Vulnerability Analysis and System Hacking practice questions

Use SQLMap to test for SQL injection

Why wrong: Using SQLMap to test for SQL injection is entirely misdirected in this scenario, as SQLMap is a specialized tool designed exclusively for detecting and exploiting SQL injection vulnerabilities. SQL injection targets database interactions, attempting to manipulate backend queries, whereas the ethical hacker is assessing a web server for file inclusion vulnerabilities. These two vulnerability types operate on fundamentally different principles and exploit different parts of the application's code base, making SQLMap irrelevant for confirming file inclusion.

Scan the server with Nikto to detect known RFI signatures

Why wrong: Scanning the server with Nikto to detect known RFI signatures provides an automated, high-level assessment of potential vulnerabilities, but it does not offer definitive proof or confirmation. While Nikto can identify common misconfigurations or patterns associated with file inclusion, its findings are typically indicators that require manual verification and exploitation attempts. The question implies a need for direct confirmation of the vulnerability, which a generic scanner cannot provide with the same certainty as a targeted, manual request.

Attempt to include a remote URL containing a web shell

Why wrong: Attempting to include a remote URL containing a web shell is an act of exploitation that carries significant risk and is not a safe or ethical first step for vulnerability confirmation. Deploying a web shell could lead to full system compromise, data exfiltration, or unauthorized code execution, violating the ethical hacking principle of non-destructiveness. Ethical hackers prioritize confirming vulnerabilities through the least intrusive means possible before escalating to potentially harmful exploitation techniques.

Phishing

Why wrong: Phishing is a social engineering technique, not a direct password cracking method. It involves deceptively acquiring sensitive information, such as usernames and passwords, by masquerading as a trustworthy entity in an electronic communication. The user willingly, albeit unknowingly, provides their credentials, rather than the attacker computationally deriving or bypassing them.

Man-in-the-middle attack

Why wrong: A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. While an MITM attack can be used to capture credentials transmitted over an insecure channel, it does not directly crack or compute a password; it merely intercepts it during transmission.

Keylogging

Why wrong: Keylogging is a surveillance technique that records every keystroke made on a target system, including usernames and passwords as they are typed. While effective for capturing credentials, it is a method of *obtaining* a password through monitoring user input, not a technique for *cracking* or computationally deriving a password from a stored hash or by guessing.

MAC Address 00:1A:2B:3C:4D:5E

Why wrong: A MAC address, such as 00:1A:2B:3C:4D:5E, is a hardware identifier assigned to a network interface controller (NIC) at Layer 2 of the OSI model. It uniquely identifies a device on a local network segment, but it does not represent a network service or application that Nmap would identify as running on a specific port. Therefore, it cannot be the 'most likely service' based on scan output, as services operate at higher layers.

Apache httpd 2.4.18

Why wrong: Apache httpd 2.4.18, while a widely used web server, typically presents vulnerabilities related to information disclosure, denial-of-service, or specific configuration weaknesses, rather than direct Remote Code Execution (RCE). Although security patches are always recommended, this specific version does not have a widely known, easily exploitable RCE vulnerability that would make it the 'most likely' candidate for such an impact compared to other options. Its common exploits usually require more complex chaining or specific module misconfigurations.

OpenSSH 7.2p2

Why wrong: OpenSSH 7.2p2, a secure shell protocol implementation, has had various vulnerabilities identified, including username enumeration (CVE-2016-6210) and certain authentication bypasses under specific conditions. However, direct, unauthenticated Remote Code Execution (RCE) vulnerabilities are not commonly associated with this particular version in a straightforward manner. Exploiting OpenSSH for RCE typically requires pre-authentication flaws or post-authentication privilege escalation, making it less likely to be the primary RCE target compared to other services with known critical flaws.

HTTP (80) - exploit Apache vulnerability

Why wrong: Targeting HTTP (80) with CVE-2015-0228, an Apache mod_lua vulnerability, is not the optimal first step. This specific flaw primarily leads to a Denial of Service (DoS) condition, causing the server to crash or become unresponsive, rather than providing remote code execution (RCE) or direct access. While a DoS can disrupt operations, it does not facilitate initial system compromise or privilege escalation, making it a low-severity impact for an initial attack vector compared to RCE. Therefore, it fails to achieve the primary goal of gaining control.

SSH (22) - brute force user credentials

Why wrong: Attempting to brute force SSH (22) credentials, even with knowledge of CVE-2016-6210 for user enumeration, is an inefficient and high-risk initial attack strategy. While user enumeration can refine target lists, brute-forcing is inherently noisy, generating numerous log entries that can trigger intrusion detection systems and alert administrators. Furthermore, it is a time-consuming process with a low probability of immediate success, especially against robust password policies and lockout mechanisms, making it unsuitable for rapid initial access compared to exploiting a direct RCE vulnerability.

Proxy (8080) - exploit Squid vulnerability

Why wrong: Exploiting the Squid proxy service on port 8080 using CVE-2019-12524 is not the most effective initial attack vector. This vulnerability primarily allows for Denial of Service (DoS) or cache poisoning, which can disrupt service availability or manipulate cached content, respectively. However, neither of these outcomes directly grants remote code execution (RCE) or a shell on the target system, which is typically the objective for initial compromise. Its impact is generally limited to service disruption or data integrity issues rather than direct system control.

admin

Why wrong: The 'admin' account utilizes SHA-512, indicated by the '$6$' prefix in its password hash. SHA-512 is a robust cryptographic hash function, part of the SHA-2 family, designed with a significantly larger output size and greater computational complexity than older algorithms like MD5. Its inherent strength and resistance to collision and preimage attacks make it a secure choice for password storage, thus not representing the weakest option among those presented.

root

Why wrong: The 'root' account also employs SHA-512 hashing, denoted by the '$6$' identifier preceding its password hash. This algorithm incorporates a high number of rounds and a large digest size, making brute-force and rainbow table attacks computationally intensive and impractical. Given its strong cryptographic properties and widespread adoption in secure systems, SHA-512 provides a high level of protection against password cracking, ensuring 'root' is not the weakest account.

All are equally strong

Why wrong: This statement is incorrect because the security strength of password hashes is directly dependent on the underlying cryptographic algorithm used. The exhibit clearly shows different algorithms in use: MD5 ($1$) and SHA-512 ($6$). MD5 is a deprecated and weak algorithm, while SHA-512 is a modern, strong algorithm. Therefore, the accounts are not equally protected, with 'user' being significantly weaker due to its MD5 hash.

OpenSSH 7.2p2

Why wrong: OpenSSH 7.2p2 is incorrect because CVE-2019-0215 specifically targets the Apache HTTP Server, not the OpenSSH suite. OpenSSH is a collection of secure networking utilities, primarily used for remote login and secure file transfer, operating on a different layer and serving a distinct purpose from a web server. Therefore, a vulnerability affecting Apache's mod_cgi module would have no impact on an OpenSSH installation.

Linux kernel

Why wrong: The Linux kernel is an incorrect choice because CVE-2019-0215 is an application-layer vulnerability affecting the Apache HTTP Server's mod_cgi module, not the operating system's core. The kernel manages system resources and hardware interactions, whereas this CVE involves a privilege escalation flaw within a specific web server component. Exploiting this vulnerability requires interaction with the Apache web server, not direct manipulation of kernel functions.

Squid http proxy 3.5.12

Why wrong: Squid http proxy 3.5.12 is incorrect as CVE-2019-0215 is a vulnerability specific to the Apache HTTP Server's handling of CGI scripts. Squid functions primarily as a caching and forwarding HTTP web proxy, not as a full-fledged web server capable of executing CGI scripts in the same manner as Apache. Its architecture and operational scope do not include the vulnerable mod_cgi component, rendering it immune to this particular exploit.

The group membership is not replicated to domain controllers.

Why wrong: Local group memberships, like those on a standalone workstation or a member server, are stored within the Security Account Manager (SAM) database of the local machine. Unlike domain groups in Active Directory, these local groups and their memberships are not replicated to domain controllers. Therefore, the concept of replication is irrelevant to the security posture or management of a local administrator account, as its scope is confined to the specific host where it resides.

The account has a weak password.

Why wrong: While a weak password is a critical security vulnerability that could lead to account compromise through brute-force or dictionary attacks, the provided exhibit and question stem do not offer any information regarding the password complexity or strength of the SupportUser account. The auditor's discovery, as implied by the question, points to an issue with the account's assigned privileges rather than its authentication credentials. Therefore, concluding that the password is weak is an assumption not supported by the given context.

The account name is misspelled.

Why wrong: The spelling of an account name, whether 'SupportUser' or a slight variation, has no direct bearing on the security posture of the account itself. While consistent naming conventions are crucial for organizational clarity, auditing, and ease of management, a misspelling does not inherently create a vulnerability or alter the permissions assigned to the account. The security risk is derived from the privileges associated with the account, not its nomenclature.

Denial of Service (DoS) attack

Why wrong: A Denial of Service (DoS) attack aims to render a service unavailable to legitimate users, typically by overwhelming it with excessive traffic, exploiting vulnerabilities to crash the service, or consuming all available resources. The provided logs, which clearly show repeated authentication failures, do not present any evidence of service disruption, high network load, or resource exhaustion. Instead, they precisely depict attempts to gain unauthorized access, which is a distinct objective from a DoS attack.

Dictionary attack on SSH service

Why wrong: A dictionary attack is a specific type of brute-force attack that utilizes a predefined list of common words, phrases, or previously leaked passwords against a target account. While similar to a general brute-force, the logs showing numerous failed password attempts for the *same* `root` user from a single source IP are more broadly and accurately described as a brute-force attack. Without specific evidence of the *types* of passwords being attempted (e.g., common dictionary words), the overarching term 'brute force' is the most fitting description for systematic, repeated login attempts against a single account.

Port scanning of the SSH server

Why wrong: Port scanning involves an attacker sending connection requests to a range of ports on a target system to identify open services and potential entry points. Logs indicative of port scanning would typically show connection attempts to multiple different port numbers, often followed by connection resets or rejections, rather than repeated authentication failures on a single, known service port like SSH (port 22). The observed logs specifically detail failed login attempts, confirming the SSH service is already discovered and targeted for authentication, not discovery.

The web-app version is 2.4, which is outdated.

Why wrong: While an outdated web application version (2.4) certainly presents an increased risk due to potential unpatched vulnerabilities, the question specifically asks for a potential weakness identifiable from the exhibit. Without further context or specific CVEs linked to version 2.4, merely being outdated is a general concern rather than an immediately exploitable weakness compared to a misconfigured security control like session timeout. A long session timeout directly impacts the window of opportunity for session hijacking.

The error page location is configurable.

Why wrong: The ability to configure the error page location is actually a security best practice, not a weakness. Custom error pages prevent the web server from displaying default, verbose error messages that often reveal sensitive system information, such as server versions, file paths, or stack traces, which attackers could leverage for further exploitation. Therefore, this configurability helps mitigate information leakage risks.

The servlet class name is exposed.

Why wrong: Exposing the servlet class name, while providing some internal application detail, is generally not considered a direct security vulnerability or sensitive information that attackers can immediately exploit. Unlike stack traces or server version numbers, a class name itself does not typically reveal critical system configurations, proprietary algorithms, or direct pathways to compromise the application's security posture. It's more of an informational disclosure than an exploitable weakness.

The system is running Windows 10 Pro version 19041.

Why wrong: Windows 10 Pro version 19041, also known as 20H2, is a specific build of the operating system. While knowing the exact version is useful for identifying potential vulnerabilities, the version number itself is not inherently a security flaw. The critical factor is whether all applicable security updates and patches for that version have been installed, as unpatched vulnerabilities are the true risk, not the base version.

The last installed hotfix is from April 2021, indicating the system may be missing newer patches.

Why wrong: The indication that the last installed hotfix is from April 2021 suggests the system is likely missing numerous security updates released since that date. While missing patches represent a significant and common attack surface, this general vulnerability is less specific and immediately exploitable than a known registry misconfiguration. In a multiple-choice scenario, a direct misconfiguration allowing UAC bypass is typically considered a more critical and actionable finding than a general patch deficit.

The system type is x64-based, but no additional security concerns are noted.

Why wrong: Identifying the system as x64-based merely describes its processor architecture, which is a standard and prevalent design for modern computing systems. This architectural detail does not inherently introduce security vulnerabilities or concerns on its own. While specific exploits might target x64 systems, the architecture itself is not a misconfiguration or a security flaw requiring remediation.

Nikto

Why wrong: Nikto is a specialized web server scanner designed to identify common vulnerabilities, misconfigurations, and outdated software on HTTP/HTTPS services. It operates at the application layer (Layer 7) to analyze web applications and servers for known issues. Consequently, Nikto is entirely unsuitable for enumerating information from Windows SMB services, which utilize different network protocols and ports (e.g., 445, 139) and are not web-based.

Hydra

Why wrong: Hydra is a robust, multi-protocol brute-forcing tool primarily used for guessing login credentials across a wide array of network services, including SMB. While it can interact with SMB to attempt authentication, its core function is to test for weak passwords, not to passively enumerate system details like user lists, share names, or operating system versions without attempting to log in. Therefore, it is not an enumeration tool in the context of gathering unauthenticated system information.

Nmap

Why wrong: Nmap is a versatile network scanner excellent for host discovery, port scanning, service identification, and operating system detection. While Nmap can identify open SMB ports and even use specific NSE scripts (e.g., `smb-os-discovery`) to gather basic SMB-related information, it does not provide the comprehensive, detailed enumeration of users, groups, shares, and system policies that dedicated SMB enumeration tools offer. Its primary role is broader network reconnaissance, not deep SMB-specific data extraction.

Exploit a kernel vulnerability using a local exploit

Why wrong: Exploiting a kernel vulnerability with a local exploit is generally a complex and high-risk endeavor. Such exploits often require specific kernel versions and configurations, making them unreliable and potentially causing system instability or crashes. Furthermore, kernel exploits are typically a last resort when other, simpler privilege escalation methods, such as misconfigured SUID binaries or sudo permissions, are unavailable or have been exhausted.

Use the find command with -exec to execute a shell

Why wrong: Using the find command with the -exec option to execute a shell would only grant the privileges of the user running find. For this technique to achieve privilege escalation, the find binary itself would need to be executed with elevated privileges, either by being a SUID (Set User ID) root binary or by being explicitly allowed to run via sudo. Without find having these elevated permissions, -exec simply runs commands as the current, unprivileged user.

Check for world-writable scripts in cron jobs

Why wrong: Checking for world-writable scripts in cron jobs is a legitimate privilege escalation vector, as an attacker could modify such a script to execute malicious code when the cron job runs. However, this method relies on the cron job's scheduled execution, meaning it's not an immediate way to gain a root shell. Given the availability of a more direct sudo privilege escalation path (as suggested by the correct answer), this approach is less immediate and efficient.

Remove the JndiLookup class from the Log4j jar

Why wrong: Removing the JndiLookup class from the Log4j JAR file (e.g., log4j-core-*.jar) is a manual workaround that directly eliminates the vulnerable component responsible for JNDI lookups. While effective in preventing exploitation of CVE-2021-44228, it is considered a mitigation rather than a proper patch. This approach requires careful execution to avoid corrupting the library and might not be easily reversible or maintainable across multiple deployments, making a full version update the superior long-term solution.

Disable JDBC appender in Log4j configuration

Why wrong: Disabling the JDBC appender in Log4j configuration only prevents potential exploitation scenarios where malicious input could interact with database connections via JNDI. However, the Log4Shell vulnerability (CVE-2021-44228) is far broader, primarily leveraging LDAP and other JNDI-enabled services for remote code execution. This action leaves numerous other attack vectors open, such as those involving RMI, DNS, or other custom JNDI resource lookups, rendering it an incomplete and ineffective mitigation strategy for the core vulnerability.

Block outbound traffic from the server to the internet

Why wrong: Blocking outbound traffic from the server to the internet is a temporary network-level mitigation that can prevent the vulnerable Log4j instance from fetching malicious payloads from external LDAP or RMI servers. While this can disrupt the final stage of a Log4Shell attack, it does not address the underlying vulnerability within the Log4j library itself. The server remains exploitable internally or if an attacker can establish an internal malicious server, making it an insufficient long-term solution that merely contains, rather than resolves, the risk.

SQL injection

Why wrong: SQL injection vulnerabilities arise when an application constructs SQL queries using unsanitized user input, allowing an attacker to manipulate the database logic. While an attacker might indirectly retrieve session IDs stored in a database via SQLi, the attack vector itself targets the database server to execute arbitrary commands or extract data, not the client-side session cookie directly from the user's browser. It's a server-side attack on data integrity and confidentiality, distinct from client-side cookie manipulation.

Cross-site request forgery (CSRF)

Why wrong: Cross-site request forgery (CSRF) exploits the trust a web application has in a user's browser, tricking an authenticated user into unknowingly executing unwanted actions on a trusted site. The attack leverages the browser's automatic inclusion of session cookies with requests to the target domain, but the attacker never directly accesses or steals the user's session cookie. Instead, the user's browser sends the cookie along with the forged request, making the action appear legitimate to the server.

Clickjacking

Why wrong: Clickjacking, also known as UI redressing, involves layering a transparent malicious iframe over a legitimate web page, tricking users into clicking hidden elements on the underlying page. The user believes they are interacting with the visible, benign content, but their clicks are actually directed to the concealed malicious content. This attack primarily aims to induce unintended user actions, such as making purchases or changing settings, rather than directly stealing session cookies or hijacking an existing session.

Use of return-oriented programming (ROP)

Why wrong: Return-oriented programming (ROP) is an advanced exploitation technique used *after* a buffer overflow has successfully corrupted the stack, typically to bypass Data Execution Prevention (DEP). ROP involves chaining together small snippets of existing code (gadgets) within the program's memory to achieve arbitrary code execution. Therefore, ROP itself is a *consequence* or *method of exploitation*, not an initial indicator that a buffer overflow *is occurring*.

High CPU usage

Why wrong: High CPU usage indicates that a process is consuming significant processing power, which can be caused by numerous factors such as inefficient algorithms, infinite loops, heavy computational tasks, or even other types of malware. While a program might enter an infinite loop or perform excessive computations *after* a buffer overflow has been exploited, high CPU usage is not a direct or specific indicator of the buffer overflow event itself, which primarily involves memory corruption.

Use the web_svc account to create a new SQL Server login with sysadmin privileges via the SQL Server Management Studio

Why wrong: The web_svc account is typically configured with the principle of least privilege, meaning it possesses only the minimum necessary permissions for the web application's database interactions. It would lack the securityadmin or sysadmin server roles required to create new SQL Server logins or grant elevated privileges like sysadmin, making this action unauthorized and destined to fail.

Perform a brute-force attack against the 'sa' account on the database server using a wordlist

Why wrong: Brute-forcing the 'sa' account is an extremely noisy technique that risks immediate detection by database security monitoring systems or intrusion detection systems. This method is highly likely to trigger account lockout policies, leading to a denial of service for legitimate users and alerting administrators to the attack. Furthermore, the 'sa' account is almost universally protected by strong, complex passwords, rendering wordlist attacks inefficient and often unsuccessful.

Try to use the web_svc account to directly query the credit card table using a SQL injection payload on the web application

Why wrong: The web_svc account, adhering to the principle of least privilege, is intentionally restricted from accessing sensitive tables like credit_card directly. Even if a SQL injection payload successfully executes, the underlying database permissions of the web_svc account would prevent it from performing SELECT operations on unauthorized tables. Therefore, any attempt to query the credit card table via this account would be met with a permission denied error at the database level.

Run the tool as Administrator

Why wrong: While Administrator privileges are essential for many system operations, they are insufficient to directly access the Security Account Manager (SAM) database file (typically C:\Windows\System32\config\SAM) when the Windows operating system is running. The OS maintains an exclusive lock on the SAM file to prevent corruption and ensure the integrity of user authentication data. Even an administrator cannot bypass this file lock without employing specific techniques that interact with the OS's file management or snapshot capabilities.

Use reg.exe save to export SAM hive

Why wrong: The reg.exe save command is designed to export a registry hive to a file. However, when the Windows operating system is active, the SAM hive (which contains the SAM database) is continuously in use and locked by the kernel. Attempting to use reg save HKLM\SAM C:\sam.hiv will typically result in an "Access Denied" error, even with administrative privileges, because the command cannot overcome the exclusive file lock imposed by the operating system on a live, in-use hive.

Enable SeDebugPrivilege for the current process

Why wrong: Enabling SeDebugPrivilege grants a process the ability to debug other processes, including system processes, and to read or modify their memory. While this privilege is crucial for techniques like process injection, memory dumping, or interacting with other running applications, it does not provide any mechanism to bypass file system locks. The SeDebugPrivilege operates at the process level, not the file system level, and therefore has no direct impact on the operating system's exclusive lock on the SAM database file.

Authentication bypass via SQL injection

Why wrong: Authentication bypass via SQL injection is a distinct vulnerability where an attacker manipulates an application's database queries to gain unauthorized access, typically by injecting malicious SQL syntax into input fields. Unlike buffer overflows, which exploit memory corruption to alter program execution, SQL injection targets the database layer, leveraging improper input validation to trick the database into processing unintended commands, such as bypassing login credentials.

Cross-site scripting (XSS)

Why wrong: Cross-site scripting (XSS) is a client-side web vulnerability where malicious scripts are injected into trusted websites, typically through input fields, and executed in the victim's browser. This differs fundamentally from buffer overflows, which are server-side memory corruption issues affecting the application's execution flow. XSS exploits the browser's trust in a website to steal cookies, deface content, or redirect users, without directly manipulating server memory.

Race condition

Why wrong: A race condition occurs when the output of concurrent operations is unexpectedly dependent on the sequence or timing of other uncontrollable events, leading to unpredictable or insecure behavior. This is fundamentally different from a buffer overflow, which is a deterministic memory corruption vulnerability caused by writing data beyond the allocated buffer boundaries. While timing can sometimes influence the exploitability of a buffer overflow, the core vulnerability itself is not a timing issue but a memory safety flaw.

Add drop rule for SSH, check current rules, verify the new rule, test connectivity, save the rules

Why wrong: This order is flawed because adding a rule before checking the existing ruleset can introduce conflicts, duplicate entries, or place the new rule in an ineffective position due to a broader, preceding rule. While verification would eventually highlight some issues, a proactive check minimizes configuration errors. Furthermore, testing connectivity before saving means the rule is not persistent, risking loss on reboot, and saving after testing could persist a broken configuration if the test failed.

Check current rules, add drop rule for SSH, test connectivity, verify the new rule, save the rules

Why wrong: Testing connectivity immediately after adding a rule but before verifying its application is a critical procedural error. The rule might not have been applied correctly due to syntax issues, incorrect chain specification, or other operational failures, leading to false test results. This premature testing could indicate success when the rule isn't active, or failure for unrelated reasons, making accurate troubleshooting impossible. Verification (`iptables -L`) must always precede functional testing to confirm the rule's presence and parameters.

Save the rules, check current rules, add drop rule for SSH, verify the new rule, test connectivity

Why wrong: Initiating the process by saving the rules is fundamentally incorrect and counterproductive. `iptables-save` or `netfilter-persistent save` writes the *current* active ruleset to a persistent configuration file. If no changes have been made yet, this action simply saves the existing, unchanged configuration, effectively overwriting any previous persistent state with the same old state. This negates the purpose of saving and wastes a step, as the desired new rule has not even been added yet.

Vishing: A targeted form of phishing directed at a specific individual.

Why wrong: The provided definition incorrectly describes spear phishing, not vishing. Vishing, a portmanteau of 'voice' and 'phishing,' is a social engineering attack conducted over the telephone, where attackers impersonate trusted entities to manipulate victims into divulging sensitive information or performing actions. This often involves using techniques like caller ID spoofing and pre-recorded messages to create a sense of urgency or authority, making it a distinct vector from email or website-based attacks.

Smishing: Voice phishing using phone calls.

Why wrong: The given definition inaccurately describes vishing, not smishing. Smishing refers to phishing attacks delivered via SMS (Short Message Service) text messages, where attackers send fraudulent messages designed to trick recipients into clicking malicious links, calling premium-rate numbers, or revealing personal data. These messages often mimic legitimate alerts from banks, delivery services, or government agencies, exploiting the ubiquitous nature of mobile communication.