PT0-003: CompTIA PenTest+Demo

Question

A tester gains access to an endpoint subnet and wants to move laterally through the network. Given the following output:

Question Image

Which command and attack technique is most appropriate for reducing the likelihood of detection?

A responder -I eth0 -dwvntlmrelayx.py -smb2support -tf <target>
B msf > use exploit/windows/smb/ms17_010_psexecmsf > <set options>msf > run
C hydra -L administrator -P /path/topasswdlist smb: //<target>
D nmap --script smb-brute.nse -p 445 <target>

Explanation

An SMB service with message signing disabled can be susceptible to NTLM relay. Responder can capture or trigger NTLM authentication, and ntlmrelayx.py can relay that authentication to an SMB target; this avoids the repeated failed logons produced by SMB password-brute-forcing. Microsoft identifies SMB signing as protection against relay attacks, whereas MS17-010 exploitation would require evidence that the target is vulnerable.

Learn more

PT0-003: CompTIA PenTest+Demo

AstroTutor

Notes

Readiness

QuestionQ229

Community Discussion