CEH Vulnerability Analysis and System Hacking Practice Question
You are a penetration tester hired by a medium-sized financial company. The company has a network consisting of 50 Windows workstations (Windows 10 Pro) and 5 Windows Server 2019 servers (domain controller, file server, web server, database server, and mail server). The network is segmented into three VLANs: User VLAN (192.168.1.0/24), Server VLAN (192.168.2.0/24), and DMZ (192.168.3.0/24). The web server is in the DMZ and hosts a public-facing e-commerce application built on ASP.NET with a SQL Server backend. The database server is in the Server VLAN and is not directly accessible from the internet. You are given a standard user account on a workstation in the User VLAN. After initial reconnaissance, you discover that the web server is running an outdated version of IIS (7.5) and is vulnerable to a known privilege escalation vulnerability (CVE-2020-0613) that allows local privilege escalation if an attacker has already gained initial access. You also find that the web application has a SQL injection vulnerability in the login page. You successfully exploit the SQL injection to extract the password hash of the web application's service account, which is 'web_svc'. You crack the hash offline and obtain the plaintext password. The 'web_svc' account has local administrative privileges on the web server. Using these credentials, you authenticate to the web server via RDP. From there, you want to pivot to the database server to extract credit card information stored in the database. The database server only allows connections from the web server on port 1433 (SQL Server). Using the 'web_svc' account, you are able to connect to the database server using SQL Server Management Studio. However, you find that the 'web_svc' account has only 'public' and 'guest' database roles, which do not allow reading any sensitive tables. You need to escalate privileges on the database server. What is the most effective next step?
⚠ Common exam trap
Many candidates assume the web_svc account's local admin rights on the web server translate to database privileges, but SQL Server role-based access control is separate, so they must escalate locally first to capture the higher-privileged service account credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploit the privilege escalation vulnerability on the web server to gain SYSTEM access, then dump the SQL Server service account credentials (e.g., from the SQL Server error logs or registry) and use them to log into the database server with sysadmin privileges
The web_svc account lacks sufficient database privileges, but by exploiting the privilege escalation vulnerability (CVE-2020-0613) on the web server to gain SYSTEM access, you can extract the SQL Server service account credentials (e.g., from SQL Server error logs or registry). The SQL Server service account typically runs with sysadmin privileges, allowing you to connect to the database server with full administrative rights and access the credit card data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the web_svc account to create a new SQL Server login with sysadmin privileges via the SQL Server Management Studio
Why it's wrong here
The web_svc account is typically configured with the principle of least privilege, meaning it possesses only the minimum necessary permissions for the web application's database interactions. It would lack the securityadmin or sysadmin server roles required to create new SQL Server logins or grant elevated privileges like sysadmin, making this action unauthorized and destined to fail.
- ✓
Exploit the privilege escalation vulnerability on the web server to gain SYSTEM access, then dump the SQL Server service account credentials (e.g., from the SQL Server error logs or registry) and use them to log into the database server with sysadmin privileges
Why this is correct
Exploiting a local privilege escalation vulnerability on the web server to gain SYSTEM access provides full control over the underlying operating system. With SYSTEM privileges, an attacker can access memory, registry hives, or log files where the SQL Server service account credentials are often stored or cached. Since the SQL Server service account typically holds sysadmin privileges on its own instance to perform its functions, these credentials can then be used to log into the database with the highest level of access.
- ✗
Perform a brute-force attack against the 'sa' account on the database server using a wordlist
Why it's wrong here
Brute-forcing the 'sa' account is an extremely noisy technique that risks immediate detection by database security monitoring systems or intrusion detection systems. This method is highly likely to trigger account lockout policies, leading to a denial of service for legitimate users and alerting administrators to the attack. Furthermore, the 'sa' account is almost universally protected by strong, complex passwords, rendering wordlist attacks inefficient and often unsuccessful.
- ✗
Try to use the web_svc account to directly query the credit card table using a SQL injection payload on the web application
Why it's wrong here
The web_svc account, adhering to the principle of least privilege, is intentionally restricted from accessing sensitive tables like credit_card directly. Even if a SQL injection payload successfully executes, the underlying database permissions of the web_svc account would prevent it from performing SELECT operations on unauthorized tables. Therefore, any attempt to query the credit card table via this account would be met with a permission denied error at the database level.
Visual reference
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.