John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack…

Question

Options

• AThe SID of Hillary network account
• BThe SAM file from Hillary computer
• CThe network shares that Hillary has permissions
• DHillary network username and password hash

• A
  7% (2)
• B
  10% (3)
• C
  3% (1)
• D
  80% (24)

Explanation

LOphtCrack (L0phtCrack) is a password auditing and cracking tool that, when placed in network sniffing mode, captures NTLM challenge-response authentication packets traveling across the network. The attack works as follows: John sends Hillary an email containing a link that points to a UNC path on a server John controls (e.g., \attacker-server\share). When Hillary's Windows workstation attempts to access that path, it automatically initiates an NTLM authentication handshake, sending her network username and NTLM password hash over the network. LOphtCrack captures this exchange, giving John Hillary's username and hashed password. The hash can then be cracked offline using dictionary or brute-force methods. This is a classic NTLM relay/capture attack. It does not directly reveal the SAM file (B), her SID (A), or her file share permissions (C).

No community discussion yet for this question.