A tester obtains access to an endpoint subnet and wants to move laterally in the network. Given the following output: Which of the following command and attack methods is the most appropriate for…

Question

Exhibit

Options

• Aresponder -I eth0 -dwv
• Bmsf > use exploit/windows/smb/ms17_010_psexec
• Chydra -L administrator -P /path/topasswdlist smb: //<target>
• Dnmap --script smb-brute.nse -p 445 <target>

• A
  80% (47)
• B
  3% (2)
• C
  5% (3)
• D
  12% (7)

Explanation

Explanation

Option A (Responder) is correct because it is a passive/semi-passive tool that listens for network broadcast protocols (LLMNR, NBT-NS, MDNS) and responds to them to capture credential hashes - it does not actively scan or brute-force targets, making it far less likely to trigger IDS/IPS alerts or account lockouts during lateral movement.

Option B (Metasploit MS17-010/EternalBlue) is wrong because exploiting a known CVE is a noisy, active attack that will almost certainly trigger endpoint detection, antivirus, and network monitoring systems. Option C (Hydra SMB brute-force) is wrong because repeated failed login attempts generate excessive noise, audit log entries, and risk account lockouts - a detection nightmare. Option D (Nmap SMB brute script) is wrong for the same reason: active brute-forcing against port 445 is highly detectable and disruptive.

Memory Tip: Think "passive = stealthy" - Responder waits and listens like a spy, while the other options knock loudly on doors. Whenever a question asks about reducing detection during lateral movement, look for the tool that harvests credentials passively rather than actively attacking.

No community discussion yet for this question.