Replay a credential between two machines you built

short · 60 min · Objective 4.2

Task

Build two lab machines sharing a local administrator password, obtain the stored credential material from one, and authenticate to the other without ever knowing the password — then watch how normal the second machine's logs look. Once you see it, the enterprise designs built to stop it make sense.

Steps

  1. On the lab you own, build two disposable VMs that share a local administrator password you set, and snapshot both.
  2. Compromise the first by any route you already have — you have one from the service-exploitation lab.
  3. Obtain the stored credential material for that shared account on the first machine.
  4. Authenticate to the second machine using that material, without typing the password.
  5. Read the second machine's authentication logs and note that the logon looks like a normal successful authentication — there is no "invalid credential" event, because the credential was valid.
  6. Change one variable — give the machines different local passwords — and confirm the replay stops working. Revert snapshots after.

Verify

grep -ciE "logon|authenticated|success" /tmp/second-machine.log
grep -ciE "invalid|failed" /tmp/second-machine.log
grep -ciE "different password|no longer|stopped|unique" /tmp/fix-result.md

The first count must be non-zero: the replayed logon appears as a successful authentication on the second machine. The second should be low or zero for the replay itself: there is no failure event, which is why this is hard to detect. The third must be non-zero: you demonstrated the fix — unique per-machine passwords stop it — which turns the exercise into a finding with a recommendation.

Notes

If a protocol authenticates with the hash, the hash IS the credential — no cracking required. A shared local administrator password across machines is the most productive version of this finding. Credentials flow downhill: using a powerful account on a weak machine exposes it, which is the argument for tiering. Longer passwords and rotation do not stop it; unique per-machine passwords do. Both machines here are ones you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.