CEH Vulnerability Analysis and System Hacking Practice Question

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

⚠ Common exam trap

Watch out — candidates often assume Administrator privileges alone are sufficient to read the SAM file, overlooking the fact that Windows locks the file even for administrators, and that VSS is the required bypass.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a Volume Shadow Copy to access SAM file

On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Run the tool as Administrator
Why it's wrong here
While Administrator privileges are essential for many system operations, they are insufficient to directly access the Security Account Manager (SAM) database file (typically C:\Windows\System32\config\SAM) when the Windows operating system is running. The OS maintains an exclusive lock on the SAM file to prevent corruption and ensure the integrity of user authentication data. Even an administrator cannot bypass this file lock without employing specific techniques that interact with the OS's file management or snapshot capabilities.
✗
Use reg.exe save to export SAM hive
Why it's wrong here
The reg.exe save command is designed to export a registry hive to a file. However, when the Windows operating system is active, the SAM hive (which contains the SAM database) is continuously in use and locked by the kernel. Attempting to use reg save HKLM\SAM C:\sam.hiv will typically result in an "Access Denied" error, even with administrative privileges, because the command cannot overcome the exclusive file lock imposed by the operating system on a live, in-use hive.
✓
Create a Volume Shadow Copy to access SAM file
Why this is correct
Creating a Volume Shadow Copy (VSS) is the most effective and commonly used method to access the SAM file while the operating system is running. VSS creates a point-in-time, read-only snapshot of the entire volume, including files that are currently locked by the OS. This snapshot allows the penetration tester to access a consistent version of the SAM file from the shadow copy, effectively bypassing the exclusive lock maintained by the live operating system without interrupting its operations.
✗
Enable SeDebugPrivilege for the current process
Why it's wrong here
Enabling SeDebugPrivilege grants a process the ability to debug other processes, including system processes, and to read or modify their memory. While this privilege is crucial for techniques like process injection, memory dumping, or interacting with other running applications, it does not provide any mechanism to bypass file system locks. The SeDebugPrivilege operates at the process level, not the file system level, and therefore has no direct impact on the operating system's exclusive lock on the SAM database file.

Go deeper

CEH Vulnerability Analysis and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question