CEH Introduction to Ethical Hacking Practice Question
You are a penetration tester hired by a financial services company to assess the security of their external web application. The application is a customer portal hosted on a Linux server with Apache 2.4.6 and PHP 7.2. During reconnaissance, you discover that the server responds to HTTP OPTIONS requests and the Allow header includes PUT and DELETE methods. The application uses a MySQL database backend. You also find a file upload feature in the profile section that accepts JPEG images. While testing, you notice that uploading a file with a .php extension returns a '403 Forbidden' error, but uploading a file with .php5 or .phtml extension succeeds. The uploaded files are stored in /uploads/ directory. What should be your next step to escalate the attack?
⚠ Common exam trap
Watch out — candidates often assume PUT method (Option A) is the primary escalation path because it is listed in the Allow header, but they overlook that the file upload feature with .phtml extension is a confirmed, working vector that directly leads to code execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.
The server allows file uploads with .phtml extension, which Apache processes as PHP due to its configuration. Uploading a PHP web shell with .phtml extension to the /uploads/ directory and accessing it directly allows command execution, escalating the attack. This bypasses the 403 Forbidden restriction on .php files while leveraging the existing upload functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the PUT method to upload a malicious file directly to the web root.
Why it's wrong here
While the HTTP PUT method can theoretically be used to upload files, it is frequently disabled or heavily restricted on production web servers, especially for sensitive directories like the web root. Even if the 'Allow' header indicates PUT is supported, server-side configurations often prevent arbitrary file creation, making this a low-probability initial attack vector for direct web root compromise without prior authentication or a specific vulnerability.
- ✓
Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.
Why this is correct
This approach leverages a common file upload vulnerability bypass technique. By using a '.phtml' extension, which Apache servers often interpret as PHP, the attacker can circumvent typical blacklist filters that block '.php' files. Once uploaded to an accessible directory like '/uploads/', the web shell can be requested, allowing the attacker to execute arbitrary commands on the server, achieving remote code execution.
- ✗
Exploit the IIS WebDAV vulnerability to execute commands.
Why it's wrong here
Exploiting an IIS WebDAV vulnerability would be ineffective in this scenario because the target server is explicitly stated or implied to be running Apache, not Microsoft's Internet Information Services (IIS). WebDAV vulnerabilities are specific to the IIS architecture and its implementation of the Web Distributed Authoring and Versioning protocol, making them irrelevant for an Apache-based environment.
- ✗
Attempt SQL injection in the login form to extract database credentials.
Why it's wrong here
While SQL injection is a critical vulnerability often found in login forms, there is no evidence provided in the question stem to suggest its presence or exploitability in this specific context. Prioritizing an unconfirmed SQL injection attempt over a known or implied file upload vulnerability, which directly leads to remote code execution, would be an inefficient and less certain approach for initial compromise.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.