312-50 Question 322
Single answer▪ Attack Access ControlsDuring an authorized internal assessment, you obtain a low-privileged domain user account in a Windows Active Directory environment. The client wants you to demonstrate a realistic way an attacker could bypass normal access controls and gain broader access without exploiting a software vulnerability. You discover that a shared internal application server stores a plaintext service account password in a configuration file readable by the Authenticated Users group. The service account is a member of Backup Operators on a file server that hosts sensitive HR data. Which action would BEST demonstrate an attack against access controls in this scenario?
- A
Use the recovered service account credentials to authenticate to the file server and access or back up protected HR files using the privileges granted to Backup Operators
- B
Launch a SYN flood against the file server so legitimate HR users are disconnected and you can access the files afterward
- C
Perform SQL injection against the HR application because application-layer attacks are the most direct way to bypass file permissions
- D
Run a vulnerability scan against all domain controllers to find a missing patch that automatically grants Domain Admin privileges
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use the exposed service account credentials and the privileges associated with that account to access protected data. This is a classic access control failure: sensitive credentials were made readable to a broad group, and the account itself was granted privileges that exceed what a low-privileged user should have. In CEH terms, attacking access controls often involves privilege abuse, credential misuse, authorization bypass, and exploitation of weak permission assignments rather than only software exploitation. In Microsoft environments, groups such as Backup Operators have powerful rights that can bypass normal NTFS access restrictions for backup and restore purposes, so assigning such rights to service accounts and exposing their credentials creates a serious risk. This aligns with security best practices from Microsoft guidance on least privilege, protected credential storage, and restricting service account permissions. A proper remediation would include removing plaintext passwords from configuration files, tightening ACLs on sensitive files, using managed service accounts where appropriate, and limiting privileged group memberships to only what is operationally necessary.
- A. Correct.
Correct. This is a realistic attack on access controls because the tester is abusing overly permissive credential exposure and existing authorization assignments rather than exploiting a software flaw. If a service account with Backup Operators privileges is exposed to Authenticated Users, an attacker can use those valid credentials to access data beyond the original low-privileged user's authorization. In Windows environments, Backup Operators can bypass certain file permission restrictions for backup and restore operations, making this a practical privilege abuse scenario that directly targets access control weaknesses.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service attack, not an access control attack. It may disrupt availability, but it does not help the attacker gain authorized or unauthorized access to protected HR data. This option reflects the misconception that causing service disruption somehow enables privilege escalation or data access.
- C. Incorrect.
Incorrect. SQL injection is a valid attack technique in some environments, but the scenario explicitly provides a more direct path involving mismanaged credentials and excessive privileges. The question asks for the BEST demonstration of attacking access controls without exploiting a software vulnerability. SQL injection would depend on an application flaw, which does not align with the scenario's objective.
- D. Incorrect.
Incorrect. Running a vulnerability scan may identify missing patches, but this is reconnaissance, not a direct demonstration of attacking access controls. Also, missing patches do not 'automatically' grant Domain Admin privileges. This option is implausible and conflates vulnerability management with access control abuse.