Ethical Hacking System Hacking 1 — Questions and Answers
Question 1: What is the primary goal of privilege escalation in system hacking?
- Gaining higher-level access rights than initially obtained (Correct answer)
- Stealing user credentials from the target system
- Installing malware on the target system
- Scanning the network for open ports
Correct answer: Gaining higher-level access rights than initially obtained
Privilege escalation aims to gain elevated permissions (e.g., admin or root) beyond what was initially compromised, allowing greater control over the target system.
Question 2: Which Windows database stores locally cached user account password hashes?
- SAM (Security Account Manager) (Correct answer)
- NTFS (New Technology File System)
- LSA (Local Security Authority)
- HKLM (HKEY Local Machine)
Correct answer: SAM (Security Account Manager)
The SAM database stores Windows user account passwords as hashes and is a primary target for credential dumping attacks.
Question 3: What type of malware is specifically designed to hide its presence and maintain persistent privileged access on a compromised system?
- Adware
- Rootkit (Correct answer)
- Ransomware
- Worm
Correct answer: Rootkit
Rootkits are designed to conceal themselves and other malicious software while maintaining privileged access, often modifying OS components to avoid detection.
Question 4: Which Metasploit post-exploitation module is commonly used to extract NTLM password hashes from a compromised Windows system?
- post/windows/gather/credentials/credential_collector
- post/multi/recon/local_exploit_suggester
- post/windows/gather/hashdump (Correct answer)
- exploit/windows/smb/ms17_010_eternalblue
Correct answer: post/windows/gather/hashdump
The hashdump module in Metasploit extracts NTLM password hashes from the SAM database on compromised Windows systems for offline cracking.
Question 5: What is a pass-the-hash (PtH) attack?
- Using a plaintext password to authenticate to a remote system
- Using a captured NTLM hash to authenticate without knowing the actual password (Correct answer)
- Cracking a password hash offline using a dictionary attack
- Sending a hashed payload to exploit a buffer overflow vulnerability
Correct answer: Using a captured NTLM hash to authenticate without knowing the actual password
Pass-the-hash allows attackers to authenticate to Windows systems using the NTLM hash directly without needing to crack or know the plaintext password.
Question 6: Which tool is widely used for password cracking through brute force, dictionary, and rainbow table attacks?
- Nmap
- Wireshark
- John the Ripper (Correct answer)
- Burp Suite
Correct answer: John the Ripper
John the Ripper is a popular open-source password security auditing tool that supports multiple cracking modes and numerous hash types.
Question 7: What does 'living off the land' (LotL) mean in the context of system hacking?
- Using zero-day exploits to bypass all security controls
- Using legitimate system tools already present on the target to carry out attacks and evade detection (Correct answer)
- Installing custom malware frameworks on a compromised system
- Harvesting credentials stored in browser profiles and password managers
Correct answer: Using legitimate system tools already present on the target to carry out attacks and evade detection
LotL attacks leverage built-in system tools like PowerShell, WMI, or certutil to execute malicious activities, reducing the attacker's footprint and evading signature-based detection.
Ethical Hacking System Hacking 1
What is the primary goal of privilege escalation in system hacking?