nerdexam
GIAC

GCIH · Question #690

Examine the image below. What share would a user typically connect to when they execute the NET USE command below? C:\> net use \\10.0.10.123

The correct answer is C. IPC$. When NET USE is executed against a remote host without specifying a share name, Windows automatically connects to the IPC$ (Inter-Process Communication) hidden share by default.

Reconnaissance, Scanning, and Enumeration

Question

Examine the image below. What share would a user typically connect to when they execute the NET USE command below? C:> net use \10.0.10.123

Exhibit

GCIH question #690 exhibit

Options

  • AC$
  • Btmp
  • CIPC$
  • DADMIN$

How the community answered

(47 responses)
  • A
    2% (1)
  • B
    4% (2)
  • C
    94% (44)

Why each option

When NET USE is executed against a remote host without specifying a share name, Windows automatically connects to the IPC$ (Inter-Process Communication) hidden share by default.

AC$

C$ is the default administrative share for the root of the C: drive and must be explicitly specified in the command (e.g., net use \\server\C$) - it is not connected to automatically.

Btmp

tmp is not a default Windows administrative share and would only exist if manually created on the target, requiring explicit naming in the NET USE command.

CIPC$Correct

IPC$ is a special hidden administrative share present on all Windows systems that facilitates named pipe communication and inter-process communication over the network. When 'net use \\<target>' is run without an explicit share path, Windows establishes a session against IPC$, which is also commonly leveraged during null session enumeration to query user accounts, groups, shares, and other system information prior to accessing other resources.

DADMIN$

ADMIN$ is an administrative share mapping to the Windows system directory (%SystemRoot%) and must also be explicitly named in the NET USE command to be accessed.

Concept tested: Default IPC$ share connection via NET USE command

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/inter-process-communication-share-null-session

Topics

#SMB#IPC$ share#NET USE#Windows networking

Community Discussion

No community discussion yet for this question.

Full GCIH Practice