Based on the following extract from the log of a compromised machine, what is the hacker really trying to steal? c:\> cmd /c type c:\winnt\repair\sam > c:\har.txt Volume in drive C has no label…

Question

Options

• Ahar.txt
• BSAM file
• Cwwwroot
• DRepair file

• A
  4% (1)
• B
  83% (20)
• C
  8% (2)
• D
  4% (1)

Explanation

Explanation

The hacker's ultimate goal is the SAM (Security Account Manager) file, which stores Windows user account credentials (usernames and hashed passwords). The command cmd /c type c:\winnt\repair\sam > c:\har.txt reveals the true intent - the attacker is copying the SAM file's contents into har.txt as a vehicle to exfiltrate it via the web server, not because har.txt itself is valuable. har.txt (A) and wwwroot (C) are merely tools in the process - the text file is a temporary container and the web directory is the delivery mechanism used to serve the file over HTTP. The repair folder (D) is simply the location where Windows stores a backup of the SAM file, not the target itself.

Memory Tip: Think of it like a heist - the gold is the SAM file (passwords), har.txt is just the getaway bag, and wwwroot is the getaway car. Always ask yourself "what data has real value?" - in Windows hacking scenarios, it's almost always the SAM file because cracking its password hashes grants full account access.

No community discussion yet for this question.