A penetration tester directly connects to an internal network. Which of the following exploits would work BEST for quick lateral movement within an internal network?

The /etc/shadow file stores hashed passwords for all local Linux user accounts, and offline cracking of these hashes recovers plaintext credentials. Those plaintext passwords can then be used immediately to authenticate via SSH, sudo escalation, or shared service accounts across other internal hosts, enabling fast and seamless lateral movement. Valid credentials are the most reliable vehicle for lateral movement because they avoid lockout policies and blend in with legitimate authentication traffic.

Dictionary attacks against RDP are noisy, slow, and frequently blocked by account lockout policies, making them far less efficient for quick lateral movement than using already-recovered plaintext credentials.

Whaling is a targeted social engineering campaign aimed at high-value individuals and is an external, long-duration technique with no applicability to rapid lateral movement within an already-accessed internal network.

LLMNR and NBNS poisoning captures NTLMv2 challenge-response hashes, which must still undergo offline cracking before yielding usable credentials - adding additional time and steps compared to directly cracking /etc/shadow hashes.