312-50 Question 105
Single answerUnix/Linux, Telnet, FTP, TFTP, SMB, IPv6, and BGPDuring an internal assessment, you compromise a dual-stack Ubuntu server in a branch office. The host can reach an internal IPv6-only management network that contains routers and legacy infrastructure. You need to identify the most serious cleartext credential exposure from this Linux host with the least risk of disrupting routing or file services. Which action is the BEST next step?
- A
Capture traffic on the host's IPv6 interface and look for Telnet or FTP authentication exchanges to recover usernames and passwords
- B
Modify the local BGP daemon configuration to advertise a more specific IPv6 prefix so traffic is redirected through the compromised host
- C
Restart the SMB service and enable guest access so you can capture NTLM hashes from reconnecting clients
- D
Use TFTP to enumerate shares on the management network because TFTP supports authenticated directory listings over UDP
Show answer and explanation
Correct answer: A
Explanation
The best answer is to passively capture traffic and look for Telnet or FTP authentication over the IPv6-connected management network. Telnet and standard FTP are legacy protocols that send credentials in cleartext, making them high-value targets during internal assessments. This is especially relevant in mixed modern/legacy environments where IPv6 connectivity may expose services administrators assume are isolated or overlooked.
Why the others are worse: BGP is a routing protocol used between autonomous systems and within some enterprise designs. Altering BGP advertisements from a compromised host is highly disruptive and not a low-risk first step. SMB is relevant in enterprise environments, but common SMB authentication methods do not simply expose cleartext passwords in transit. TFTP is unauthenticated and minimal by design, but it does not provide share enumeration or authenticated listings.
Relevant best practices and references include vendor and protocol documentation noting that Telnet and FTP lack transport security unless replaced by SSH and FTPS/SFTP alternatives. IETF RFC 854 defines Telnet, and RFC 959 defines FTP; both predate modern encryption expectations. TFTP is defined in RFC 1350 and is intentionally limited. For secure administration, modern guidance recommends SSH instead of Telnet and secure file transfer mechanisms instead of FTP/TFTP for sensitive operations.
- A. Correct.
Correct. Telnet and traditional FTP transmit credentials in cleartext, and this remains true whether they run over IPv4 or IPv6. From a compromised Linux host with access to an IPv6-only segment, passively capturing traffic with tools such as tcpdump or Wireshark is a practical, low-impact way to identify exposed credentials without altering network behavior. This directly targets the most serious cleartext authentication risk among the listed protocols.
- B. Incorrect.
Incorrect. While BGP can influence routing, changing BGP advertisements is intrusive, high risk, and could disrupt production traffic. It is not the least disruptive next step. Also, manipulating routes to redirect traffic is far more invasive than first checking for existing cleartext credential exposure. In an assessment, passive collection is typically preferred before active interference with routing protocols.
- C. Incorrect.
Incorrect. SMB does not require restarting a service on a compromised Linux host to identify credential exposure elsewhere, and enabling guest access would alter system configuration and likely create instability or detection risk. SMB authentication is not equivalent to cleartext password transmission; NTLM challenge-response is not sent as plain usernames and passwords on the wire. This option reflects the misconception that any visible SMB authentication yields reusable cleartext credentials.
- D. Incorrect.
Incorrect. TFTP is a trivial file transfer protocol over UDP and does not provide authenticated directory listing functionality like FTP or SMB. It is commonly used for simple file transfers such as network device boot images or configs, but it does not enumerate shares. This option is based on a false assumption about TFTP capabilities.