Certified Ethical Hacker System Hacking and Malware 2

Question 1

An attacker uses the SAM file extracted from a Windows host to recover plaintext passwords offline. Which tool is BEST suited for this cracking task?

Accepted Answer

John the Ripper

Answer

John the Ripper is a password-cracking tool that can attack NTLM/SAM hashes offline.

Question 2

Which Windows technique allows an attacker to authenticate using a captured NTLM hash without ever cracking it to plaintext?

Accepted Answer

Pass-the-Hash

Answer

Pass-the-Hash reuses the captured NTLM hash directly to authenticate to remote services.

Question 3

A rootkit that operates by modifying the kernel's system call table is classified as which type?

Accepted Answer

Kernel-level rootkit

Answer

Kernel-level rootkits hook or modify kernel structures such as the system call table.

Question 4

During privilege escalation on Linux, an attacker finds a SUID binary owned by root. What does exploiting it most directly grant?

Accepted Answer

Execution with the file owner's (root) privileges

Answer

A SUID binary runs with the privileges of its owner, so a root-owned SUID can yield root execution.

Question 5

Which technique hides data by embedding it inside the unused slack space or within an image file's least significant bits?

Accepted Answer

Steganography

Answer

Steganography conceals data within other files such as images using techniques like LSB embedding.

Certified Ethical Hacker Practice Test