PT0-001 · Question #240
A penetration tester successfully exploits a system, receiving a reverse shell. Which of the following is a Meterpreter command that is used to harvest locally stored credentials?
The correct answer is B. hashdump. The Meterpreter post-exploitation framework provides the 'hashdump' command to extract NTLM password hashes from a compromised Windows system's SAM database.
Question
A penetration tester successfully exploits a system, receiving a reverse shell. Which of the following is a Meterpreter command that is used to harvest locally stored credentials?
Options
- Abackground
- Bhashdump
- Csession
- Dgetuid
- Epsexec
How the community answered
(25 responses)- B92% (23)
- D4% (1)
- E4% (1)
Why each option
The Meterpreter post-exploitation framework provides the 'hashdump' command to extract NTLM password hashes from a compromised Windows system's SAM database.
The 'background' command suspends the active Meterpreter session and returns to the Metasploit console without interacting with credentials.
The 'hashdump' command in Meterpreter reads the Security Account Manager (SAM) database on a Windows target and dumps NTLM/LM password hashes for all local accounts. These hashes can then be used for offline cracking or pass-the-hash attacks. It is the standard Meterpreter command specifically designed for local credential harvesting.
'session' (or 'sessions') is a Metasploit console command used to list or switch between active sessions, not to harvest credentials.
'getuid' returns the username of the current process context on the target, which is informational only and does not extract stored credentials.
'psexec' is a Metasploit exploit module used for lateral movement via SMB, not a Meterpreter session command for credential harvesting.
Concept tested: Meterpreter post-exploitation credential harvesting
Source: https://docs.metasploit.com/docs/using-metasploit/basics/using-meterpreter.html
Topics
Community Discussion
No community discussion yet for this question.