312-50 Question 131
Single answer▪ Gaining AccessDuring an authorized internal penetration test, you compromise a Windows 10 workstation used by a finance employee. The workstation is joined to an Active Directory domain, and your goal is to gain access to additional systems without triggering account lockouts or noisy authentication failures. You discover that the user is a local administrator on the compromised workstation, but not a domain administrator. Which action would be the MOST effective next step to obtain reusable credentials for lateral movement within the domain environment?
- A
Dump credentials from LSASS memory on the compromised workstation to recover plaintext passwords, NTLM hashes, or Kerberos tickets for logged-on users
- B
Run a full TCP port scan against every host in the subnet and attempt anonymous SMB connections to identify domain administrator shares
- C
Force a password reset for the compromised user account to gain elevated access to domain resources with the new credentials
- D
Disable Windows Defender and reboot the host so that domain administrator credentials are automatically cached after restart
Show answer and explanation
Correct answer: A
Explanation
The best next step is to extract credential material from the compromised Windows system, specifically from LSASS memory, if permitted by scope and if you have the necessary local privileges. In real environments, administrators, help desk personnel, service accounts, or other users may have authenticated to the host, leaving behind NTLM hashes, Kerberos tickets, or other artifacts that can be used for lateral movement. This approach is typically more targeted and less noisy than broad scanning or repeated login attempts, which helps avoid account lockouts and excessive authentication failures.
From a defensive and best-practice standpoint, Microsoft recommends protections such as Credential Guard, LSASS protection (RunAsPPL where applicable), limiting administrative logons to lower-trust systems, and using privileged access workstations to reduce exposure of reusable credentials. These controls are specifically intended to mitigate credential theft from memory and subsequent lateral movement. The question focuses on applied post-exploitation decision-making: once local admin access is obtained on a domain-joined endpoint, credential access is often the most effective path to gaining access to additional systems.
- A. Correct.
Correct. On a Windows host where you already have sufficient local privileges, dumping credentials from LSASS can reveal material useful for lateral movement, such as NTLM hashes, Kerberos tickets, and sometimes plaintext credentials depending on logon type, protections, and OS configuration. This is a realistic gaining-access technique because it leverages an existing foothold to obtain reusable authentication artifacts without generating repeated failed logons that could lock accounts or trigger alerts. In CEH-relevant scenarios, this supports pass-the-hash, pass-the-ticket, or credential reuse against other systems where those credentials are valid.
- B. Incorrect.
Incorrect. Broad network scanning and anonymous SMB probing may help with enumeration, but it does not directly obtain reusable credentials. It is also noisier and more likely to be detected than leveraging credentials already present on the compromised endpoint. The misconception here is confusing post-exploitation credential access with general network discovery.
- C. Incorrect.
Incorrect. Forcing a password reset is not a realistic or stealthy post-exploitation technique for gaining additional access during an internal penetration test unless you already possess delegated administrative rights to reset that account in Active Directory. Resetting a password would also disrupt the user and likely generate immediate operational and security alerts. The misconception is assuming that control of a workstation gives control over domain identity management.
- D. Incorrect.
Incorrect. Disabling endpoint protection and rebooting does not cause domain administrator credentials to be automatically cached on the host. Credential caching on Windows depends on actual logons and system configuration, not on a reboot alone. This option reflects a misunderstanding of how cached credentials and administrative logons work in domain environments.