312-50 Question 132
Single answer▪ Gaining AccessDuring an authorized internal assessment, you compromise a Windows 10 workstation used by a help-desk technician. The machine is joined to an Active Directory domain, and you have local administrator privileges on that workstation but no domain admin rights. The client wants you to demonstrate a realistic method of gaining further access without exploiting a software vulnerability. Which action is the most effective next step to obtain reusable credentials for lateral movement in this scenario?
- A
Dump credentials from LSASS memory on the compromised workstation to recover cached NTLM hashes or plaintext credentials of logged-on users
- B
Perform a SYN flood against the domain controller to force users to reconnect and reveal their passwords
- C
Run SQL injection attacks against the workstation's local services to extract domain credentials
- D
Overwrite the Security Account Manager (SAM) remotely on the domain controller to promote the local account into Domain Admins
Show answer and explanation
Correct answer: A
Explanation
The best answer is to dump credentials from LSASS memory on the compromised workstation. In real-world internal engagements, once an attacker or tester gains local administrator rights on a Windows system, credential access becomes a key path to further access. Help-desk staff often log in to multiple systems or use elevated tools, making their workstation especially valuable for harvesting reusable credentials. This is a classic post-exploitation path that does not require exploiting a new software vulnerability and is consistent with CEH coverage of gaining access, privilege abuse, and lateral movement. Microsoft has documented LSASS as a protected process target for credential material, and industry guidance such as MITRE ATT&CK documents OS Credential Dumping (T1003). Defensive best practices include enabling Windows Defender Credential Guard, restricting administrative logons, using tiered administration, and monitoring for suspicious access to LSASS.
- A. Correct.
Correct. On a compromised Windows host where you already have local administrator rights, extracting credentials from LSASS is a realistic post-exploitation technique for gaining access. Tools such as Mimikatz or other credential-dumping methods can recover NTLM hashes, Kerberos tickets, and in some environments even plaintext credentials for users who have logged on interactively or via remote administration. If the help-desk technician has privileged access to other systems, those credentials can support lateral movement using pass-the-hash, pass-the-ticket, or direct authentication. This aligns with common ATT&CK techniques such as OS Credential Dumping.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not a credential access or gaining-access method. It disrupts availability rather than helping an assessor obtain reusable authentication material. It is also noisy, typically outside the scope of a standard internal assessment unless explicitly authorized, and would not cause users to reveal passwords in any reliable way.
- C. Incorrect.
Incorrect. SQL injection applies to vulnerable web applications or database-driven services that improperly handle input. It is not a relevant next step on a standard Windows workstation simply because you have local admin access. Even if a local application used a database, SQL injection would not be the most direct or realistic way to obtain domain credentials from this foothold.
- D. Incorrect.
Incorrect. The SAM database stores local account information, not domain group membership on a domain controller. You cannot simply overwrite the SAM on a domain controller to add a workstation local account to Domain Admins. Domain accounts and privileged group membership are managed by Active Directory, not by modifying a local workstation account or using this described method.