312-50 Question 94
Select 2▪ NTP and NFS EnumerationDuring an internal assessment, you identify a Linux server that appears to provide both NTP and NFS services. Your goal is to gather useful enumeration data with minimal interaction and without attempting exploitation. Which TWO actions would be the most appropriate to validate exposed NFS shares and obtain useful NTP information from the host?
- A
Use rpcinfo -p
and showmount -e to identify RPC programs and list exported NFS shares - B
Use ntpq -c rv
to query the remote server's runtime variables if query responses are permitted - C
Use snmpwalk -v2c -c public
1.3.6.1.2.1.25 to enumerate NFS exports and NTP peers - D
Use dig axfr @
to retrieve NFS export lists and NTP associations from DNS - E
Use nbtscan
to enumerate RPC mountd information and NTP monlist output
Show answer and explanation
Correct answers: A, B
Explanation
For CEH-level enumeration, the best approach is to use protocol-appropriate tools that gather service information without changing state. For NFS, common enumeration steps include querying rpcbind with rpcinfo and checking exports with showmount. These methods align with standard UNIX/Linux administration and NFS troubleshooting practices. For NTP, ntpq can obtain useful status information when remote control queries are enabled; however, results depend on the server's restrict rules or equivalent access controls. Historically, testers also checked NTP mode 6/7 responses, but modern hardened configurations often limit or disable such queries due to abuse concerns. From a defensive perspective, administrators should restrict NFS exports to specific hosts, apply root_squash where appropriate, and limit rpcbind/mountd exposure. For NTP, they should restrict query permissions and follow current NTP implementation guidance to minimize information leakage. Relevant references include the showmount and rpcinfo manual pages, NTP query tool documentation such as ntpq, and NFS/NTP hardening guidance from vendor documentation and project maintainers.
- A. Correct.
Correct. rpcinfo -p
is a standard way to enumerate RPC services registered with rpcbind/portmapper, including services related to NFS such as mountd and nfs. showmount -e queries the remote mount daemon for exported file systems when allowed. Together, these commands are practical, low-impact enumeration steps for identifying whether NFS is exposed and what shares are exported. - B. Correct.
Correct. ntpq can query an NTP server for status and runtime variables when the server permits mode 6 control queries. The command ntpq -c rv
can reveal useful information such as system status, stratum, reference ID, and synchronization state. This is a valid NTP enumeration technique, although responses depend on server configuration and access controls. - C. Incorrect.
Incorrect. snmpwalk is used to enumerate data exposed through SNMP, not to directly query NFS exports or NTP peer details unless the host is explicitly exposing that information via SNMP MIBs and community access is known. In this scenario, it is not the appropriate primary method to validate NFS shares or directly enumerate NTP service behavior.
- D. Incorrect.
Incorrect. A DNS zone transfer with dig axfr is related to DNS misconfiguration and can reveal DNS records, but it does not retrieve NFS export lists or NTP association data. This distractor reflects a common mistake of using a valid enumeration technique for the wrong service.
- E. Incorrect.
Incorrect. nbtscan is used for NetBIOS name service enumeration on Windows/NetBIOS-enabled hosts. It does not enumerate RPC mountd details or NTP monlist information. This option incorrectly mixes unrelated protocols and tools.