312-50 Question 95
Select 2▪ NTP and NFS EnumerationDuring an internal assessment, you identify a Linux server that appears to provide both NTP and NFS services. Your objective is to enumerate these services using low-noise methods to determine whether the NFS exports are misconfigured and whether the NTP service discloses useful operational information. Which TWO actions should you take first?
- A
Use rpcinfo and showmount against the target to enumerate RPC programs and exported NFS shares
- B
Send NTP mode 6 queries with ntpq to retrieve peer and system information if the server permits control queries
- C
Run a full TCP connect scan of all 65535 ports to identify UDP-based NTP monlist support
- D
Attempt to mount every discovered NFS export immediately with read/write options to verify access
- E
Use SNMP community string guessing to enumerate NTP peers and NFS exports from the host
Show answer and explanation
Correct answers: A, B
Explanation
The best initial enumeration steps are to query NFS through RPC-aware tools and query NTP through supported control mechanisms. For NFS, rpcinfo and showmount are commonly used to identify RPC services and exported directories. This helps determine whether exports are visible and potentially misconfigured before any mount attempt. For NTP, ntpq can issue mode 6 control queries to obtain operational details when permitted. This is useful for enumeration and is more accurate than relying on outdated assumptions such as universal monlist support. Historically, mode 7 monlist responses were abused for amplification attacks, but modern guidance recommends disabling or restricting such functionality, and many current deployments no longer support it. Relevant references include the NFS and RPC man pages for rpcinfo and showmount, and NTP documentation for ntpq control queries and restrictions in ntpd/ntpsec environments. From a CEH perspective, the key is choosing minimally invasive, protocol-appropriate enumeration methods before attempting exploitation or access.
- A. Correct.
Correct. NFS commonly relies on ONC RPC services such as rpcbind/portmapper and mountd. Using rpcinfo can reveal registered RPC programs and ports, while showmount -e can request the list of exported file systems from mountd when allowed. This is a standard, low-noise enumeration approach for identifying exposed NFS shares before attempting access.
- B. Correct.
Correct. Querying NTP with ntpq using mode 6 control queries can disclose useful information such as associations, peers, and system status when the server allows them. This is a practical enumeration step because some NTP servers still respond to read-only control queries even when more dangerous legacy queries are disabled.
- C. Incorrect.
Incorrect. NTP primarily uses UDP/123, so a full TCP connect scan is the wrong technique for identifying NTP behavior. It is also unnecessarily noisy. In addition, monlist is a legacy mode 7 query associated with older ntpd behavior, not something you discover through a TCP connect scan.
- D. Incorrect.
Incorrect. Immediately attempting to mount all exports is not the best first step. Proper enumeration should identify available exports and access rules before mounting. Also, specifying read/write does not guarantee write access; the export configuration on the server controls that. Jumping straight to mounting is less controlled and may be more intrusive than necessary.
- E. Incorrect.
Incorrect. SNMP may reveal host configuration if enabled and if valid community strings are known, but it is not the primary or most direct method for enumerating NTP and NFS services in this scenario. The question asks for the best first actions focused on NTP and NFS enumeration themselves.