312-50 Question 129
Single answer▪ System Hacking ConceptsDuring an authorized internal assessment, you gain local administrator access to a Windows 10 workstation that is joined to an Active Directory domain. The client wants to understand the risk of credential exposure from compromised endpoints. You need to obtain password hashes from the system for offline cracking while minimizing the chance of disrupting the host. Which action is the most appropriate to achieve this goal?
- A
Dump the contents of LSASS memory directly and extract only Kerberos service tickets
- B
Copy the SAM and SYSTEM registry hives and extract local account hashes offline
- C
Enable RDP and use the built-in Windows Credential Manager GUI to export all saved passwords
- D
Reset a local administrator password and then review Event Viewer for previously used credentials
Show answer and explanation
Correct answer: B
Explanation
The best answer is to copy the SAM and SYSTEM registry hives and extract local account hashes offline. In Windows, local account password hashes are stored in the Security Account Manager (SAM) database, and the SYSTEM hive contains the system boot key required to derive or decrypt the protected hash data. This is a classic system hacking concept in CEH: once administrative privileges are obtained, attackers may access protected credential stores to perform offline password cracking. Compared with live LSASS dumping, offline hive collection is often less disruptive and can reduce the chance of immediate process-memory detection, though any such activity should be performed only with explicit authorization. From a defensive perspective, this scenario highlights the importance of least privilege, LAPS/Windows LAPS for local admin password management, restricting local administrator use, monitoring access to sensitive registry hives, and enabling protections such as Credential Guard where appropriate. Microsoft documentation on SAM, LSASS, Credential Manager, and Windows credential protections supports these distinctions.
- A. Incorrect.
This is incorrect because directly dumping LSASS memory is a more invasive credential-access technique and is commonly monitored by EDR tools. Also, extracting only Kerberos service tickets would not meet the stated goal of obtaining password hashes from the system for offline cracking of local accounts. LSASS access can expose plaintext credentials, NTLM hashes, and tickets depending on protections, but the option is narrower than the requirement and less aligned with minimizing disruption.
- B. Correct.
This is correct because Windows stores local account password hashes in the SAM database, and the SYSTEM hive contains the boot key material needed to decrypt them. Copying the SAM and SYSTEM hives for offline extraction is a standard post-exploitation technique used in authorized assessments to obtain local NTLM hashes with relatively low operational impact compared to live memory tampering. This directly supports offline cracking and is highly relevant to evaluating endpoint credential exposure.
- C. Incorrect.
This is incorrect because Windows Credential Manager does not provide a legitimate built-in function to export all saved passwords in plaintext through the GUI for an administrator. Saved credentials are protected and not broadly recoverable this way. This option reflects a common misconception that administrative access automatically enables simple GUI-based password export.
- D. Incorrect.
This is incorrect because resetting a password changes the credential rather than revealing the original hash or password, which undermines the objective of assessing existing credential exposure. It is also disruptive and may affect services, scheduled tasks, or user access. Event Viewer does not store previously used user passwords for later review.