During a penetration test, a tester runs a phishing campaign and receives a shell from an internal PC running Windows 10 OS. The tester wants to perform credential harvesting with Mimikazt. Which of…

Question

Options

• Areg add HKLM\System\ControlSet002\Control\SecurityProviders\WDigest /v userLogoCredential
• Breg add HKCU\System\CurrentControlSet\Control\SecurityProviders\WDigest /v
• Creg add HKLM\Software\CurrentControlSet\Control\SecurityProviders\WDigest /v
• Dreg add HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest /v

• A
  15% (6)
• B
  3% (1)
• C
  8% (3)
• D
  75% (30)

Explanation

Using reg add adds a new subkey or entry into the registry. The syntax is as follows: reg add <KeyName> /v <ValueName> /t <DataType> /d <Data> KeyName specifies the full path of the subkey or entry to be added. /v <ValueName> specifies the name of the registry entry to be added under the specified subkey. /t <DataType> specifies the type for the registry entry. /d <Data> specifies the data for the new registry entry. Penetration testers often focus on using the easiest attack vector to achieve their objectives. One common attack method is a tool called Mimikatz. It can steal cleartext credentials from the memory of compromised Windows systems. When the WDigest Authentication protocol is enabled, plaintext passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows 10.

No community discussion yet for this question.