nerdexam
GIAC

GPEN · Question #444

Analyze the command output below. What information can the tester infer directly from the information shown?

The correct answer is C. The target host is running Linux with Samba services. Samba version strings in SMB enumeration output directly identify the target as a Linux or Unix system running the open-source Samba implementation rather than native Windows SMB.

Penetration Testing Foundations & Reconnaissance

Question

Analyze the command output below. What information can the tester infer directly from the information shown?

Exhibit

GPEN question #444 exhibit

Options

  • AThe administrator account has no password
  • BNull sessions are enabled on the target
  • CThe target host is running Linux with Samba services
  • DAccount lockouts must be reset by the Administrator

How the community answered

(38 responses)
  • A
    11% (4)
  • B
    5% (2)
  • C
    82% (31)
  • D
    3% (1)

Why each option

Samba version strings in SMB enumeration output directly identify the target as a Linux or Unix system running the open-source Samba implementation rather than native Windows SMB.

AThe administrator account has no password

The presence or absence of a password on the Administrator account cannot be determined from a service banner or basic SMB identification output alone.

BNull sessions are enabled on the target

Null session capability is a separate SMB configuration setting that requires a specific successful null connection attempt to confirm, not simply identifying the service type.

CThe target host is running Linux with Samba servicesCorrect

Samba is an open-source SMB/CIFS implementation that runs exclusively on Linux and Unix platforms. Tools such as enum4linux, smbclient, or nmap SMB scripts display version banners containing the string 'Samba' along with a version number, which unambiguously identifies the host OS family as Linux. This inference is directly supported by the service banner without requiring further enumeration.

DAccount lockouts must be reset by the Administrator

Account lockout reset policies require querying password policy details via tools like rpcclient or 'net accounts', which is distinct from service version identification output.

Concept tested: SMB service fingerprinting and OS identification via Samba banners

Source: https://www.samba.org/samba/docs/current/man-html/samba.7.html

Topics

#Samba#SMB#null sessions#service enumeration

Community Discussion

No community discussion yet for this question.

Full GPEN Practice