312-50 Question 136
Single answer▪ Vulnerability ExploitationDuring an authorized internal penetration test, you identify a legacy Windows 7 SP1 workstation used by the finance team. Scanning and validation show that SMBv1 is enabled, the host is missing MS17-010 patches, and TCP 445 is reachable from your test segment. The rules of engagement allow proof-of-exploit but require minimizing disruption and avoiding actions that could destabilize the host. Which approach is the MOST appropriate to verify exploitability while meeting those constraints?
- A
Use a safe MS17-010 vulnerability check to confirm the host is likely vulnerable, then document the finding without attempting remote code execution
- B
Launch the EternalBlue exploit with a Meterpreter payload to obtain SYSTEM access because successful code execution is the only valid proof
- C
Run a password-spraying attack against SMB to gain access using weak credentials instead of testing the vulnerability directly
- D
Exploit SMBv1 with a denial-of-service proof of concept to show impact without establishing a shell
Show answer and explanation
Correct answer: A
Explanation
The key issue is choosing the least risky method that still provides credible evidence of exploitability. MS17-010 affects SMBv1 on unpatched Windows systems and is associated with high-impact exploits such as EternalBlue. However, ethical hacking and CEH-style decision-making require applying technical knowledge within operational and legal constraints. When rules of engagement limit disruption, a safe validation method is preferable to live exploitation. Industry practice supports confirming version/patch exposure, validating reachable services, and using non-destructive checks before considering weaponized exploitation. For reference, Microsoft security guidance for MS17-010 and common testing workflows using Nmap NSE scripts support safe identification of exposed SMB services. The best answer is therefore to perform a safe MS17-010 check and document the evidence rather than execute a risky exploit on a production finance workstation.
- A. Correct.
Correct. In a constrained engagement where the objective is to verify exploitability while minimizing operational risk, a non-intrusive or 'safe' check for MS17-010 is the best choice. Tools such as Nmap's smb-vuln-ms17-010 NSE script are commonly used to identify likely vulnerability status without attempting full exploitation. This approach aligns with professional testing practice: gather sufficient evidence, avoid unnecessary payload execution, and respect the rules of engagement. Since EternalBlue exploitation can crash unstable systems, documenting confirmed exposure and patch status is often the most appropriate proof.
- B. Incorrect.
Incorrect. Although exploiting MS17-010 with EternalBlue can provide definitive proof, it is not the most appropriate action under a requirement to minimize disruption. EternalBlue is well known for potentially causing system instability or crashes, especially on legacy and fragile hosts. In real engagements, testers should not default to remote code execution when a lower-risk validation method satisfies the objective and the rules of engagement.
- C. Incorrect.
Incorrect. Password spraying is a different attack path and does not verify the specific vulnerability exploitation scenario presented. Even if weak SMB credentials existed, that would demonstrate poor authentication hygiene rather than confirm exposure to MS17-010. This option reflects a common misconception that any successful compromise is interchangeable with vulnerability validation; in practice, findings must map accurately to the tested weakness.
- D. Incorrect.
Incorrect. Triggering a denial-of-service condition is directly contrary to the requirement to avoid destabilizing the host. It also creates unnecessary operational impact on a finance workstation. Demonstrating availability impact is generally more disruptive than a safe vulnerability check and would be difficult to justify when the rules of engagement emphasize minimal disruption.