CCNA Ceh Enum System Hacking Questions

B is correct because 'Hiding files' is a key phase in the CHPSET (Cracking, Hiding, Privilege Escalation, Sniffing, Executing, Targeting) system hacking methodology. After gaining access and escalating privileges, the attacker must hide malicious files, processes, or evidence to avoid detection by security tools or administrators. This step often involves techniques like file attribute manipulation, rootkits, or steganography to conceal the presence of the attacker on the compromised system.

Clearing event logs removes evidence of attacker activity. Using rootkits hides malicious processes and files. Both are standard covering tracks techniques.

John the Ripper is the most efficient tool for performing a dictionary attack against password hashes retrieved from a system, such as those obtained from the SAM database or via enum4linux. It supports a wide range of hash types and can be configured to use custom wordlists, making it ideal for cracking the 'sqlsvc' account password in an internal penetration test.

Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

The `snmpwalk` command is used to retrieve a subtree of management information from an SNMP agent. By specifying `-c public` (the community string) and `-v2c` (SNMP version 2c), the command performs a GETNEXT request cycle to walk the entire MIB tree, enumerating all accessible OIDs and their values. Option D correctly identifies this as enumerating the MIB tree using the 'public' community string.

CHPSET stands for Cracking, Hiding, Privilege escalation, Executing applications, Spying, Erasing tracks. Erasing tracks is the last phase, where attackers remove evidence of their activity.

enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.

The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.

CHPSET: Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing tracks. Hiding files involves techniques like ADS or steganography to conceal malicious files.

If a user has sudo rights to run vim as root, they can escape to a shell by typing `:!bash` within vim, gaining a root shell. This is a known sudo privilege escalation vector.

enum4linux is a tool for enumerating SMB (Server Message Block) services on Windows. Disclosing usernames can enable attackers to perform password guessing or brute‑force attacks.

The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

Option B is correct. The SMTP VRFY command is used to verify if a user exists on the server, enabling user enumeration.

The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.

smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Windows file shares. It can list available shares with the `-L` option and, with valid credentials, enumerate users via the `-U` flag or by browsing the IPC$ share. This makes it a direct tool for SMB enumeration.

Option D is correct because the VRFY command asks the mail server to verify whether a given email address exists, EXPN expands a mailing list to reveal individual addresses, and RCPT TO (used in the SMTP transaction) can also be used to check address validity by observing the server's response. Together, these commands allow an attacker to enumerate valid email accounts on the server.

A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.

Options C and D are correct. LDAP enumeration and SMTP enumeration are both enumeration techniques used to gather information about users, systems, or services.

The CHPSET methodology in system hacking stands for Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing. Option D correctly lists these phases in order: Cracking (password cracking), Hiding (covering tracks), Privilege escalation (gaining higher access), Executing (running malicious code), Spying (monitoring activity), and Erasing (removing evidence). This sequence follows the logical progression from initial access to maintaining access and finally covering tracks.

If logs are forwarded to a remote SIEM, local log deletion will still leave traces in the SIEM. A better approach is to manipulate specific log entries (e.g., modify or delete only the incriminating entries) to avoid raising alert on bulk deletion. However, the best among options is to modify logs selectively.

Covering tracks includes log manipulation (clearing or modifying logs), using rootkits to hide processes/files, and steganography to hide malicious data. Disabling antivirus is more of an evasion technique during the attack, not specifically covering tracks. Privilege escalation is a different phase.

Options B, C, and D are correct. Exploiting SUID binaries, kernel exploits, and sudo misconfigurations are common Linux privilege escalation techniques. A and E are enumeration steps, not escalation methods.

The `nbtstat -A` command performs a NetBIOS name table lookup against the specified IP address using the NetBIOS over TCP/IP (NBT) protocol. It returns the remote host's NetBIOS name table, which includes registered names and services, along with the MAC address of the network adapter. This is a standard enumeration technique to identify the hostname, logged-in user, and other NetBIOS-related information.

Option B is correct because a hybrid password attack combines a dictionary or wordlist with additional modifications, such as appending random numbers to each word. This approach leverages common password patterns where users often add digits to a base word to meet complexity requirements, making it more effective than a simple dictionary attack.

The default read-only community string in SNMPv1 and SNMPv2c is 'public'. This string acts as a password that allows an SNMP manager to query device MIB objects for monitoring purposes without making configuration changes. It is widely documented in RFC 1157 and is the standard default across most networking equipment.

Rootkits at the kernel level can intercept system calls and hide file changes from FIM. DKOM rootkits modify kernel objects to hide processes and files, making detection difficult.

nbtstat -A (with capital A) performs a NetBIOS name table lookup on a remote IP address, revealing computer names, logged-in users, and services.

Enumeration is the process of extracting detailed information about a target, such as user accounts, network shares, and services, which is used to identify potential attack vectors.

Option A is correct because `snmpwalk` is specifically designed to retrieve a subtree of MIB objects by performing a series of GETNEXT requests starting from a given OID. Using `.1` as the root OID (which corresponds to the entire ISO tree) with the SNMPv2c community string 'public' will enumerate all accessible OIDs in the MIB tree, effectively dumping the entire Management Information Base.

enum4linux is a wrapper around tools from the Samba suite, primarily using the SMB/CIFS protocol to query Windows systems for information such as user lists, shares, and OS details. It leverages SMB's remote IPC mechanisms (e.g., via \pipe\lsarpc or \pipe\samr) to enumerate these data points, making D the correct answer.

The command 'snmpwalk -v2c -c public 192.168.1.10' explicitly specifies SNMP version 2c with the '-v2c' flag and the community string 'public' with the '-c' flag. SNMPv2c is the most common version for read-only queries, and 'public' is the default read-only community string. The large output indicates successful enumeration of the MIB tree, confirming the community string is correct.

smbclient is a tool from the Samba suite specifically designed to interact with SMB/CIFS shares. It allows an attacker to enumerate available shares on a Windows target and retrieve file listings by connecting to the SMB service (port 445 or 139) using commands like 'smbclient -L //target' or by mounting a share and listing its contents.

Rainbow tables are precomputed tables of hash chains that allow fast lookup to reverse a hash into a plaintext password.

The 'Hiding files' phase of the CHPSET (Cracking passwords, Hacking, Privilege escalation, Spying, Erasing tracks, Executing applications, Hiding files) methodology involves concealing malicious files from the operating system and security tools. Techniques such as rootkits (which hook system calls like NtQueryDirectoryFile to hide files from directory listings) and steganography (embedding data within innocent files like images or audio) are used to avoid detection. This phase directly follows 'Executing applications' and ensures the attacker's payload remains persistent and covert.

Ophcrack is a free password cracker that uses rainbow tables to crack Windows hashes.

LDAP enumeration can be performed anonymously if the server allows. Tools like `ldapsearch` or `adfind` can query LDAP. Among the options, `ldapsearch` is the standard tool.