312-50 Question 130
Single answer▪ Gaining AccessDuring an authorized internal penetration test, you discover a legacy Windows file server that allows SMB access from a user workstation segment. Nmap and service enumeration show SMB signing is not required on the server, and several users are actively logged in to the same subnet. The client wants you to demonstrate a realistic gaining-access risk without exploiting a software vulnerability on the server itself. Which action would be the most appropriate next step to obtain reusable credentials for lateral movement?
- A
Use an LLMNR/NBT-NS poisoning attack with a tool such as Responder to capture or relay NetNTLM authentication from nearby hosts
- B
Launch a SYN flood against the file server to force users to reconnect and expose plaintext passwords over SMB
- C
Exploit a SQL injection flaw on the server's SMB service to dump local account passwords
- D
Perform ARP spoofing and directly read users' Windows passwords from encrypted Kerberos traffic
- E
Use a pass-the-hash attack immediately, even though you have not yet captured any password hashes or NTLM material
Show answer and explanation
Correct answer: A
Explanation
The best answer is the LLMNR/NBT-NS poisoning approach because it fits both the scenario and realistic CEH-style gaining-access tradecraft. In Windows environments, if name resolution falls back to LLMNR or NBT-NS and SMB signing is not enforced, tools such as Responder can capture NetNTLM challenge-response hashes and, in some cases, support credential relay workflows. This is a common internal-network attack path for demonstrating how weak name resolution and unsigned SMB traffic can enable lateral movement without exploiting a software vulnerability on the target server itself. By contrast, DoS does not achieve credential capture, SQL injection is irrelevant to SMB, intercepting Kerberos does not reveal plaintext passwords, and pass-the-hash cannot be performed until valid hash material is first obtained. Relevant defensive guidance includes Microsoft's recommendations to disable LLMNR where possible, restrict or disable NBT-NS in managed environments, and require SMB signing to reduce the risk of credential relay.
- A. Correct.
Correct. In an internal network where SMB signing is not required, LLMNR/NBT-NS poisoning is a realistic way to capture NetNTLM challenge-response material or relay authentication to other services, depending on environmental controls. This aligns with common gaining-access techniques used during authorized assessments when testers want to demonstrate credential exposure and lateral movement risk without exploiting a host-side software bug. The key conditions in the scenario, Windows environment, active users, and lack of required SMB signing, make this a practical next step.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not a credential acquisition method. It may disrupt operations and would generally be inappropriate unless explicitly authorized for availability testing. It also does not cause SMB to send plaintext passwords; modern Windows authentication uses NTLM or Kerberos, not plaintext password transmission in this context.
- C. Incorrect.
Incorrect. SMB is not a SQL-based service, so a SQL injection attack against SMB is technically nonsensical. This distractor targets candidates who recognize 'credential dumping' as an objective but fail to match the technique to the actual protocol and service in use.
- D. Incorrect.
Incorrect. ARP spoofing can position an attacker as a man-in-the-middle on a local subnet, but Kerberos traffic does not expose users' plaintext passwords simply because it is intercepted. Kerberos uses tickets and encrypted exchanges, so directly reading passwords from captured Kerberos packets is not a valid expectation.
- E. Incorrect.
Incorrect. Pass-the-hash requires previously obtained NTLM hashes or equivalent authentication material. In this scenario, the tester has not yet captured hashes or relayed credentials, so attempting pass-the-hash immediately is premature. It is a post-compromise or post-capture technique, not the first step here.