Certified Ethical Hacker (CEH) System Hacking and Malware Threats Syllabus

System Hacking and Malware Threats syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for System Hacking and Malware Threats in Certified Ethical Hacker (CEH), not a summary of it.

1. 1

   Gaining Access and Privilege Escalation

   3 topics

   • Password Cracking
     • Dictionary, brute-force, and hybrid attacks
     • Rainbow tables and password salting
     • LLMNR/NBT-NS poisoning and Responder
   • Privilege Escalation
     • Vertical and horizontal escalation
     • DLL hijacking and unquoted service paths
     • Kernel exploits and misconfigurations
   • Active Directory Attacks
     • Kerberoasting and AS-REP roasting
     • Pass-the-hash and pass-the-ticket
2. 2

   Maintaining Access and Covering Tracks

   3 topics

   • Maintaining Access and Executing Applications
     • Backdoors, keyloggers, spyware
     • Remote code execution payloads
   • Hiding Files and Steganography
     • Rootkits and alternate data streams
     • Image and document steganography
   • Clearing Logs and Covering Tracks
     • Windows event log clearing
     • Linux history and log manipulation
3. 3

   Malware Threats

   5 topics

   • Malware Concepts and Distribution
     • Malware components and lifecycle
     • Exploit kits and distribution vectors
   • Trojans and Backdoors
     • Trojan types and command channels
     • Covert channels and wrappers
   • Viruses and Worms
     • Virus types and infection phases
     • Worm propagation
   • Fileless Malware and Advanced Threats
     • Living-off-the-land techniques (LOLBins)
     • APTs and ransomware
   • Malware Analysis and Countermeasures
     • Static vs dynamic analysis and sandboxing
     • Anti-malware controls

System Hacking and Malware Threats flashcards for Certified Ethical Hacker (CEH)

18 of 51 cards from the System Hacking and Malware Threats deck — real questions with worked answers.

1. In password cracking, what is a brute-force attack?

   An attack that systematically tries every possible combination of characters until the correct password is found. It is guaranteed to succeed eventually but is the slowest method, with time growing exponentially with password length and character set size.

2. How does a dictionary attack differ from a brute-force attack in password cracking?

   A dictionary attack tries passwords from a precompiled list of likely words/phrases, making it fast but limited to passwords in the list. A brute-force attack tries all possible character combinations, making it exhaustive but far slower.

3. What is a rainbow table attack, and what defense defeats it?

   It uses precomputed tables of password hashes to reverse a captured hash back to plaintext quickly. Adding a unique random salt to each password before hashing defeats rainbow tables, because precomputed tables become useless.

4. What is the difference between active online, passive online, and offline password attacks?

   Active online: directly guessing passwords against a live system (e.g., password guessing). Passive online: capturing credentials without interacting, via sniffing/MITM/replay. Offline: cracking a stolen hash file (dictionary, brute-force, rainbow) without touching the target.

5. What is password salting and why does it strengthen stored password hashes?

   Salting adds a unique random value to each password before hashing, so identical passwords produce different hashes. This prevents precomputed (rainbow) table attacks and makes each hash require separate cracking effort.

6. In Windows, what are LM and NTLM hashes, and which is weaker?

   LM (LAN Manager) and NTLM are Windows password hash formats. LM is far weaker: it uppercases the password, splits it into two 7-character halves hashed separately with no salt, making it trivial to crack. NTLM (MD4-based) is stronger but unsalted.

7. What is a pass-the-hash (PtH) attack?

   An attack where the attacker authenticates to a remote service using a captured NTLM password hash directly, without needing to crack it to plaintext, because NTLM authentication uses the hash itself as the credential.

8. What is privilege escalation, and what are its two types?

   Gaining higher access rights than originally granted. Vertical (privilege elevation): moving to a higher privilege level (e.g., user to admin/root). Horizontal: accessing another account at the same privilege level.

9. What is DLL hijacking as a privilege-escalation technique?

   An attacker places a malicious DLL where a privileged application loads it before the legitimate one (exploiting the DLL search order), causing the privileged process to execute attacker code.

10. What is privilege escalation via unquoted service paths on Windows?

    When a Windows service path contains spaces and is not enclosed in quotes, Windows may execute a malicious binary placed in an earlier part of the path (e.g., C:\Program.exe) with the service's (often SYSTEM) privileges.

11. How can DLL search order hijacking be mitigated?

    Use fully qualified (absolute) DLL paths, enable Safe DLL Search Mode, apply application allowlisting, and ensure application directories are not writable by unprivileged users.

12. What is Active Directory, and what protocol does it use for authentication?

    A Microsoft directory service that stores and manages domain objects (users, computers, groups) and enforces policy. It primarily uses Kerberos for authentication, with NTLM as a fallback, and LDAP for directory queries.

13. What is a Kerberoasting attack in Active Directory?

    An attacker requests Kerberos service tickets (TGS) for accounts with Service Principal Names (SPNs), then cracks the ticket offline because it is encrypted with the service account's password hash, recovering the plaintext service-account password.

14. What is a Golden Ticket attack in Active Directory?

    Using the KRBTGT account's hash to forge Kerberos Ticket-Granting Tickets (TGTs), letting an attacker impersonate any user with arbitrary privileges across the domain for persistent, near-undetectable access.

15. What is a Silver Ticket attack and how does it differ from a Golden Ticket?

    A Silver Ticket forges a Kerberos service ticket (TGS) using a specific service account's hash, granting access to that one service. A Golden Ticket forges a TGT using the KRBTGT hash, granting domain-wide access to any service.

16. What is DCSync in the context of Active Directory attacks?

    An attack where, abusing replication permissions, the attacker impersonates a domain controller and uses the directory replication protocol (DRSUAPI) to request password hashes (including KRBTGT) from a real DC without running code on it.

17. What does LDAP enumeration reveal to an attacker in an AD environment?

    It exposes directory information such as usernames, group memberships, computer accounts, organizational units, and SPNs, which attackers use for reconnaissance and to plan privilege escalation and lateral movement.

18. In the system hacking phase 'maintaining access', what is the attacker's goal?

    To retain persistent, ongoing control of a compromised system, often by installing backdoors, rootkits, or remote-access trojans so they can return later without re-exploiting the original vulnerability.

See more System Hacking and Malware Threats flashcards →

Planning System Hacking and Malware Threats for Certified Ethical Hacker (CEH)

System Hacking and Malware Threats (Certified Ethical Hacker (CEH)) FAQ