Module 06 - System Hacking ( EC Mode Part 01 ) Flashcards
Which of the following tools helps an ethical hacker detect buffer overflow vulnerabilities in an application?
A. Medusa
B. OllyDbg
C. Hashcat
D. THC-Hydra
Answer: B. OllyDbg
Explanation:
THC-Hydra: THC-Hydra is a network logon cracker that supports many different services, such as IPv6 and Internationalized RFC 4013. It comes with a GUI and supports HTTP proxy and SOCKS proxy.
Medusa: Medusa is password-cracking tool.
Hashcat: Hashcat is a cracker compatible with multiple OSs and platforms and can perform multihash (MD4, 5; SHA – 224, 256, 384, 512; RIPEMD-160; etc.), multi-device password cracking.
OllyDbg: It is a buffer overflow detection tool and is a 32-bit assembler-level analyzing debugger for Microsoft® Windows®. Its emphasis on binary code analysis makes it particularly useful when the source is unavailable.
Which of the following techniques acts as a defensive measure against buffer overflow attacks?
A. Not allowing the compiler to add bounds to all buffers
B. Allowing the execution of code outside the code space
C. Implementing automatic bounds checking
D. Avoiding code review at the source code level
Answer: C. Implementing automatic bounds checking
Explanation:
The following countermeasures can be adopted to defend against buffer overflow attacks
Develop programs by following secure coding practices and guidelines
Use address space layout randomization (ASLR) technique
Validate arguments and minimize code that requires root privileges
Perform code review at the source code level by using static and dynamic code analyzers
Allow the compiler to add bounds to all buffers
Implement automatic bounds checking
Always protect the return pointer on the stack
Never allow execution of code outside the code space
Regularly patch the applications and operating systems
Perform code inspection manually with a checklist to ensure that the code meets certain criteria
Employ Data Execution Prevention (DEP) to mark memory regions as non-executable
Implement code pointer integrity checking to detect whether a code pointer has been corrupted before it is dereferenced
Given below are the different steps involved in password guessing.
1-Create a list of possible passwords.
2-Rank passwords from high to low probability.
3-Find a valid user.
4-Key in each password until the correct password is discovered.
What is the correct sequence of steps involved in password guessing?
A. 3 -> 1 -> 2 -> 4
B. 4 -> 2 -> 3 -> 1
C. 2 -> 3 -> 1 -> 4
D. 1 -> 2 -> 3 -> 4
Answer: A. 3 -> 1 -> 2 -> 4
Given below are the different steps involved in exploiting vulnerabilities.
1-Develop the exploit.
2-Determine the risk associated with the vulnerability.
3-Determine the capability of the vulnerability.
4-Identify the vulnerability.
5-Gain remote access.
6-Select the method for delivering: local or remote.
7-Generate and deliver the payload.
What is the correct sequence of steps involved in exploiting vulnerabilities?
A. 2 -> 3 -> 6 -> 4 -> 5 -> 1 -> 7
B. 4 -> 2 -> 3 -> 1 -> 6 -> 7 -> 5
C. 3 -> 6 -> 7 -> 4 -> 2 -> 1 -> 5
D. 1 -> 2 -> 3 -> 4 -> 5 -> 6 -> 7
Answer: B. 4 -> 2 -> 3 -> 1 -> 6 -> 7 -> 5
Explanation:
Steps involved in exploiting vulnerabilities:
Identify the vulnerability
Determine the risk associated with the vulnerability
Determine the capability of the vulnerability
Develop the exploit
Select the method for delivering – local or remote
Generate and deliver the payload
Gain remote access
Which of the following types of stack memory register stores the address of the next instruction to be executed?
A. ESP
B. ESI
C. EIP
D. EDI
Answer: C. EIP
Explanation:
Stack memory includes five types of registers:
EBP: Extended Base Pointer (EBP), also known as StackBase, stores the address of the first data element stored onto the stack
ESP: Extended Stack Pointer (ESP) stores the address of the next data element to be stored onto the stack
EIP: Extended Instruction Pointer (EIP) stores the address of the next instruction to be executed
ESI: Extended Source Index (ESI) maintains the source index for various string operations
EDI: Extended Destination Index (EDI) maintains the destination index for various string operations
Ben is a disgruntled ex-employee of an organization and has knowledge of computers and hacking. He decided to hack the organization and disrupt its operations. In this process, he cracked the passwords of remote systems by recovering cleartext passwords from a password hash dump.
Which of the following types of password attacks did Ben perform on the target organization?
A. Offline attack
B. Active online attack
C. Passive online attack
D. Non-electronic attack
Answer: A. Offline attack
Explanation:
Non-Electronic Attacks: This is, for most cases, the attacker’s first attempt at gaining target system passwords. Non-electronic or non-technical attacks do not require any technical knowledge about hacking or system exploitation. Techniques used to perform non-electronic attacks include shoulder surfing, social engineering, dumpster diving, etc.
Passive Online Attacks: A passive attack is a type of system attack that does not lead to any changes in the system. In this attack, the attacker does not have to communicate with the system, but passively monitor or record the data passing over the communication channel, to and from the system.
Offline Attacks: Offline attacks refer to password attacks in which an attacker tries to recover cleartext passwords from a password hash dump. Offline attacks are often time-consuming but have a high success rate, as the password hashes can be reversed owing to their small keyspace and short length. Attackers use pre-computed hashes from rainbow tables to perform offline and distributed network attacks.
Active Online Attacks: This is one of the easiest ways to gain unauthorized administrator-level system access. Here, the attacker communicates with the target machine to gain password access. Techniques used to perform active online attacks include password guessing, dictionary and brute-forcing attacks, hash injection, LLMNR/NBT-NS poisoning, use of Trojans/spyware/keyloggers, internal monologue attacks, Markov-chain attacks, Kerberos password cracking, etc.
Gary, a professional hacker, is attempting to access an organization’s systems remotely. In this process, he used a tool to recover the passwords of the target system and gain unauthorized access to critical files and other system software.
Which of the following tools did Gary use to crack the passwords of the target system?
A. BeRoot
B. Hashcat
C. Dependency Walker
D. OllyDbg
Answer: B. Hashcat
Explanation:
OllyDbg: OllyDbg is a 32-bit assembler-level analyzing debugger for Microsoft® Windows®. Its emphasis on binary code analysis makes it particularly useful when the source is unavailable. It debugs multithread applications and attaches to running programs. It recognizes complex code constructs, such as a call to jump to the procedure
BeRoot: BeRoot is a post-exploitation tool to check common misconfigurations to find a way to escalate privilege
Dependency Walker: Dependency Walker is useful for troubleshooting system errors related to loading and executing modules. It detects many common application problems, such as missing modules, invalid modules, import/export mismatches, circular dependency errors, etc.
Hashcat: Hashcat is a cracker compatible with multiple OSs and platforms and can perform multi-hash (MD4, 5; SHA – 224, 256, 384, 512; RIPEMD-160; etc.), multi-device password cracking.
Tim, a network administrator in an organization, received several complaints about unusual behavior in the network. He implemented a spoofing detection toolkit in the network to quickly detect and isolate attackers on the network.
Which of the following tools did Tim use to detect the attacks on the network?
A. Sherlock
B. OpenStego
C. CCleaner
D. Vindicate
Answer: D. Vindicate
Explanation:
CCleaner: CCleaner is a system optimization, privacy, and cleaning tool. It allows attackers to remove unused files and cleans traces of Internet browsing details from the target PC. With this tool, an attacker can very easily erase his/her tracks.
OpenStego: OpenStego is a steganography application that provides the following functions.
Data Hiding: It can hide any data within a cover file (e.g., images)
Watermarking: Watermarking files (e.g., images) with an invisible signature. It can be used to detect unauthorized file copying.
Vindicate: Vindicate is an LLMNR/NBNS/mDNS spoofing detection toolkit for network administrators. Security professionals use this tool to detect name service spoofing. This tool helps them to quickly detect and isolate attackers on their network. It is designed to detect the use of hacking tools such as Responder, Inveigh, NBNSpoof, and Metasploit’s LLMNR, NBNS, and mDNS spoofers while avoiding false positives
Sherlock: Attackers use Sherlock to search a vast number of social networking sites for a target username. This tool helps the attacker to locate the target user on various social networking sites along with the complete URL.
How can rainbow tables be defeated?
A. Use of nondictionary words
B. Password salting
C. Lockout accounts under brute force password cracking attempts
D. All uppercase character passwords
Answer: B. Password salting
Explanation:
Password salting is a technique where random strings of characters are added to the password before calculating their hashes. This makes it more difficult to reverse the hashes and defeats precomputed hash attacks.
Rainbow tables can be created for all nondictionary words and uppercase characters. Locking out accounts is not a right answer as the rainbow attacks are passive attacks and not performed on live systems.
A computer science student needs to fill some information into a password protected Adobe PDF job application that was received from a prospective employer. Instead of requesting the password, the student decides to write a script that pulls passwords from a list of commonly used passwords to try against the secured PDF until the correct password is found or the list is exhausted. Identify the type of password attack.
A. Man-in-the-middle attack
B. Dictionary attack
C. Brute-force attack
D. Session hijacking
Answer: B. Dictionary attack.
Explanation:
Man-in-the-Middle Attack: When two parties are communicating, a man-in-middle attack can take place, in which a third party intercepts a communication between the two parties without their knowledge. Meanwhile, the third party eavesdrops on the traffic, and then passes it along. To do so, the “man in the middle” has to sniff from both sides of the connection simultaneously. In a MITM attack, the attacker acquires access to the communication channels between victim and server to extract the information.
Brute Force Attack: In the brute force method, all possible characters are tested, for example, uppercase from A to Z, numbers from 0 to 9, and lowercase from a to z. This method is useful to identify one-word or two-word passwords. If a password consists of uppercase and lowercase letters and special characters, it might take months or years to crack the password using a brute force attack.
Dictionary Attack: A dictionary attack has predefined file that contains a list of words of various combinations, and an automated program tries entering these words one at a time to see if any of them are the password. This might not be effective if the password includes special characters and symbols. If the password is a simple word, then it can be found quickly.
Session Hijacking: Session hijacking refers to an attack where an attacker takes over a valid TCP communication session between two computers. Since most authentication only occurs at the start of a TCP session, it allows the attacker to gain access to a machine. Attackers can sniff all the traffic from the established TCP sessions and perform identity theft, information theft, fraud, etc.
You have retrieved the raw hash values from a Windows 2000 Domain Controller. Using social engineering, you know that they are enforcing strong passwords. You understand that all users are required to use passwords that are at least eight characters in length. All passwords must also use three of the four following categories: lower-case letters, capital letters, numbers, and special characters. With your given knowledge of users, likely user account names, and the possibility that they will choose the easiest passwords possible, what would be the fastest type of password cracking attack you can run against these hash values to get results?
A. Dictionary attack
B. Replay attack
C. Brute-Force attack
D. Hybrid attack
Answer: D. Hybrid attack
Explanation:
Replay Attack: In a replay attack, packets and authentication tokens are captured using a sniffer. After the relevant info is extracted, the tokens are placed back on the network to gain access. The attacker uses this type of attack to replay bank transactions or other similar types of data transfer, in the hope of replicating and/or altering activities, such as banking deposits or transfers.
Dictionary Attack: In a dictionary attack, a dictionary file is loaded into the cracking application that runs against user accounts. This dictionary is the text file that contains a number of dictionary words that are commonly used as passwords. The program uses every word present in the dictionary to find the password. Apart from a standard dictionary, attackers’ dictionaries have added entries with numbers and symbols added to words (e.g., “3December!962”). Simple keyboard finger rolls (“qwer0987”), which many believe to produce random and secure passwords, are thus included in an attacker’s dictionary.
Brute-Force Attack: In a brute force attack, attackers try every combination of characters until the password is broken. Cryptographic algorithms must be sufficiently hardened to prevent a brute-force attack, which is defined by the RSA: “Exhaustive key-search, or brute-force search, is the basic technique for trying every possible key in turn until the correct key is identified.”
Hybrid Attack: A hybrid attack is more powerful as it uses both a dictionary attack and brute force attack. It also uses symbols and numbers. Password cracking becomes easier with this method. Often, people change their passwords merely by adding some numbers to their old passwords. In this case, the program would add some numbers and symbols to the words from the dictionary to try and crack the password. For example, if the old password is “system,” then there is a chance that the person will change it to “system1” or “system2.”
Henry, a professional hacker, was hired by an organization to crack the password of a target server. For this purpose, Henry employed a Python-based tool that helped him in cracking the passwords of the target server and establishing unauthorized access to the target network.
Identify the tool employed by Henry in the above scenario.
A.StegoStick
B.Scranos
C.DPAT
D.Spytech SpyAgent
Answer: C.DPAT
Explanation:
DPAT: DPAT is a Python script that generates password use statistics from password hashes dumped from a domain controller (DC) and a password crack file such as hashcat.pot generated using the hashcat tool during password cracking.
Spytech SpyAgent: Spytech SpyAgent is computer spy software that allows you to monitor everything users do on your computer—in total secrecy.
Scranos: Scranos is a trojanized rootkit that masquerades as cracked software or a legitimate application, such as anti-malware, a video player, or an ebook reader, to infect systems and perform data exfiltration that damages the reputation of the target and steals intellectual property.
StegoStick: StegoStick is a steganographic tool that allows attackers to hide any file in any other file.
Which of the following is a password cracking tool that allows attackers to reset the passwords of the Windows local administrator, domain administrator, and other user accounts?
A. OmniHide Pro
B. Secure Shell Bruteforcer
C. Audio Spyware
D. DeepSound
Answer: B. Secure Shell Bruteforcer.
Explanation:
Secure Shell Bruteforcer: It is a password cracking tool that allows you to reset unknown or lost Windows local administrator, domain administrator, and other user account passwords. In the case of forgotten passwords, it even allows users instant access to their locked computer without reinstalling Windows.
Audio Spyware: Audio spyware is a sound surveillance program designed to record sound onto a computer. The attacker can silently install the spyware on the computer, without the permission of the computer user and without sending them any notification.
OmniHide Pro: OmniHide PRO allows you to hide any secret file within an innocuous image, video, music file, etc.
DeepSound: DeepSound allows you to hide any secret data in audio files (WAV and FLAC). It also allows you to extract secret files directly from audio CD tracks. In addition, it can encrypt secret files, thereby enhancing security.
Given below are the various steps involved in an exploit chaining attack.
1-Gather exploits one after another.
2-Gain access to root-level services.
3-Combine all the exploits to compromise the system.
4-Initiate reconnaissance.
Identify the correct sequence of steps involved in performing exploit chaining attacks.
Quiz: Identify the correct sequence of steps involved in performing exploit chaining attacks.
A. 2 -> 3 -> 4 -> 1
B. 1 -> 3 -> 4 -> 2
C. 4 -> 3 -> 2 -> 1
D. 4 -> 1 -> 3 -> 2
Answer: D. 4 -> 1 -> 3 -> 2
Which of the following tools allows attackers to collect host information including PowerShell security settings, Kerberos tickets, and items in Recycle Bin?
A. Dylib Hijack Scanner
B. Veracode
C. Robber
D. GhostPack Seatbelt
Answer: D. GhostPack Seatbelt.
Explanation:
Veracode: It is a buffer overflow detection tool that helps security professionals to detect buffer overflow vulnerabilities.
GhostPack Seatbelt: Attackers use Seatbelt to collect host information including PowerShell security settings, Kerberos tickets, and items in Recycle Bin. Using Seatbelt, attackers perform security checks to find insecurities, which can be exploited to launch active attacks on the host network.
Robber: Robber is an open-source tool that helps attackers to find executables prone to DLL hijacking.
Dylib Hijack Scanner: Dylib Hijack Scanner (DHS) is a simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked.
Aster, a professional hacker, was tasked with identifying insecurities in an organizational network. For this purpose, Aster employed a toolset to perform security checks and find insecurities, which can be exploited to launch active attacks.
Which of the following tools did Aster employ in the above scenario?
A. X-Ray
B. xHelper
C. FaceNiff
D. GhostPack Seatbelt
Answer: D. GhostPack Seatbelt
Which of the following practices makes an organization’s network vulnerable to password cracking attacks?
A. Enable account lockout with a certain number of attempts, counter time, and lockout duration.
B. Never perform continuous user behavior analysis and blind-spot analysis.
C. Ensure that password database files are encrypted and accessible only by system administrators.
D. Perform a periodic audit of passwords in the organization.
Answer: B. Never perform continuous user behavior analysis and blind-spot analysis.
Explanation:
The best practices to protect against password cracking are as follows:
Perform a periodic audit of passwords in the organization.
Ensure that password database files are encrypted and accessible only by system administrators.
Enable account lockout with a certain number of attempts, counter time, and lockout duration
Perform continuous user behavior analysis and blind-spot analysis.
Employ geo-lock accounts to restrict users from logging in from different locations or IP addresses.
Which of the following practices helps security experts defend an organizational network against various password cracking attempts?
A. Employ geo-lock accounts to restrict users from logging in from different locations.
B. Always use the same password during a password change.
C. Disable information security auditing.
D. Use passwords that can be found in a dictionary.
Answer: A. Employ geo-lock accounts to restrict users from logging in from different locations.
Explanation:
The best practices to protect against password cracking are as follows:
Employ geo-lock accounts to restrict users from logging in from different locations or IP addresses.
Enable information security auditing to monitor and track password attacks.
Do not use the same password during a password change.
Restrict the use of similar passwords and patterns for multiple accounts.
Do not share passwords.
Do not use passwords that can be found in a dictionary.
Which of the following practices can be adopted by security experts to defend against buffer overflow attacks within an organization?
A. Never use the NX bit to mark certain areas of memory as executable and nonexecutable.
B. Employ the latest OSes that offer high protection.
C. Do not use stack canaries, a random value, or a string of characters.
D. Disallow the compiler to add bounds to all the buffers.
Answer: B. Employ the latest OSes that offer high protection.
Explanation:
The following countermeasures can be adopted to defend against buffer overflow attacks:
Implement Structured Exception Handler Overwrite Protection (SEHOP) to deter attackers from overwriting the exception registration record using the SEH overwrite exploitation technique.
Employ the latest OSes that offer more protection.
Use programming languages such as Python, COBOL, or Java instead of C.
Ensure the function does not perform a write operation when it reaches the end after determining the buffer’s size.
Audit the libraries and frameworks used to develop source code to ensure that they are not vulnerable.
Use stack canaries, a random value or string of characters, which makes it difficult for attackers to overwrite.
Use the NX bit to mark certain areas of memory as executable and nonexecutable.
Allow the compiler to add bounds to all the buffers.
Which of the following practices makes an organization’s network vulnerable to buffer overflow attacks?
A. Audit the libraries and frameworks used to develop source code to ensure that they are not vulnerable.
B. Implement Structured Exception Handler Overwrite Protection (SEHOP).
C. Use C programming language instead of Python, COBOL, or Java.
D. Ensure that the function does not perform a write operation when it reaches the end after determining the buffer’s size.
Answer: C. Use C programming language instead of Python, COBOL, or Java.
Explanation:
The following countermeasures can be adopted to defend against buffer overflow attacks:
Implement Structured Exception Handler Overwrite Protection (SEHOP) to deter attackers from overwriting the exception registration record using the SEH overwrite exploitation technique.
Employ the latest OSes that offer more protection.
Use programming languages such as Python, COBOL, or Java instead of C.
Ensure the function does not perform a write operation when it reaches the end after determining the buffer’s size.
Audit the libraries and frameworks used to develop source code to ensure that they are not vulnerable.
Use stack canaries, a random value or string of characters, which makes it difficult for attackers to overwrite.
Which of the following malware masks itself as a benign application or software that initially appears to perform a desirable or benign function but steals information from a system?
A. Keylogger
B. Worm
C. Virus
D. Trojan
Answer: D. Trojan.
Explanation:
Keylogger: It is a program that records all user keystrokes without the user’s knowledge
Virus: Often an executable program that required an already infected system or OS
Trojan: Deceptive malware program that appears to be legitimate software. A Trojan is a program that masks itself as a benign application. The software initially appears to perform a desirable or benign function but instead steals information or harms the system.
Worm: It is a malware type that sends copies of itself from one system to another.
Which of the following types of password attacks does not lead to any changes in the system and includes techniques such as wire sniffing, man-in-the-middle attacks, and replay attacks?
A. Active online attacks
B. Non-electronic attacks
C. Passive online attacks
D. Offline attacks
Answer: C. Passive online attacks.
Explanation:
Non-Electronic Attacks: This is, for most cases, the attacker’s first attempt at gaining target system passwords. Non-electronic or non-technical attacks do not require any technical knowledge about hacking or system exploitation. Techniques used to perform non-electronic attacks include shoulder surfing, social engineering, dumpster diving, etc.
Active Online Attacks: This is one of the easiest ways to gain unauthorized administrator-level system access. Here, the attacker communicates with the target machine to gain password access. Techniques used to perform active online attacks include password guessing, dictionary and brute-forcing attacks, hash injection, LLMNR/NBT-NS poisoning, use of Trojans/spyware/keyloggers, etc.
Passive Online Attacks: A passive attack is a type of system attack that does not lead to any changes in the system. In this attack, the attacker does not have to communicate with the system, but passively monitor or record the data passing over the communication channel, to and from the system. The data are then used to break into the system. Techniques used to perform passive online attacks include wire sniffing, man-in-the-middle attacks, replay attacks, etc.
Offline Attacks: Offline attacks refer to password attacks in which an attacker tries to recover cleartext passwords from a password hash dump. Offline attacks are often time-consuming but have a high success rate, as the password hashes can be reversed owing to their small keyspace and a short length. Attackers use pre-computed hashes from rainbow tables to perform offline and distributed network attacks.
Greg, an attacker, was hired to perform an attack on an organization. In this process, he gathered all the information about the target’s network and systems. After acquiring the required information, he searched for vulnerabilities in a database that includes details of the latest vulnerabilities.
Which of the following databases did Greg use to search for vulnerabilities?
A. Factiva
B. MITRE CVE
C. Shodan
D. Whois
Answer: B. MITRE CVE.
Explanation:
Factiva: Factiva is a global news database and licensed content provider. It is a business information and research tool that gets information from licensed and free sources and provides capabilities such as searching, alerting, dissemination, and business information management
Shodan: Shodan is a computer search engine that searches the Internet for connected devices (routers, servers, and IoT.).
MITRE CVE: MITRE maintains a CVE database that contains details of the latest vulnerabilities. Attackers can search MITRE CVE to discover vulnerabilities that exist in the target system.
Whois: Whois is a query and response protocol used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system. This protocol listens to requests on port 43 (TCP). Regional Internet Registries (RIRs) maintain Whois databases, which contain the personal information of domain owners.
Jude, a security professional in an organization, decided to strengthen the security of the applications used by the organization. In this process, he used a buffer-overflow detection tool that recognizes buffer overflow vulnerabilities in the applications.
Which of the following tools helps Jude detect buffer overflow vulnerabilities?
A. Splint
B. Infoga
C. Maltego
D. Octoparse
Answer: A. Splint.
Explanation:
Octoparse: Octoparse offers automatic data extraction, as it quickly scrapes web data without coding and turns web pages into structured data. As shown in the screenshot, attackers use Octoparse to capture information from webpages, such as text, links, image URLs, or html code
Infoga: Infoga is a tool used for gathering email account information (IP, hostname, country, etc.) from different public sources (search engines, pgp key servers, and Shodan), and it checks if an email was leaked using the haveibeenpwned.com API
Splint: Splint can be used to detect the common security vulnerabilities including buffer overflows.
Maltego: Maltego is a program that can be used to determine the relationships and real-world links between people, groups of people, organizations, websites, Internet infrastructure, documents.
