GPEN · Question #419
You have compromised a Windows workstation using Metasploit and have injected the Meterpreter payload into the smss process. You want to dump the SAM database of the remote system so you can crack…
The correct answer is C. Stdapi. Dumping the SAM database through Meterpreter requires the Stdapi extension to provide the necessary system-level API commands for filesystem and registry interaction.
Question
You have compromised a Windows workstation using Metasploit and have injected the Meterpreter payload into the smss process. You want to dump the SAM database of the remote system so you can crack it offline. Which Meterpreter module would you need to load in addition to the defaults so that you can accomplish this?
Options
- ACore
- BPriv
- CStdapi
- DHashdump
How the community answered
(43 responses)- A2% (1)
- B12% (5)
- C81% (35)
- D5% (2)
Why each option
Dumping the SAM database through Meterpreter requires the Stdapi extension to provide the necessary system-level API commands for filesystem and registry interaction.
Core is the base Meterpreter module automatically present that handles transport and channel management, but it provides no system-level commands for accessing the SAM database.
Priv adds privilege escalation capabilities and the hashdump command but is not the module the question identifies as the required additional load in this scenario.
Stdapi (Standard API) is the Meterpreter extension that provides commands for filesystem traversal, registry access, process management, and system interaction - all of which are required to locate and extract the SAM database from the Windows registry. Although Stdapi is often auto-loaded, explicitly loading it ensures access to the full suite of system commands needed to read registry hives like HKLM\SAM. Without Stdapi present, Meterpreter cannot execute the system-level operations required to pull the credential store.
Hashdump is a Meterpreter command or post-exploitation module invoked at the console, not a loadable extension module in the same category as Core, Stdapi, or Priv.
Concept tested: Meterpreter Stdapi extension for SAM database access
Source: https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-advanced-commands.html
Topics
Community Discussion
No community discussion yet for this question.