Free Preparation Discussions
MENU
CompTIA Exam PT0-003 Topic 2 Question 18 Discussion
Topic #: 2
A tester obtains access to an endpoint subnet and wants to move laterally in the network. Given the following output:
kotlin
Copy code
Nmap scan report for some_host
Host is up (0.01 latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results: smb2-security-mode: Message signing disabled
Which of the following command and attack methods is the most appropriate for reducing the chances of being detected?
Explanation of the Correct Option:
A (responder and ntlmrelayx.py):
Responder is a tool for intercepting and relaying NTLM authentication requests.
Since SMB signing is disabled, ntlmrelayx.py can relay authentication requests and escalate privileges to move laterally without directly brute-forcing credentials, which is stealthier.
Why Not Other Options?
B: Exploiting MS17-010 (psexec) is noisy and likely to trigger alerts.
C: Brute-forcing credentials with Hydra is highly detectable due to the volume of failed login attempts.
D: Nmap scripts like smb-brute.nse are useful for enumeration but involve brute-force methods that increase detection risk.
CompTIA Pentest+ Reference:
Domain 3.0 (Attacks and Exploits)
Werner
1 months agoHeidy
1 months agoSharika
1 months agoVerda
2 months agoTawanna
2 months agoStephanie
2 months agoKattie
2 months agoJovita
2 months agoBrandee
2 months agoLynsey
3 months agoOmer
2 months agoGlenn
2 months agoDierdre
2 months ago