After an attacker has successfully gained remote access to a server with minimal privileges, which of the following is their next step?

A.
Elevate system privileges.

B.
Monitor network traffic.

C.
Capture private keys.

D.
Begin key recovery.