312-50 Question 96
Select 2▪ NTP and NFS EnumerationDuring an internal assessment, you discover a Linux file server that appears to provide both NTP and NFS services. Your goal is to enumerate useful information without making unauthorized changes to the host. Which TWO actions are the most appropriate to identify exported NFS shares and gather NTP peer/time information from this server?
- A
Use
showmount -e <target>to list NFS exports exposed by the server - B
Use
ntpq -p <target>to query the remote server for its NTP peer associations - C
Use
mount -t nfs <target>:/ /mnt/testto force-mount the server root export and confirm access - D
Use
rpcinfo -p <target>to enumerate registered RPC services such as mountd and nfs - E
Use
ntpdate -u <target>to dump the server's full NTP peer table without affecting the target
Show answer and explanation
Correct answers: A, D
Explanation
For NFS enumeration, two of the most practical and commonly used techniques are querying exports with showmount -e and enumerating RPC services with rpcinfo -p. Together, these help an assessor verify that NFS-related daemons are available and identify what shares may be mountable. This aligns with standard UNIX/Linux administrative behavior for NFS, where mountd and rpcbind/portmapper expose information necessary for clients.
For NTP, assessors often look for version, peer, or association data using NTP control queries, but these are frequently restricted on hardened systems. Because the question asks for the most appropriate actions to identify exported NFS shares and gather NTP peer/time information without making changes, the strongest answers are the low-impact NFS enumeration actions that are consistently valid. Mounting a share is an access step rather than pure enumeration, and ntpdate -u does not enumerate peer tables.
Relevant references include the showmount(8) and rpcinfo(8) manual pages for NFS/RPC enumeration, and NTP documentation for query behavior and control-message restrictions. In practice, many organizations restrict NTP mode 6/7 queries due to reconnaissance and amplification concerns, so a tester should expect mixed results when probing NTP services.
- A. Correct.
Correct.
showmount -e <target>is a standard enumeration method for NFS servers. It queries the remote mount daemon to list exported file systems and the hosts or networks allowed to mount them. In a CEH-style assessment, this is a low-impact way to identify accessible NFS shares before attempting any mount operation. - B. Incorrect.
Incorrect.
ntpq -pis commonly used to display peer status, but it is typically intended to query an NTP daemon that supports mode 6 control queries. In practice, many servers restrict or disable these queries, and the syntax shown is not the most reliable remote enumeration approach for simply identifying exposed NTP information in a controlled assessment. It may work in some environments, but it is not the best answer here compared with more standard service enumeration steps. - C. Incorrect.
Incorrect. Attempting to mount an export is more intrusive than basic enumeration and may cross the line from discovery into active access. It also assumes that the root directory is exported, which is often false. A professional assessor should first identify exports with
showmountand validate RPC/NFS services before mounting anything, and only do so with explicit authorization. - D. Correct.
Correct.
rpcinfo -p <target>enumerates RPC programs registered on the host, including services commonly associated with NFS such as portmapper/rpcbind, mountd, nfs, nlockmgr, and status. This helps confirm that NFS-related services are present and reveals listening ports and protocol versions, which is directly useful during NFS enumeration. - E. Incorrect.
Incorrect.
ntpdate -uis used to query and potentially synchronize time using unprivileged ports; it does not dump the target's full NTP peer table. Choosing this option reflects a common misconception that any NTP query tool reveals internal peer associations. It may confirm time service responsiveness, but it is not a peer-enumeration method.