312-50 Question 142
Single answer▪ Maintaining AccessDuring an authorized internal penetration test, you gain local administrator access on a Windows 10 workstation that frequently connects to a corporate VPN. The rules of engagement allow you to demonstrate a temporary, user-mode persistence mechanism but prohibit modifying domain policies, installing kernel drivers, or disabling security controls. You need a method that will likely survive a reboot, execute when the employee logs in, and avoid requiring elevated privileges every time it runs. Which option is the most appropriate way to maintain access within these constraints?
- A
Create a per-user registry Run key in HKCU to launch a payload when the user logs on
- B
Install a kernel-mode rootkit to hook the boot process before endpoint protection starts
- C
Create a new domain Group Policy Object that deploys a scheduled task to all workstations
- D
Patch LSASS in memory to force credential caching and regain access after reboot
Show answer and explanation
Correct answer: A
Explanation
For maintaining access in a Windows environment, CEH candidates should distinguish between persistence methods that are user-mode, host-scoped, and minimally invasive versus techniques that are stealthier but out of scope or operationally risky. In this case, a per-user Run key is the best fit because it is a standard Windows autorun mechanism designed to execute programs when that user logs on. Microsoft documents these autorun locations in Windows startup behavior, and they are widely recognized in both administration and incident response. By contrast, kernel rootkits are intrusive and prohibited here, domain GPO changes exceed the engagement boundary, and LSASS memory tampering is a credential-access tactic rather than a durable post-reboot persistence method. A CEH practitioner should choose the method that meets the objective while staying within authorization, minimizing impact, and matching the persistence requirement.
- A. Correct.
Correct. A persistence entry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is a classic user-mode persistence technique on Windows. It survives reboot, triggers at user logon, and runs in the security context of that user without needing elevation each time. In this scenario, it fits the rules of engagement because it does not require kernel components, domain-wide changes, or disabling defensive controls.
- B. Incorrect.
Incorrect. A kernel-mode rootkit is far outside the allowed scope. It modifies low-level system behavior, is highly invasive, and directly violates the restriction against installing kernel drivers. Although rootkits are associated with maintaining access, this option is not appropriate for a controlled CEH-style engagement with explicit limitations.
- C. Incorrect.
Incorrect. Deploying persistence through a domain GPO would require changes to domain policy infrastructure and would impact systems beyond the single authorized host. The scenario explicitly prohibits modifying domain policies. This distractor reflects a common misunderstanding that effective persistence is acceptable even when it exceeds scope.
- D. Incorrect.
Incorrect. Patching LSASS in memory is not a reliable persistence mechanism for surviving reboot. LSASS memory modifications are volatile and disappear after restart. It also introduces significant operational and legal risk because LSASS is a protected, security-sensitive process. This option confuses credential access techniques with persistence techniques.