312-50 Question 144
Single answer▪ Maintaining AccessDuring an authorized internal penetration test, you obtain local administrator privileges on a Windows 10 workstation that frequently leaves the corporate network and reconnects through different VPNs. The rules of engagement allow you to maintain access only if the method is reliable, encrypted, and causes minimal disruption to the user. You need a mechanism that will automatically reconnect to your controlled host whenever the system regains Internet access, without requiring the user to log in interactively. Which option is the most appropriate choice?
- A
Create a Windows service that launches a reverse HTTPS Meterpreter payload and configure it to start automatically
- B
Replace explorer.exe with cmd.exe so a shell appears before the desktop loads
- C
Enable the Guest account and add it to the local Administrators group for later RDP access
- D
Place a batch file in the current user's Startup folder that opens a netcat bind shell on port 4444
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create a Windows service that launches a reverse HTTPS payload. In maintaining access, the operator should prefer persistence that is stable, minimally disruptive, and aligned with the network environment. A reverse connection is generally more dependable than a bind shell because the compromised host initiates the outbound session, which works better through NAT, host firewalls, and changing remote network paths. Using HTTPS adds transport encryption and blends more naturally with normal outbound traffic than raw listener ports. A service is also superior here because it starts automatically with the system and does not depend on user logon, unlike Startup folder persistence. From a defensive and administrative perspective, Windows services are a known persistence mechanism covered in MITRE ATT&CK persistence techniques, while Microsoft documentation distinguishes services from per-user startup mechanisms in terms of execution context and startup behavior. In an authorized CEH context, the key is choosing the method that best fits the operational constraints while minimizing visible impact.
- A. Correct.
Correct. A Windows service runs in the background and can start automatically at boot, which means it does not depend on interactive user logon. Using a reverse HTTPS payload is appropriate for maintaining access because it initiates outbound encrypted traffic, which is generally more reliable across NAT, VPN changes, and host firewalls than an inbound bind shell. In CEH-style maintaining access scenarios, services and scheduled persistence tied to system startup are common approaches when reliability and reduced user impact are required.
- B. Incorrect.
Incorrect. Replacing explorer.exe with cmd.exe is highly disruptive, obvious to the user, and likely to break normal workstation functionality. Although it might provide command access, it does not meet the requirement for minimal disruption and would be easily detected during normal use. It is not a realistic persistence method for a professional engagement operating within strict rules of engagement.
- C. Incorrect.
Incorrect. Enabling the Guest account and elevating it to Administrators is noisy, insecure, and operationally risky. It creates a conspicuous configuration change that is likely to be detected by administrators, endpoint controls, or log review. It also does not satisfy the requirement for reliable encrypted reconnection, since RDP access depends on inbound reachability and explicit remote access rather than an automatic callback.
- D. Incorrect.
Incorrect. A Startup folder script only runs when that specific user logs in, so it does not satisfy the requirement to reconnect without interactive logon. In addition, a netcat bind shell requires inbound connectivity to the workstation, which is often blocked by local firewalls, NAT, or changing VPN environments. It is also unencrypted unless wrapped in another mechanism, making it a poor fit for the scenario.