Certified Ethical Hacker System Hacking and Malware 2 — Questions and Answers
Question 1: An attacker uses the SAM file extracted from a Windows host to recover plaintext passwords offline. Which tool is BEST suited for this cracking task?
- Wireshark
- John the Ripper (Correct answer)
- Nikto
- Netcat
Correct answer: John the Ripper
John the Ripper is a password-cracking tool that can attack NTLM/SAM hashes offline.
Question 2: Which Windows technique allows an attacker to authenticate using a captured NTLM hash without ever cracking it to plaintext?
- Pass-the-Hash (Correct answer)
- Rainbow table lookup
- Dictionary attack
- Brute force
Correct answer: Pass-the-Hash
Pass-the-Hash reuses the captured NTLM hash directly to authenticate to remote services.
Question 3: A rootkit that operates by modifying the kernel's system call table is classified as which type?
- Application-level rootkit
- Library-level rootkit
- Kernel-level rootkit (Correct answer)
- Boot-sector rootkit
Correct answer: Kernel-level rootkit
Kernel-level rootkits hook or modify kernel structures such as the system call table.
Question 4: During privilege escalation on Linux, an attacker finds a SUID binary owned by root. What does exploiting it most directly grant?
- Network sniffing ability
- Execution with the file owner's (root) privileges (Correct answer)
- A reverse DNS record
- Persistent cron access only
Correct answer: Execution with the file owner's (root) privileges
A SUID binary runs with the privileges of its owner, so a root-owned SUID can yield root execution.
Question 5: Which technique hides data by embedding it inside the unused slack space or within an image file's least significant bits?
- Steganography (Correct answer)
- Tunneling
- Spoofing
- Fuzzing
Correct answer: Steganography
Steganography conceals data within other files such as images using techniques like LSB embedding.
Question 6: An attacker clears the Windows Security event log to cover their tracks. Which command-line tool can wipe a specific event log?
- ipconfig
- wevtutil (Correct answer)
- tasklist
- chkdsk
Correct answer: wevtutil
wevtutil cl Security clears the Windows Security event log.
Question 7: Which malware type replicates itself across networks without requiring user interaction or a host file?
- Virus
- Worm (Correct answer)
- Logic bomb
- Trojan
Correct answer: Worm
A worm self-propagates across networks autonomously without needing a host file or user action.
Certified Ethical Hacker System Hacking and Malware 2
An attacker uses the SAM file extracted from a Windows host to recover plaintext passwords offline.
Which tool is BEST suited for this cracking task?