312-50V10 · Question #664
A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniff the SMB exchanges which carry user logons. The user is plugged into a hub with 23 other systems. However, he is u
The correct answer is B. Kerberos is preventing it.. Windows 2000 uses Kerberos v5 as the default domain authentication protocol, which relies on tickets rather than transmittable password hashes, preventing L0phtcrack from capturing usable credential exchanges.
Question
A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniff the SMB exchanges which carry user logons. The user is plugged into a hub with 23 other systems. However, he is unable to capture any logons though he knows that other users are logging in. What do you think is the most likely reason behind this?
Options
- AThere is a NIDS present on that segment.
- BKerberos is preventing it.
- CWindows logons cannot be sniffed.
- DL0phtcrack only sniffs logons to web servers.
How the community answered
(48 responses)- A6% (3)
- B79% (38)
- C10% (5)
- D4% (2)
Why each option
Windows 2000 uses Kerberos v5 as the default domain authentication protocol, which relies on tickets rather than transmittable password hashes, preventing L0phtcrack from capturing usable credential exchanges.
A NIDS monitors and generates alerts on suspicious traffic but does not block packet capture or prevent a host on the same hub segment from receiving broadcast frames.
Windows 2000 introduced Kerberos v5 as the default protocol for domain authentication, replacing the older NTLM and LM challenge-response mechanisms that L0phtcrack is designed to capture. Kerberos authentication uses encrypted tickets (TGTs and service tickets) issued by the Key Distribution Center - password hashes are never transmitted directly across the network, so L0phtcrack finds no SMB credential exchanges to capture and crack.
Windows logons can be sniffed when the system falls back to NTLM or LM authentication - this claim is factually incorrect for non-Kerberos environments.
L0phtcrack is specifically built to capture and crack SMB-based NTLM/LM authentication exchanges, not web server logons.
Concept tested: Kerberos authentication preventing NTLM credential sniffing
Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Topics
Community Discussion
No community discussion yet for this question.