PT0-002 · Question #441
A penetration tester captures SMB network traffic and discovers that users are mistyping the name of a fileshare server. This causes the workstations to send out requests attempting to resolve the…
The correct answer is D. Respond to the requests with the tester's IP address and steal authentication credentials. In the scenario where users are mistyping the name of a fileshare server, leading to broadcast requests, the most effective exploitation strategy would be for the penetration tester to respond to these requests with their own IP address (D) and set up a service to capture…
Question
A penetration tester captures SMB network traffic and discovers that users are mistyping the name of a fileshare server. This causes the workstations to send out requests attempting to resolve the fileshare server's name. Which of the following is the best way for a penetration tester to exploit this situation?
Options
- ARelay the traffic to the real file server and steal documents as they pass through.
- BHost a malicious file to compromise the workstation.
- CReply to the broadcasts with a fake IP address to deny access to the real file server.
- DRespond to the requests with the tester's IP address and steal authentication credentials.
How the community answered
(27 responses)- A7% (2)
- B15% (4)
- C7% (2)
- D70% (19)
Explanation
In the scenario where users are mistyping the name of a fileshare server, leading to broadcast requests, the most effective exploitation strategy would be for the penetration tester to respond to these requests with their own IP address (D) and set up a service to capture authentication credentials. This technique is known as a "Man-in-the-Middle" (MitM) attack, where the attacker intercepts communication between two parties. In this case, the tester can exploit the misdirected requests to potentially capture sensitive information such as usernames and passwords.
Topics
Community Discussion
No community discussion yet for this question.