nerdexam
GIAC

GPEN · Question #419

You have compromised a Windows workstation using Metasploit and have injected the Meterpreter payload into the smss process. You want to dump the SAM database of the remote system so you can crack…

The correct answer is C. Stdapi. Dumping the SAM database through Meterpreter requires the Stdapi extension to provide the necessary system-level API commands for filesystem and registry interaction.

Exploitation & Post-Exploitation Techniques

Question

You have compromised a Windows workstation using Metasploit and have injected the Meterpreter payload into the smss process. You want to dump the SAM database of the remote system so you can crack it offline. Which Meterpreter module would you need to load in addition to the defaults so that you can accomplish this?

Options

  • ACore
  • BPriv
  • CStdapi
  • DHashdump

How the community answered

(43 responses)
  • A
    2% (1)
  • B
    12% (5)
  • C
    81% (35)
  • D
    5% (2)

Why each option

Dumping the SAM database through Meterpreter requires the Stdapi extension to provide the necessary system-level API commands for filesystem and registry interaction.

ACore

Core is the base Meterpreter module automatically present that handles transport and channel management, but it provides no system-level commands for accessing the SAM database.

BPriv

Priv adds privilege escalation capabilities and the hashdump command but is not the module the question identifies as the required additional load in this scenario.

CStdapiCorrect

Stdapi (Standard API) is the Meterpreter extension that provides commands for filesystem traversal, registry access, process management, and system interaction - all of which are required to locate and extract the SAM database from the Windows registry. Although Stdapi is often auto-loaded, explicitly loading it ensures access to the full suite of system commands needed to read registry hives like HKLM\SAM. Without Stdapi present, Meterpreter cannot execute the system-level operations required to pull the credential store.

DHashdump

Hashdump is a Meterpreter command or post-exploitation module invoked at the console, not a loadable extension module in the same category as Core, Stdapi, or Priv.

Concept tested: Meterpreter Stdapi extension for SAM database access

Source: https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-advanced-commands.html

Topics

#Meterpreter#SAM database#password dumping#Metasploit modules

Community Discussion

No community discussion yet for this question.

Full GPEN Practice