312-50 Question 128
Single answer▪ System Hacking ConceptsDuring an internal CEH-authorized assessment, you gain local administrative access to a legacy Windows 7 workstation that is joined to the domain. The client wants to understand the risk of credential exposure from cached secrets stored on the host. You need to extract password hashes from the Security Account Manager (SAM) database in a forensically sound way without rebooting the system. Which action is the most appropriate?
- A
Use Volume Shadow Copy or a live-response method to copy both the SAM and SYSTEM registry hives, then extract local account hashes offline with a tool such as pwdump/secretsdump-style parsing
- B
Copy only the SAM file from C:\Windows\System32\config and crack it directly, because the SYSTEM hive is not required to decrypt stored password hashes
- C
Dump LSASS memory and treat the resulting contents as equivalent to the SAM database, because LSASS memory always contains the same local password hashes as the SAM
- D
Reset a local administrator password with an offline registry editor first, then read the SAM afterward to recover the original NTLM hashes
Show answer and explanation
Correct answer: A
Explanation
The best answer is to acquire both the SAM and SYSTEM hives and perform offline extraction. In Windows system-hacking methodology, the SAM stores local account password hashes, while the SYSTEM hive contains key material required to decrypt or derive access to those protected hashes. This is why many legitimate forensic and security tools require both hives. Using a live-response collection method such as Volume Shadow Copy helps avoid rebooting the machine and reduces unnecessary alteration of the target. By contrast, copying only the SAM is insufficient, LSASS dumping is a separate technique focused on credentials in memory rather than the SAM itself, and password resets alter evidence rather than revealing existing hashes. This aligns with standard DFIR and Windows credential-handling practices documented across Microsoft internals references and widely used incident-response tooling guidance.
- A. Correct.
Correct. On Windows systems, local account password hashes are stored in the SAM database, but the hashes are protected using boot key material derived from the SYSTEM hive. In practice, an assessor commonly acquires both the SAM and SYSTEM hives from a live system using a method such as Volume Shadow Copy or another authorized live-response technique, then parses them offline. This avoids rebooting the host and preserves the evidence needed to recover local account hashes accurately.
- B. Incorrect.
Incorrect. A common misconception is that the SAM file alone is sufficient. In reality, the SYSTEM hive is needed to derive the syskey/boot key material used to protect the password hashes in the SAM. Without the SYSTEM hive, offline extraction of usable local hashes is generally not possible.
- C. Incorrect.
Incorrect. LSASS memory dumping is a different credential-access technique and may reveal plaintext credentials, Kerberos material, or cached secrets depending on system state, protections, and logon activity. However, it is not equivalent to acquiring the SAM database. Not all local account hashes present in SAM will necessarily be recoverable from LSASS memory, and the question specifically asks for extracting hashes from the SAM in a forensically sound way.
- D. Incorrect.
Incorrect. Resetting a local administrator password changes account credential data and is not forensically sound if the goal is to assess original credential exposure. It can destroy or alter evidence and does not help recover the original NTLM hashes. This option reflects a misunderstanding between password reset operations and credential extraction.