entries, which is a direct action on the log files themselves, not a hiding mechanism.

How to eliminate wrong answers

Option A is wrong because token impersonation is a technique used to steal or forge authentication tokens (e.g., Kerberos tickets) to gain unauthorized access, not to modify logs. Option B is wrong because steganography hides data within other files (e.g., images or audio) to conceal communication, not to alter system logs. Option D is wrong because rootkit installation involves installing malicious software that hides processes, files, or system modifications from the OS, but it does not specifically target log files for modification; log manipulation is a separate post-exploitation step.

Practice this question →

130

MCQmedium

A security engineer runs SNMPwalk on a network device and receives community strings as 'public' and 'private'. What is the PRIMARY concern?

A.The device is vulnerable to buffer overflow attacks

B.The device is infected with malware

C.The device may be exposing sensitive configuration information

D.The device is using outdated encryption protocols

AnswerC

When an snmpwalk command successfully retrieves data using common or default community strings, it signifies that the device's SNMP agent is configured insecurely. This allows an attacker to access extensive Management Information Base (MIB) data, which frequently includes critical system details, network interface configurations, routing tables, and even potentially sensitive user account information. Such information leakage provides valuable reconnaissance for further targeted attacks.

Why this answer

The SNMP community strings 'public' and 'private' are default read-only and read-write credentials defined in SNMPv1 and SNMPv2c. An attacker who can SNMPwalk the device with these strings can enumerate the entire MIB tree, including system configuration, routing tables, interface details, and user accounts. This directly exposes sensitive configuration information, making C the primary concern.

Exam trap

EC-Council often tests the distinction between 'default credentials' and 'exploitation vectors'—candidates mistakenly associate 'public/private' with encryption or malware, when the real risk is unauthorized information disclosure via SNMP enumeration.

How to eliminate wrong answers

Option A is wrong because SNMP community strings are authentication credentials, not a vector for buffer overflow attacks; buffer overflows exploit memory corruption in protocol parsing or application code, not weak default strings. Option B is wrong because the presence of default community strings indicates poor security configuration, not malware infection; malware would require evidence of malicious processes or network behavior. Option D is wrong because SNMPv1 and SNMPv2c do not use encryption at all—they transmit community strings in cleartext; the issue is lack of encryption, not outdated encryption protocols.

Practice this question →

131

Multi-Selecthard

Which THREE of the following are components of the CHPSET system hacking methodology? (Select three.)

Select 3 answers

A.Sniffing network traffic

B.Hiding files

C.Cracking passwords

D.Scanning ports

E.Executing applications

AnswersA, C, E

Sniffing network traffic is a fundamental component of the CHPSET (Cracking, Hiding, Planting, Sniffing, Executing, Erasing) methodology, specifically corresponding to the 'Sniffing' phase. This involves passively capturing and analyzing data packets traversing a network segment to intercept sensitive information such as credentials, session tokens, or proprietary data. Attackers utilize tools like Wireshark or tcpdump to monitor network communications, gaining insights into network topology and identifying potential vulnerabilities for further exploitation.

Why this answer

The CHPSET system hacking methodology includes six phases: Cracking (C), Hiding (H), Privilege Escalation (P), Sniffing (S), Executing (E), and Targeting (T). Among the given options, Sniffing network traffic (A) corresponds to Sniffing, Cracking passwords (C) to Cracking, and Executing applications (E) to Executing. Hiding files (B) is a specific activity under the Hiding phase but is not a distinct phase itself.

Scanning ports (D) is a reconnaissance step performed during the pre-hacking phase, not part of CHPSET. Therefore, the three correct components are A, C, and E.

Exam trap

Candidates may incorrectly select Hiding files (B) as a separate phase, but the CHPSET methodology lists 'Hiding' as a broad phase that can include various hiding techniques. The specific term 'Hiding files' is not a phase. Others may include Scanning ports (D) due to its prevalence in earlier stages, but it is not part of the system hacking phases.

Practice this question →

132

Multi-Selecteasy

Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)

Select 2 answers

A.Running a vulnerability scanner

B.Enabling firewall rules

C.Installing a rootkit

D.Creating new user accounts

E.Clearing event logs

AnswersC, E

Installing a rootkit is a highly effective technique for covering an attacker's tracks by providing stealthy, persistent access. Rootkits are designed to modify the operating system's core functions, either at the kernel or userland level, to conceal files, processes, network connections, and other malicious artifacts from legitimate system utilities and security software. This sophisticated level of hiding allows an attacker to maintain a covert presence, making detection extremely challenging for administrators and forensic analysts.

Why this answer

Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.

Exam trap

In the CEH exam, candidates often mistakenly select creating new user accounts (Option D) as a track-covering technique when it is actually a persistence method that leaves obvious traces. Covering tracks focuses on hiding evidence of the attack, such as clearing logs or using rootkits to conceal malicious activity.

Practice this question →

133

MCQmedium

During an internal penetration test, an analyst uses `enum4linux -a 10.0.0.5` and retrieves a list of local users, including an account named 'sqlsvc'. The analyst then attempts to crack the password using a dictionary attack. Which password cracking tool would be most efficient for this task?

A.RainbowCrack

B.SNMPwalk

C.John the Ripper

D.Ophcrack

AnswerC

John the Ripper is a robust, open-source password cracking utility widely recognized for its versatility in performing dictionary attacks against a multitude of hash types. It can efficiently process password hashes, including NTLM and LM hashes commonly found in Windows environments and potentially extracted or identified through SMB enumeration tools like enum4linux. Its extensive wordlist support and customizable rules make it an ideal choice for attempting to crack enumerated user passwords via dictionary attack.

Why this answer

John the Ripper is the most efficient tool for performing a dictionary attack against password hashes retrieved from a system, such as those obtained from the SAM database or via enum4linux. It supports a wide range of hash types and can be configured to use custom wordlists, making it ideal for cracking the 'sqlsvc' account password in an internal penetration test.

Exam trap

EC-Council often tests the distinction between dictionary attacks and rainbow table attacks, leading candidates to choose RainbowCrack or Ophcrack when the question explicitly specifies a dictionary attack method.

How to eliminate wrong answers

Option A is wrong because RainbowCrack uses precomputed rainbow tables for time-memory trade-off attacks, not dictionary attacks; it is inefficient for targeted cracking of a single account without a matching table. Option B is wrong because SNMPwalk is a tool for querying SNMP-enabled devices to enumerate MIB values, not a password cracking tool. Option D is wrong because Ophcrack specializes in cracking Windows LM and NTLM hashes using rainbow tables, not general dictionary attacks, and requires specific table sets.

Practice this question →

134

MCQmedium

An incident responder finds that the Windows Event Logs on a compromised server have been cleared, and the Security log shows gaps in coverage. Additionally, a rootkit is suspected. Which phase of the hacking methodology does the clearing of logs represent?

A.Privilege escalation

B.Cracking passwords

C.Erasing tracks

D.Executing applications

AnswerC

Erasing tracks, also known as covering tracks or anti-forensics, is a post-exploitation phase where an attacker attempts to remove or alter evidence of their presence and activities on a compromised system. Clearing Windows event logs is a quintessential example of this technique, as it directly eliminates critical forensic data that incident responders rely on to understand the attack timeline, methods, and scope. This action aims to hinder detection and attribution, making it significantly harder for security teams to reconstruct the incident.

Why this answer

Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

Exam trap

The trap here is that candidates confuse 'Erasing tracks' with 'Privilege escalation' because clearing logs often requires administrative privileges, but the phase is defined by the intent to hide evidence, not the permission level used.

How to eliminate wrong answers

Option A is wrong because privilege escalation is the phase where an attacker gains higher-level permissions (e.g., from user to administrator), not the act of removing logs. Option B is wrong because cracking passwords is a technique used during the 'Gaining Access' phase to obtain credentials, not a phase for hiding evidence. Option D is wrong because executing applications is a generic action that can occur in multiple phases (e.g., exploitation or maintaining access), but it does not specifically describe the act of clearing logs to avoid detection.

Practice this question →

135

MCQmedium

A penetration tester executes the command: snmpwalk -c public -v2c 192.168.1.50. Which of the following BEST describes the purpose of this command?

A.Modify SNMP settings on the remote device

B.Perform a brute-force attack on the SNMP community string

C.Test the SNMP agent for denial of service vulnerabilities

D.Enumerate the MIB tree of the SNMP agent using the 'public' community string

AnswerD

The `snmpwalk` utility is specifically designed to query an SNMP agent and traverse its Management Information Base (MIB) tree. By sending a series of GETNEXT requests, it systematically retrieves all Object Identifiers (OIDs) and their corresponding values accessible through the agent. The `c public` argument specifies the community string "public," which is a common default or weak credential used to gain read-only access for enumeration purposes. This command effectively maps the device's configuration and status information.

Why this answer

The `snmpwalk` command is used to retrieve a subtree of management information from an SNMP agent. By specifying `-c public` (the community string) and `-v2c` (SNMP version 2c), the command performs a GETNEXT request cycle to walk the entire MIB tree, enumerating all accessible OIDs and their values. Option D correctly identifies this as enumerating the MIB tree using the 'public' community string.

Exam trap

The trap here is that candidates may confuse `snmpwalk` with a modification or attack tool, but the CEH exam expects you to recognize it as a standard enumeration command that leverages the SNMP GETNEXT operation to walk the MIB tree.

How to eliminate wrong answers

Option A is wrong because `snmpwalk` is a read-only operation that retrieves data; it cannot modify SNMP settings on the remote device. Option B is wrong because `snmpwalk` does not perform brute-force attacks; tools like `onesixtyone` or `hydra` are used for brute-forcing community strings, and the command already provides the community string 'public'. Option C is wrong because `snmpwalk` is not a denial of service test; it is a standard enumeration technique, and DoS testing would involve flooding or malformed packets, not a normal GETNEXT walk.

Practice this question →

136

MCQmedium

A security engineer notices repeated log entries showing a user account logging in at odd hours and then clearing event logs. The engineer suspects credential theft. Which phase of the CHPSET methodology involves erasing tracks?

A.Erasing tracks

B.Hiding files

C.Spying

D.Cracking passwords

AnswerA

When a security engineer observes repeated log entries indicating unauthorized activity, an attacker's immediate priority after gaining access is often to eliminate or alter these digital footprints. Erasing tracks involves anti-forensic techniques like clearing event logs, modifying timestamps, or injecting benign entries to obscure malicious actions. This critical step aims to delay detection, complicate incident response, and prevent security personnel from understanding the full scope of the breach.

Why this answer

The CHPSET methodology (Cracking passwords, Hiding files, Planting backdoors, Spying, Erasing tracks, and Transferring files) defines the phases of system hacking. Erasing tracks is the phase where attackers clear event logs, modify log files, or use tools like `wevtutil` or `clearlogs.exe` to remove evidence of their activities, matching the engineer's observation of cleared logs after suspicious logins.

Exam trap

The CEH exam often tests the CHPSET methodology by asking which phase corresponds to a specific action, and the trap here is that candidates confuse 'erasing tracks' with 'hiding files' because both involve concealment, but hiding files is about data storage, not log manipulation.

How to eliminate wrong answers

Option B is wrong because hiding files involves concealing stolen data or tools using techniques like NTFS alternate data streams or hidden attributes, not clearing logs. Option C is wrong because spying refers to monitoring user activity or capturing keystrokes (e.g., with keyloggers) to gather information, not erasing forensic evidence. Option D is wrong because cracking passwords is the phase of obtaining credentials via methods like brute-force or dictionary attacks, which occurs before the attacker gains access and then erases tracks.

Practice this question →

137

MCQeasy

During a penetration test, you need to enumerate SMB shares on a Windows target. Which of the following tools is specifically designed for this purpose?

A.ldapsearch

B.nmap

C.enum4linux

D.snmpwalk

AnswerC

enum4linux is a powerful Perl script specifically designed for enumerating information from Windows and Samba hosts, making it ideal for SMB share enumeration during penetration tests. It consolidates multiple SMB-specific enumeration techniques, including querying for user lists, group memberships, operating system information, and crucially, listing available SMB shares and their permissions. This tool leverages protocols like NetBIOS and SMB to gather comprehensive details, providing a focused and efficient approach to discovering shared resources.

Why this answer

enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.

Exam trap

The trap here is that candidates may choose nmap because it can scan for SMB services, but the question asks for a tool specifically designed for enumerating SMB shares, not just detecting the service.

How to eliminate wrong answers

Option A is wrong because ldapsearch is a tool for querying LDAP directories, not for enumerating SMB shares. Option B is wrong because while nmap can scan for open SMB ports (e.g., 139, 445) and run some SMB scripts, it is a general-purpose port scanner, not a tool specifically designed for SMB share enumeration. Option D is wrong because snmpwalk is used to retrieve SNMP MIB data from network devices, not for SMB share enumeration.

Practice this question →

138

MCQeasy

A security analyst runs 'nbtstat -A 192.168.1.10' and receives a table showing the machine name and a list of names registered. Which service is being enumerated?

A.SNMP

B.LDAP

C.SMTP

D.NetBIOS

AnswerD

The `nbtstat` command is a dedicated utility for diagnosing and troubleshooting NetBIOS over TCP/IP (NBT) name resolution issues and displaying NetBIOS name table information. When executed with the `-a` (adapter status) or `-A` (adapter status by IP address) switch followed by an IP address, `nbtstat` queries the remote machine for its NetBIOS name table. This process reveals registered names, services, and often MAC addresses, directly constituting NetBIOS enumeration and making it the correct answer.

Why this answer

The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.

Exam trap

The trap here is that candidates confuse the nbtstat command with other enumeration tools, mistakenly thinking it queries SNMP or LDAP because those services also reveal system information, but nbtstat is exclusively a NetBIOS enumeration command.

How to eliminate wrong answers

Option A is wrong because SNMP (Simple Network Management Protocol) uses UDP ports 161/162 and is enumerated with tools like snmpwalk or snmp-check, not the nbtstat command. Option B is wrong because LDAP (Lightweight Directory Access Protocol) operates on TCP port 389 and is enumerated via ldapsearch or similar directory queries, not through NetBIOS name resolution. Option C is wrong because SMTP (Simple Mail Transfer Protocol) runs on TCP port 25 and is enumerated with commands like VRFY or EXPN, or tools like smtp-user-enum, not via nbtstat.

Practice this question →

139

MCQmedium

In the context of system hacking methodology (CHPSET), which phase involves hiding malicious files from the operating system and security tools using techniques such as NTFS alternate data streams (ADS) or steganography?

A.Privilege escalation

B.Erasing tracks

C.Hiding files

D.Cracking passwords

AnswerC

Hiding files is a crucial post-exploitation activity within the system hacking methodology, designed to conceal malicious tools, backdoors, rootkits, or exfiltrated data on a compromised system. This action ensures the attacker's continued access and persistence by making their presence difficult for defenders to detect through standard system monitoring. It is a fundamental technique for maintaining a covert foothold and preventing the discovery of persistent mechanisms.

Why this answer

The 'Hiding files' phase of the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Erasing tracks, Hiding files) methodology specifically involves concealing malicious files from the OS and security tools. Techniques like NTFS alternate data streams (ADS) allow data to be stored in a file's metadata stream (e.g., type echo payload > file.txt:stream) without affecting the visible file size, while steganography hides data within images or audio files. This phase occurs after gaining access and before covering tracks.

Exam trap

The trap here is that candidates confuse 'hiding files' with 'erasing tracks' (Option B) in the EC-CEH methodology, as both involve evasion, but erasing tracks focuses on log and evidence removal, not file concealment via ADS or steganography.

How to eliminate wrong answers

Option A is wrong because privilege escalation is the phase where an attacker gains higher-level permissions (e.g., from user to administrator) using exploits like token manipulation or service misconfigurations, not hiding files. Option B is wrong because erasing tracks (also called covering tracks) involves clearing logs, timestamps, and evidence of intrusion (e.g., using wevtutil or clearing event logs), not concealing files themselves. Option D is wrong because cracking passwords is part of the initial 'Cracking' phase, where tools like John the Ripper or Hashcat are used to recover plaintext passwords from hashes, not to hide files.

Practice this question →

140

MCQmedium

A penetration tester gains access to a Linux server and attempts to escalate privileges. They run `sudo -l` and see that the user can run `/usr/bin/vim` as root without a password. Which privilege escalation technique should the tester use?

A.Perform token impersonation using SeImpersonatePrivilege

B.Use vim's shell escape via `:!bash` to get a root shell

C.Exploit a kernel vulnerability (CVE-2023-xxxx)

D.Abuse the SUID bit on vim

AnswerB

This is the correct approach because if vim is launched with sudo privileges, even if sudo is configured to require a password, the vim process itself will be running as root. Within vim, the :!bash command allows the user to execute an arbitrary shell command. Since vim is already running as root, the spawned bash shell will inherit these root privileges, effectively granting a root shell without needing to know the root password directly.

Why this answer

The `sudo -l` output shows that the user can run `/usr/bin/vim` as root without a password. Vim has a built-in shell escape feature: from within vim, typing `:!bash` (or `:!sh`) executes a shell with the privileges of the user running vim. Since vim is run via sudo as root, the spawned shell will be a root shell, directly escalating privileges without needing additional exploits.

Exam trap

CEH exams often test the distinction between sudo-based privilege escalation and SUID-based escalation; the trap here is that candidates may incorrectly focus on the SUID bit (Option D) when the actual vector is the sudo rule allowing arbitrary command execution via vim's shell escape.

How to eliminate wrong answers

Option A is wrong because token impersonation using SeImpersonatePrivilege is a Windows-specific privilege escalation technique (e.g., JuicyPotato), not applicable to Linux. Option C is wrong because exploiting a kernel vulnerability (CVE-2023-xxxx) is unnecessary when a simple sudo misconfiguration already grants root access; it is overkill and risks system instability. Option D is wrong because the SUID bit on vim is not relevant here; the user already has sudo permission to run vim as root, so the escalation vector is the sudo rule, not the SUID bit.

Practice this question →

141

MCQhard

During a penetration test, the tester runs `enum4linux -U 192.168.1.20` and obtains a list of usernames. What service is being enumerated, and what is the primary risk associated with this information disclosure?

A.NFS; it can lead to unauthorized file access

B.SNMP; it can reveal community strings

C.SMB; it can facilitate password spraying or brute‑force attacks

D.LDAP; it can expose directory structure

AnswerC

`enum4linux` specifically leverages the Server Message Block (SMB) protocol to enumerate user information from Windows or Samba hosts, directly identifying the service in the scenario. Obtaining a list of valid usernames, as achieved by the `-U` flag, is a critical precursor for credential-based attacks. This disclosed information significantly facilitates password spraying, where common passwords are tried against numerous accounts, or targeted brute-force attacks against specific user accounts.

Why this answer

enum4linux is a tool that queries SMB (Server Message Block) services on a target, typically over TCP ports 139 or 445. The `-U` flag specifically enumerates users from the SAM database via the SMB protocol. The primary risk of obtaining a valid username list is that it enables password spraying or brute-force attacks against SMB authentication, which can lead to unauthorized access.

Exam trap

The CEH exam often tests the association between the specific enumeration tool and its corresponding service, so the trap here is confusing enum4linux with other enumeration tools like `snmpwalk` (SNMP) or `ldapsearch` (LDAP), leading candidates to pick a plausible-sounding but incorrect service.

How to eliminate wrong answers

Option A is wrong because NFS (Network File System) is enumerated with tools like `showmount` or `rpcinfo`, not enum4linux, and the risk of unauthorized file access is associated with NFS export misconfigurations, not username enumeration. Option B is wrong because SNMP (Simple Network Management Protocol) is enumerated with tools like `snmpwalk` or `onesixtyone`, and the risk of revealing community strings is unrelated to SMB username enumeration. Option D is wrong because LDAP (Lightweight Directory Access Protocol) is enumerated with tools like `ldapsearch` or `windapsearch`, and while it can expose directory structure, enum4linux does not interact with LDAP.

Practice this question →

142

MCQeasy

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

A.nslookup

B.netstat

C.nbtstat

D.net view

AnswerC

nbtstat is the correct command for NetBIOS name resolution and enumeration.

Why this answer

The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

Exam trap

The trap here is that candidates confuse 'net view' (which shows network shares) with NetBIOS name enumeration, but nbtstat is the specific tool for querying the NetBIOS name table and cache directly.

How to eliminate wrong answers

Option A (nslookup) is wrong because it is used for DNS queries (A, AAAA, MX, etc.) and has no capability to enumerate NetBIOS names, which operate at a different layer (NetBIOS session service over TCP/UDP 137-139). Option B (netstat) is wrong because it displays active TCP/UDP connections, listening ports, and routing tables, but it does not query or resolve NetBIOS names or name tables. Option D (net view) is wrong because while it lists shared resources on a network, it relies on the Server Message Block (SMB) protocol and does not directly enumerate the raw NetBIOS name table or cache; it is a higher-level command that uses NetBIOS indirectly but is not the tool for name enumeration.

Practice this question →

143

MCQeasy

A security analyst wants to enumerate all users from an SMTP server. Which of the following SMTP commands can be used for user enumeration?

A.DATA

B.MAIL FROM

C.HELO

D.VRFY

AnswerD

The VRFY (Verify) command is specifically designed to query an SMTP server to determine if a particular mailbox or user exists on the system. When provided with a username or email address, the server typically responds with information indicating whether the user is valid, often including their full name or a success code. This direct validation capability makes VRFY a highly effective tool for enumerating valid user accounts on an SMTP server, which is precisely what the security analyst aims to achieve.

Why this answer

The VRFY command is used in SMTP to verify whether a mailbox exists on the server. By issuing VRFY followed by a username, the server typically responds with a 250 code if the user exists or a 550 code if not, enabling user enumeration. This is a recognized technique in security assessments to discover valid email accounts.

Exam trap

The trap here is that candidates often confuse VRFY with EXPN or think that HELO or MAIL FROM can be abused for enumeration, but only VRFY directly queries the server for user existence.

How to eliminate wrong answers

Option A is wrong because DATA is used to begin the transmission of the email body content, not for user enumeration. Option B is wrong because MAIL FROM specifies the sender's address in an SMTP transaction and does not query the server for user existence. Option C is wrong because HELO initiates the SMTP session by identifying the client to the server and provides no mechanism to enumerate users.

Practice this question →

144

MCQmedium

An attacker uses a tool that sends crafted RCPT TO commands to an SMTP server to verify email addresses. Which SMTP enumeration technique is being used?

A.AUTH

B.RCPT TO

C.EXPN

D.VRFY

AnswerB

The RCPT TO:<address@domain.com> command is a fundamental SMTP instruction used to specify an intended recipient for an email. Attackers exploit this by sending numerous RCPT TO commands with guessed email addresses to a target mail server. The server's response, such as a 250 OK for a valid address or a 550 No such user here for an invalid one, allows for systematic enumeration of active email accounts. This method is highly effective for building target lists for further attacks.

Why this answer

The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.

Exam trap

The trap here is that candidates often confuse RCPT TO with VRFY, assuming VRFY is the primary enumeration command, but in practice, VRFY is frequently disabled, making RCPT TO the more reliable and commonly tested technique in CEH scenarios.

How to eliminate wrong answers

Option A is wrong because AUTH is an SMTP command used for authentication, not for verifying email addresses; it does not reveal whether a recipient exists. Option C is wrong because EXPN is used to expand mailing lists or aliases, returning all members of a list, not to verify individual email addresses. Option D is wrong because VRFY is used to verify if a user exists on the server, but it is often disabled or restricted for security reasons, whereas RCPT TO is more commonly available and effective for enumeration.

Practice this question →

145

MCQhard

An attacker uses SMTP commands to verify the existence of email accounts on a mail server. Which sequence of SMTP commands is used for this purpose?

A.EHLO, AUTH, STARTTLS

B.HELO, MAIL FROM, RCPT TO, DATA

C.NOOP, QUIT, RSET

D.VRFY, EXPN, RCPT TO

AnswerD

VRFY, EXPN, and RCPT TO are effective SMTP commands for enumerating valid user accounts and aliases on a mail server. VRFY (Verify) explicitly requests the server to confirm if a specified user or mailbox exists, often returning a 250 OK response for valid users or a 550 error for non-existent ones. EXPN (Expand) requests the server to expand a mailing list or alias, revealing the individual members or addresses it contains. RCPT TO, even without a subsequent DATA command, can be used to test for recipient validity by observing the server's response code (e.g., 250 OK vs. 550 User unknown).

Why this answer

The VRFY command asks the mail server to verify whether a given email address exists, EXPN expands a mailing list to reveal individual addresses, and RCPT TO (used in the SMTP transaction) can also be used to check address validity by observing the server's response. Together, these commands allow an attacker to enumerate valid email accounts on the server.

Exam trap

The trap here is that candidates often confuse the standard SMTP mail-sending sequence (HELO, MAIL FROM, RCPT TO, DATA) with the enumeration-specific commands, forgetting that VRFY and EXPN are explicitly designed for address verification.

How to eliminate wrong answers

Option A is wrong because EHLO, AUTH, and STARTTLS are used for SMTP session initiation, authentication, and encryption negotiation, not for verifying email account existence. Option B is wrong because HELO, MAIL FROM, RCPT TO, and DATA are the standard sequence for sending an email message, not specifically for enumeration, though RCPT TO can be abused for enumeration it is not the primary sequence. Option C is wrong because NOOP is a no-operation command, QUIT ends the session, and RSET resets the session; none of these commands verify email account existence.

Practice this question →

146

Multi-Selecthard

Which THREE of the following are valid techniques for covering tracks after compromising a system? (Select 3 correct answers)

Select 3 answers

A.Clearing event logs using wevtutil

B.Exploiting SUID binaries to gain root

C.Installing a rootkit to hide malicious processes

D.Using timestomp to modify file timestamps

E.Disabling Windows Defender via Group Policy

AnswersA, C, D

Clearing event logs using `wevtutil` is a direct method of covering tracks by eliminating forensic evidence. The `wevtutil` command-line utility allows an attacker to clear specific Windows Event Logs, such as Security, System, or Application logs, which record system activities, security events, and application errors. By removing these logs, an attacker can erase records of their login attempts, command executions, file accesses, and other malicious actions, significantly hindering incident response and forensic investigations.

Why this answer

A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.

Exam trap

EC-Council often tests the distinction between privilege escalation (gaining higher access) and covering tracks (hiding evidence), causing candidates to mistakenly select SUID exploitation as a track-covering technique.

Practice this question →

147

MCQmedium

After compromising a system, an attacker wants to erase their tracks. They clear the Windows Event Logs using `wevtutil cl` commands. However, the logs are forwarded to a remote SIEM. Which covering tracks technique would be MOST effective to avoid detection?

A.Modify specific event log entries to remove evidence of their actions

B.Disable Windows Event Log service (EventLog)

C.Use a rootkit to hide files and processes

D.Encrypt the log files

AnswerA

Modifying specific event log entries is the most sophisticated method for post-compromise evidence removal, as it allows for targeted deletion. Attackers employ specialized tools to parse event logs, identify incriminating entries related to their activities—such as failed logins, privilege escalation, or command execution—and then selectively delete or alter these records. This technique maintains the appearance of normal system operation by leaving benign log data intact, making detection by SIEMs or forensic analysts significantly more challenging than simply clearing all logs.

Why this answer

Modifying specific event log entries directly removes the incriminating evidence without disrupting the logging pipeline. Since logs are forwarded to a remote SIEM, simply clearing or disabling local logs would trigger an alert due to a gap in log forwarding. By surgically editing only the relevant entries (e.g., using PowerShell or API calls to alter Event Log records), the attacker avoids detection while the SIEM continues to receive logs, maintaining the appearance of normal operation.

Exam trap

The trap here is that candidates often assume clearing logs (wevtutil cl) is sufficient, but the question explicitly states logs are forwarded to a remote SIEM, making any disruption to the log stream (disabling, encrypting, or clearing) a red flag, whereas targeted modification of entries is stealthier and avoids breaking the forwarding pipeline.

How to eliminate wrong answers

Option B is wrong because disabling the Windows Event Log service (EventLog) would stop all log generation and forwarding, causing the SIEM to immediately detect a missing heartbeat or log gap, which is a strong indicator of compromise. Option C is wrong because a rootkit hides files and processes but does not alter or remove existing event log entries; the incriminating log data would still be present and forwarded to the SIEM. Option D is wrong because encrypting the log files would render them unreadable locally and likely break the forwarding pipeline, again creating a detectable anomaly in the SIEM's log stream.

Practice this question →

148

Multi-Selecthard

Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)

Select 3 answers

A.Installing a rootkit to hide files and processes

B.Escalating privileges to SYSTEM

C.Disabling antivirus software

D.Using steganography to hide stolen data in images

E.Clearing event logs

AnswersA, D, E

Installing a rootkit is a sophisticated method for covering tracks, as a rootkit is a collection of tools designed to obtain and maintain privileged access to a computer while actively hiding its presence. By modifying core operating system components, rootkits can conceal malicious files, running processes, network connections, and even user accounts from standard system utilities and security software. This makes it extremely difficult for forensic investigators to detect the attacker's activities and persistence mechanisms, effectively covering their tracks post-compromise.

Why this answer

Installing a rootkit is a classic method for covering tracks because it operates at the kernel or user level to intercept system calls (e.g., NtQuerySystemInformation on Windows) and hide malicious files, processes, registry keys, and network connections from standard enumeration tools like Task Manager or netstat. This prevents the victim from detecting the compromise during routine monitoring.

Exam trap

EC-CEH often tests the distinction between actions taken during the attack (privilege escalation, disabling AV) and actions taken after the attack to erase evidence (clearing logs, hiding files with rootkits, steganography), so candidates mistakenly select privilege escalation or AV disabling as track-covering methods.

Practice this question →

149

MCQeasy

A security analyst runs the command `nbtstat -A 192.168.1.105` on a Windows machine. What information is the analyst most likely trying to gather?

A.The NetBIOS name table and MAC address of the remote host

B.The LDAP directory structure of the domain

C.The SNMP community strings of the target

D.The SMB shares available on the remote host

AnswerA

The `nbtstat -a` (or `-A`) command is specifically designed to display the NetBIOS name table of a remote computer, identified by its IP address. This table includes registered NetBIOS names, their types, and crucially, the MAC address associated with the network interface. It provides valuable information for identifying systems and services relying on NetBIOS over TCP/IP, making it a direct and effective reconnaissance tool for this protocol.

Why this answer

The `nbtstat -A` command performs a NetBIOS name table lookup against the specified IP address using the NetBIOS over TCP/IP (NBT) protocol. It returns the remote host's NetBIOS name table, which includes registered names and services, along with the MAC address of the network adapter. This is a standard enumeration technique to identify the hostname, logged-in user, and other NetBIOS-related information.

Exam trap

The trap here is that candidates confuse `nbtstat -A` with `net view` or `nbtstat -a`, mistakenly thinking it lists SMB shares or uses a hostname instead of an IP address, when in fact `-A` specifically targets a remote IP and returns the NetBIOS name table and MAC.

How to eliminate wrong answers

Option B is wrong because LDAP directory structure is queried using LDAP-specific tools like `ldapsearch` or `nslookup` with SRV records, not `nbtstat`. Option C is wrong because SNMP community strings are obtained via SNMP enumeration tools like `snmpwalk` or `snmpenum`, not through NetBIOS commands. Option D is wrong because SMB shares are enumerated using commands like `net view` or tools like `smbclient`, while `nbtstat` only reveals NetBIOS names and MAC addresses, not share listings.

Practice this question →

150

Multi-Selecthard

Which TWO of the following are examples of hybrid password attacks? (Select 2 correct answers)

Select 2 answers

A.Using a wordlist to try every possible password in the list

B.Using a dictionary file and appending random numbers to each word

C.Using a set of rules with Hashcat to modify dictionary words (e.g., leet speak substitutions)

D.Generating all possible character combinations up to a certain length

E.Cracking passwords using precomputed rainbow tables

AnswersB, C

This is a classic example of a hybrid password attack, combining elements of a dictionary attack with a targeted brute-force component. By taking words from a dictionary file and systematically appending numerical sequences (e.g., 'password123', 'summer2024'), the attack efficiently targets common user password patterns that involve adding digits to memorable words. This method significantly expands the attack surface beyond a simple dictionary without resorting to a full, computationally expensive brute-force approach.

Why this answer

A hybrid password attack combines a dictionary or wordlist with additional modifications, such as appending random numbers to each word. This approach leverages common password patterns where users often add digits to a base word to meet complexity requirements, making it more effective than a simple dictionary attack.

Exam trap

EC-Council often tests the distinction between hybrid attacks and other attack types, and the trap here is that candidates may confuse a dictionary attack (Option A) with a hybrid attack, or mistake brute-force (Option D) or rainbow tables (Option E) as hybrid methods, when in fact hybrid attacks specifically combine a dictionary with rule-based modifications or appendages.

Practice this question →