Question

During a post-exploitation phase, you have SYSTEM-level access on a domain-joined Windows workstation that is currently disconnected from the corporate network. The domain controller is unreachable, so you cannot perform an LSASS dump against a live authentication session or query the DC directly. You want to recover domain credentials for lateral movement once connectivity is restored. Which technique is MOST appropriate given these constraints?

Accepted Answer

Extract cached domain logon hashes (MSCACHEv2/DCC2) from the SECURITY registry hive and crack them offline

Answer

Perform a DCSync attack to replicate credential material from the domain controller

Answer

Run Responder to poison LLMNR/NBT-NS and capture NetNTLMv2 hashes from other hosts

Answer

Use pass-the-hash with the local Administrator hash to authenticate directly to the domain controller