Certified Ethical Hacker Cert Guide: Enumeration and System Hacking

This chapter introduces Windows enumeration and system hacking. It gives you the knowledge you need to prepare for the Certified Ethical Hacker exam, and it broadens your knowledge of Windows security controls and weaknesses. However, this chapter addresses only the basic information, as it would require an entire book to cover all Windows hacking issues. If you are seriously considering a career as a penetration tester, this chapter should whet your appetite for greater knowledge.

The chapter begins by introducing enumeration and discusses what kind of information can potentially be uncovered. Enumeration is the final pre-attack phase in which you probe for usernames, system roles, account details, open shares, and weak passwords. This chapter also reviews some basics of Windows architecture. A review of Windows users and groups is discussed. The last topic is system hacking. This section discusses the tools and techniques used for gaining access to computer systems. Although many of the tools introduced are specific to Windows systems, the steps are the same no matter what the platform, as evident in Chapter 5, “Linux and Automated Assessment Tools,” when Linux is discussed.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz enables you to assess whether you should read this entire chapter thoroughly or jump to the “Exam Preparation Tasks” section. If you are in doubt about your answers to these questions or your own assessment of your knowledge of the topics, read the entire chapter. Table 4-1 lists the major headings in this chapter and their corresponding “Do I Know This Already?” quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Review Questions.”

Table 4-1 “Do I Know This Already?” Section-to-Question Mapping

1. Which of the following is considered a nontechnical attack?

   1. Password sniffing
   2. Dumpster diving
   3. Password injection
   4. Software keylogger

2. A RID of 500 is associated with what account?

   1. A user account
   2. The first users account
   3. The guest account
   4. The administrator account

3. During enumeration what ports may specifically indicate SMB on a Windows computer?

   1. 110
   2. 111
   3. 389
   4. 445

4. During enumeration what ports may specifically indicate portmapper on a Linux computer?

   1. 110
   2. 111
   3. 389
   4. 445

5. Which of the following is a tool commonly used for enumeration?

   1. GetAcct
   2. John
   3. LCP
   4. IAM tool kit

6. Which type of password cracking makes use of the space/time memory trade-off?

   1. Dictionary attack
   2. Rainbow table
   3. Rule
   4. Hybrid

7. The second layer of security on the SAM file is known as what?

   1. Encoding
   2. Obscuring
   3. SYSKEY
   4. Salting

8. Windows passwords that are stored in seven-character fields are known as what?

   1. NTLMv2
   2. Kerberos
   3. Salted
   4. LAN Manager

9. Which of the following matches the common padding found on the end of short Windows passwords?

   1. 1404EE
   2. EE4403
   3. EEEEEE
   4. 1902DD

10. If you were going to enumerate DNS, which of the following tools could be used?

    1. Route print
    2. ARP -A
    3. Nslookup
    4. IPconfig