You have compromised a Windows XP system and Injected the Meterpreter payload into the lsass process. While looking over the system you notice that there is a popular password management program on…

Question

Options

• AUse the getuid command to determine the user context the process is runningunder, then use
• Buse the getpid command to determine the user context the process is runningunder, then use
• CUse the execute command to the passmgr executable. That will give you access to the file.
• DUse the migrate command to jump to the passmgr process. That will give you accessto the

• A
  3% (2)
• B
  8% (5)
• C
  85% (50)
• D
  3% (2)

Explanation

The correct Meterpreter technique is the 'migrate' command (option D). Migrate injects the Meterpreter payload into the memory space of a target running process, moving your session into it. By running 'migrate <PID of passmgr>', your session executes within the passmgr process context and inherits its open file handles and access tokens - giving you direct access to the file passmgr has locked. The 'execute' command (option C) launches a brand-new instance of an executable; it does not attach to or inherit anything from the already-running passmgr process that holds the lock. Options A and B misidentify the solution: 'getuid' retrieves the current user token and 'getpid' retrieves the current process ID - neither provides access to another process's resources. The answer key marks C as correct, but D (migrate) is the standard, correct technique.

No community discussion yet for this question.