312-50 Question 106
Single answerenumeration)During an authorized internal assessment, you identify a Windows file server that allows anonymous SMB sessions. The client wants to understand what information an attacker could gather during enumeration without valid domain credentials. Which action would provide the most useful enumeration result at this stage?
- A
Use enum4linux or rpcclient with a null session to enumerate users, groups, shares, and password policy information
- B
Run Mimikatz against the server to dump credentials from LSASS using the anonymous SMB session
- C
Use SQL enumeration tools to retrieve database account names from the host over TCP 1433 without checking whether SQL Server is installed
- D
Perform ARP spoofing against the subnet to extract Active Directory user names directly from SMB null sessions
Show answer and explanation
Correct answer: A
Explanation
This question tests practical enumeration knowledge rather than rote recall. In Windows environments, anonymous SMB/null sessions have historically allowed varying levels of information disclosure through SMB and MSRPC, especially on poorly configured legacy systems or misconfigured modern hosts. A tester should first use protocol-appropriate enumeration methods such as rpcclient, smbclient, or enum4linux to identify shares, account names, group memberships, and policy details that can support later password attacks or privilege analysis. By contrast, tools like Mimikatz require post-compromise privilege, SQL enumeration is service-specific and unsupported by the scenario, and ARP spoofing is unrelated to obtaining enumeration data from an SMB null session. This aligns with common penetration testing workflow and Microsoft security guidance around restricting anonymous access and SMB enumeration exposure.
- A. Correct.
Correct. If a Windows host permits anonymous SMB/null sessions, tools such as enum4linux and rpcclient can often query information exposed through SMB/RPC, including shares, local/domain users, groups, and sometimes password policy details, depending on system configuration. This is a classic enumeration activity in CEH-style scenarios because it leverages misconfigured anonymous access without requiring authenticated credentials.
- B. Incorrect.
Incorrect. Mimikatz is a post-exploitation credential access tool that typically requires local administrative or SYSTEM-level privileges on the target, not merely anonymous SMB access. An anonymous/null session does not provide the privilege level needed to read LSASS memory.
- C. Incorrect.
Incorrect. SQL enumeration over TCP 1433 is only relevant if Microsoft SQL Server is actually present and reachable. The scenario specifically concerns anonymous SMB enumeration on a Windows file server, so jumping to SQL tools without evidence of SQL Server is not the best next enumeration step.
- D. Incorrect.
Incorrect. ARP spoofing is a man-in-the-middle technique used to intercept traffic on a local network segment; it is not a method for directly enumerating AD usernames from an SMB null session. This option mixes unrelated techniques and reflects a common misconception that any network attack can substitute for protocol-specific enumeration.