Question 1

Which of the following are valid ways to disable the storage of LM hashes on a Windows host? (Choose all that apply)
A) Use group policy
B) Editing the registry
C) Use a password that is at least 15 characters long
D) LM hashes cannot be disabled because of legacy support

Accepted Answer

All of these are valid ways to disable LM hash support, but legacy systems must be considered before doing so.

Question 2

Curtis is looking over a SAM file he captured using PWDump3v2. He is looking at the LM hashes for a password he might be able to crack rather quickly. Which of the following users has a password that is less than 7 characters?
A) E390B1995922152FAAD3B435B51404EE
B) 4097A469B4C52C1D1D71060D896B7A46
C) FB4138BA5EB0FA6AF56EE607BD78827B
D) E52CAC67419A9A224A3B108F3FA6CB6D

Accepted Answer

Look for the "404EE" (you don't have to memorize the whole thing) on the end of the hash. It is easy to remember and always happens when the second half of the LM hash is only NULL characters.

Question 3

Which of the following is the static string that is encrypted with the DES key in LM?
A) M!cr0s0ft
B) Lm@uth
C) LmH@sH
D) KGS!@$%

Accepted Answer

This is part of the reason that a set of seven NULL characters will always result in the same ciphertext.

Question 4

An attacker writes a script similar to the one given. What is he trying to accomplish?
FOR /F "token=1, 2*" %i in passlist.txt do net use \target\IPC$ %i /u: %j
A) Send a virus disguised as "passlist.txt" to the target
B) Password guessing from a list
C) Backdoor the target host with an undocumented feature of Windows
D) Access the IPC$ share with a strong authentication token

Accepted Answer

The file "passlist.txt" referred to in the script contains a list of usernames and passwords in two columns.
Each row in the list will be inserted into the net use command and applied to the target machine.

Question 5

What is the feature supported by all NTFS volumes that allows forked data to be associated with a file in a way that will not affect the size of the original data?
A) Alternate Data Streams
B) Steganography
C) Cryptography
D) FAT32 hidden streams (for legacy support)

Accepted Answer

ADS allow data to be placed into a file attribute named "$DATA. It is a feature of NTFS that supports the applications originally written for the HPFS (High Performance File System)

Question 6

There is a windows tweak that allows the storage of different login credentials using the "Stored Usernames and Passwords" applet. Which command will allow access to this tool?
A) runas passmgr.exe
B) net use \server\ShowKMgr
C) rundll32.exe keymgr.dll, KRShowKeyMgr
D) runas winpassmgr.bat

Accepted Answer

The rundll32.exe application allows access to functions within .dll files. Dynamic Link Library files are shared by many applications but are not directly executable. In this command, we are calling KYShowKeyMgr within the keymgr.dll by using rundll32.exe

Question 7

Bill seems to be connected to every marketing project that has had information leaked to the same competitor. Someone notices on a myspace page some photographs of Bill socializing with some executives of that competitor. Bill is sent on vacation for a week, and a supervisor access Bill's email and notices repeated emails with silly documents attached like jokes, random lists, or cooking recipe's.
He asks you if this seems suspicious and wonders if these are coded messages. You tell him it is even easier than that, and suspect which of the following techniques?
A) ADS Streams are being used to smuggle documents using a USB key
B) Steganography is being used to tunnel the secrets through the VPN
C) this host was compromised by foreign hackers and Bill is the real victim
D) snow.exe could be used to hide data inside the attached documents

Accepted Answer

Data can be hidden in many different file types including photographs, tunnels, and streams. The only statement that is correct and relevant to the question mentions snow.exe, which is a tool for hiding data in text files. On the CEH exam, even if you have not heard the name of a tool that gets mentioned, it is usually still possible to reason out the best answer from the other information given.

Question 8

Your father just purchased a new computer and brings it to you for a lookover. He wants to make sure he can safely use the internet and a few other applications. You show him the necessary steps to preparing a Windows computer fresh out of the box. What did you teach your father to do (Choose 3)?
A) Make sure the antivirus scanners are updating
B) Make sure all applications have security patches updated
C) Download a free anti-toolbar blocker application from secure-updatez.ws
D) Make sure his explorer settings are set to the maximum security levels for all websites.
E) Enable Windows Update and the personal firewall

Accepted Answer

Unfortunately, setting his Browser settings to their strongest setting will result him calling several times a day complaining that "the internet doesn't work".

Question 9

Blair receives permission to audit the passwords on a critical server. The server is joined to a domain and is therefore "Kerberized" but Blair decides to try the simplest approach first anyway. He uses pwdump to successfully obtain the hashes and john the ripper to crack them. Blair's supervisor is stunned. He says "I made sure every password was at least 10 characters long"
Why did the audit fail?
A) Blair used a terabyte sized dictionary file he downloaded from the Internet
B) The effective length of the passwords was only 7 characters.
C) Blair used "AllCrack2008" the most powerful cracking tool available
D) Blair used a hacked version of John the Ripper that is "forensic" strength.

Accepted Answer

Even when hosts are joined to a domain, it must be verified that LM hashes are not being stored.

Question 10

KC comes into work about 30 minutes early to start a ARP poisoned attack to sniff traffic between the workstation of a fellow coworker, Greg, and the domain controller. His boss compliments him for being so early and likes his work ethic.
KC waits until Greg comes to work logs in to the domain. He sniffs the passwords and spends the rest of the afternoon cracking it. What tool can be used to perform this entire sequence?
A) Rainbowcrack
B) L0phtcrack
C) Kerbcrack version 6
D) Cain and Abel

Accepted Answer

This attack is possible if the Kerb-PreAuth key is captured. This one time a credential is exposed on a Windows network login attempt. The ARP poisoning was to defeat a switch and allow sniffing. Intrusion detection systems could have detected this part of the attack before it was successful.

Question 11

April is noticing in her network monitoring software that an unusual amount of UDP traffic is being sent to ports 1026 and 1027 toward various hosts. He sets up a honeypot by opening a port and listening in case any of this traffic heads in his direction.
A few minutes later he sees text appear on the command console that reads and recognizes this as messenger spam. "Windows has discovered 31 critical errors. The following steps must be taken immediately: [the rest goes on to recommend a download and other destructive suggestions]"
What did April do to receive and view this message?
A) Used Netcat with the command: nc -l -p 1026 -u -v
B) Used Netcat with the command: nc -l -p 31 -u -v
C) Used Windump with the command: windump -l -p 1026 -u -v
D) Sent a message back to the source asking for clarification

Accepted Answer

Netcat is the "Swiss army knife" of tools and in this case was used to open a "listener" (-l) of the correct port, expecting udp traffic(-u) and displaying the data received in the console window (-v).

Question 12

As a technique, rootkits hide processes and the resources that start them. What is the primary objective of a rootkit?
A) Hide process that open access points (backdoors)
B) Replace important system files with corrupted versions
C) Prevent diagnostic tools from operating correctly
D) Privilege escalation

Accepted Answer

Rootkits are part of the maintaining access step of an attack. Once the host has been compromised the rootkit is installed. It opens ports for access, and some can initiate connections to remote hosts.

Question 13

Marco wants to encode data into a music file. Since it is text, he isn't sure this can be done. After searching the internet he comes across a promising tool.
What tool did he find?
A) Mp3stego
B) Snow
C) Camera Shy
D) S-Tools

Accepted Answer

The other tools are also steganography tools, but use different media.

Question 14

Ernest finds a laptop that seems to have an encrypted drive. He knows the owner of the laptop works for a company that requires 15 character strong passwords. With a good quality password cracker how long will it take Ernest to brute force this password?
A) 5 minutes
B) 30 seconds
C) 12 Million years
D) 2 days

Accepted Answer

It is impossible to know exactly how long something like this will take. Look for extremes. Strong and long passwords take a long time, while short, weak or dictionary words take the shortest time.

Question 15

In order to speed up the process of breaking a password that is pretty strong, Barney decides to use DNA.
What is the best description of this technique?
A) Decremented Notation Algorithm is a super efficient way to break passwords. The more random the password the better the technique works.
B) Distributed Nonce Algorithm increases the analysis of seed values to 1000 times normal rates. This allows more key space to be covered in a short time.
C) Distributed Network Architecture allows multiple computers to calculate possible hash values in parallel.
D) Distinct Nuance Alternatives can get "close enough" hash collisions in a hort amount of time using minimal processing power.

Accepted Answer

Internet wide distributed computing efforts exist for a variety of complex projects. It is also possible to do this on a private network.

Question 16

From the following log entries, what are the affected user accounts?
Mkdir - p /etc/x11/applnk/internet/.etc
Touch -macr /etc/x11/applnk/internet/.etc
Mkdir - p /etc/x11/applnk/internet/.etcpasswd
Touch -macr /etc/x11/applnk/internet/.etcpasswd
Adduser dns -d /bin -s /bin/bash -u 0 -g 0
Passwd nobody -d
Passwd dns -d
A) dns, nobody
B) nobody, macr
C) dns, IUSR_
D) mkdir, touch

Accepted Answer

The nobody account is commonly used for anomymous access such visitors to the web service. The account "dns" is a ruse, that is more commonly known as "named" (as in Naming Daemon), it is given root privileges and the attacker is hoping this account would simple remain unnoticed.

Question 17

A common technique when compromising Linux hosts is to make sure that if it is used as a sniffer, the command __________ is replaced with a modified version that will not show the ________ flag in its
Output. (fill in the blanks)
A) ipconfig, PRMISC
B) ifconfig, SNIFFER=1
C) ipconfig, PROMISC=On
D) ifconfig, PROMISC

Accepted Answer

The ifconfig command shows the present configuration of the NIC. If it is running the LibPcap drivers for sniffing mode, the attacker would not want this to be detectable.

Question 18

Where are password hashes stored on a Linux system?
A) /etc/credentials
B) /etc/passwd
C) /etc/shadow
D) /etc/sam

Accepted Answer

Hashes were originally stored in the /etc/passwd file which was readable to the world and vulnerable to password cracking attacks. These hashes were moved to the /etc/shadow file that can only be read with root privileges

Question 19

Darren wants to run a stealth nmap scan that will require root privileges. Observing best practices, he does not want to be logged in as root. What is the best way to run the command?
A) root nmap -sS
B) runas nmap -sS
C) sudo nmap -sS
D) start nmap -sS

Accepted Answer

The sudo (Switch User and Do) command is used in Linux to elevate the privilege of a single command. The "runas" command can be used in Windows

Question 20

Doug was just told about a set of tools known as the "dsniff' suite that runs nicely under Backtrack Linux. Which tool can he use to capture a file transfer that took place over NFS?
A) filesnarf
B) urlsnarf
C) mailsnarf
D) nsfsnarf

Accepted Answer

NFS (Network File System) can be used in the Linux world to share directories and files across the network. Default implementations do not provide for encryption, so the files can be sniffed on the network.

Quiz 4: Operating Systems and Applications

Which of the following are valid ways to disable the storage of LM hashes on a Windows host? (Choose all that apply)

Curtis is looking over a SAM file he captured using PWDump3v2. He is looking at the LM hashes for a password he might be able to crack rather quickly. Which of the following users has a password that is less than 7 characters?

Which of the following is the static string that is encrypted with the DES key in LM?

An attacker writes a script similar to the one given. What is he trying to accomplish? FOR /F "token=1, 2*" %i in passlist.txt do net use \\target\IPC$ %i /u: %j

What is the feature supported by all NTFS volumes that allows forked data to be associated with a file in a way that will not affect the size of the original data?

There is a windows tweak that allows the storage of different login credentials using the "Stored Usernames and Passwords" applet. Which command will allow access to this tool?

Your father just purchased a new computer and brings it to you for a lookover. He wants to make sure he can safely use the internet and a few other applications. You show him the necessary steps to preparing a Windows computer fresh out of the box. What did you teach your father to do (Choose 3) ?

As a technique, rootkits hide processes and the resources that start them. What is the primary objective of a rootkit?

Marco wants to encode data into a music file. Since it is text, he isn't sure this can be done. After searching the internet he comes across a promising tool. What tool did he find?

Ernest finds a laptop that seems to have an encrypted drive. He knows the owner of the laptop works for a company that requires 15 character strong passwords. With a good quality password cracker how long will it take Ernest to brute force this password?

In order to speed up the process of breaking a password that is pretty strong, Barney decides to use DNA. What is the best description of this technique?

A common technique when compromising Linux hosts is to make sure that if it is used as a sniffer, the command __ is replaced with a modified version that will not show the flag in its Output. (fill in the blanks)

Where are password hashes stored on a Linux system?

Darren wants to run a stealth nmap scan that will require root privileges. Observing best practices, he does not want to be logged in as root. What is the best way to run the command?

Doug was just told about a set of tools known as the "dsniff' suite that runs nicely under Backtrack Linux. Which tool can he use to capture a file transfer that took place over NFS?