CEH Social Engineering and Physical Security Practice Question

Exhibit

Refer to the exhibit.

Exhibit:
C:\Users\jdoe> net user jdoe /domain
The request will be processed at a domain controller for domain corp.xyz.com.

User name                    jdoe
Full Name                    John Doe
Comment
User's comment
Country code                 001 (United States)
Account active               Yes
Account expires              Never

Password last set            6/15/2024 9:30:00 AM
Password expires             9/13/2024 9:30:00 AM
Password changeable          6/16/2024 9:30:00 AM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script                 logon.bat
User profile
Home directory               \\fileserver\home\jdoe
Last logon                   7/10/2024 2:15:00 PM

Logon hours allowed          All

Local Group Memberships      *Domain Users
Global Group memberships     *Domain Users
The command completed successfully.

Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?

⚠ Common exam trap

EC-Council often tests the misconception that credentials are always stored in system databases like NTDS.dit or SAM, but the trap here is that attackers target easily accessible, plaintext files like logon scripts that users or administrators create for convenience.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

logon.bat script

Logon.bat scripts are commonly used in Windows environments to map network drives or perform startup tasks, and administrators often embed plaintext credentials in such scripts for automation. An attacker who compromises the workstation can read this batch file to extract stored passwords, making it a high-value target for credential theft.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
User profile (C:\Users\jdoe)
Why it's wrong here
Gaining access to the user profile folder, such as C:\Users\jdoe, provides access to a collection of user-specific files and settings, including documents, desktop items, and application data. However, the profile *folder itself* is a container, not a specific file directly holding credentials in a readily exploitable format like a script. While sensitive information might reside within subfolders, the profile as a whole isn't the most direct answer for an attacker seeking immediate credential compromise in the context of a specific exploitable artifact.
✗
Home directory on \\fileserver\home\jdoe
Why it's wrong here
A user's home directory, typically a network share like \\fileserver\home\jdoe, serves as a centralized storage location for personal files and documents. Similar to a local user profile, this is a network *location* or *container*, not a specific executable file or database inherently designed to store credentials for other resources. While an attacker might find sensitive documents or configuration files within it, the home directory itself is not the direct source of credentials in the same manner a logon script might be.
✓
logon.bat script
Why this is correct
A logon.bat script is a specific executable file often configured to run automatically when a user logs onto a domain-joined machine. These scripts are frequently used to map network drives, configure printers, or execute other setup tasks, and unfortunately, they sometimes contain hardcoded usernames and passwords for network resources. An attacker gaining access to this script can directly read these embedded credentials, making it a prime target for credential harvesting and subsequent lateral movement within the network.
✗
Active Directory database (NTDS.dit)
Why it's wrong here
The NTDS.dit file is the core database of Active Directory, containing all domain objects, including user accounts and their NTLM password hashes. This critical file resides exclusively on a Domain Controller (DC), not on a standard user's workstation. Therefore, an attacker who has only gained access to a user's local machine would not directly find or extract the NTDS.dit file from that workstation, making it an incorrect answer for a scenario focused on local user machine compromise.

Go deeper

CEH Social Engineering and Physical Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question