nerdexam
EC-Council

312-50V10 · Question #669

Which of the following LM hashes represent a password of less than 8 characters? (Select 2)

The correct answer is B. 44EFCE164AB921CQAAD3B435B51404EE E. B757BF5C0D87772FAAD3B435B51404EE. LM hashes with a second half equal to 'AAD3B435B51404EE' indicate the password is 7 characters or fewer, because that constant is the DES encryption result of an all-null 7-byte block.

System Hacking

Question

Which of the following LM hashes represent a password of less than 8 characters? (Select 2)

Options

  • ABA810DBA98995F1817306D272A9441BB
  • B44EFCE164AB921CQAAD3B435B51404EE
  • C0182BD0BD4444BF836077A718CCDF409
  • DCEC52EB9C8E3455DC2265B23734E0DAC
  • EB757BF5C0D87772FAAD3B435B51404EE
  • FE52CAC67419A9A224A3B108F3FA6CB6D

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    72% (26)
  • C
    3% (1)
  • D
    17% (6)
  • F
    6% (2)

Why each option

LM hashes with a second half equal to 'AAD3B435B51404EE' indicate the password is 7 characters or fewer, because that constant is the DES encryption result of an all-null 7-byte block.

ABA810DBA98995F1817306D272A9441BB

The hash BA810DBA98995F1817306D272A9441BB does not end with 'AAD3B435B51404EE' as its second half, indicating non-null characters exist in both 7-character blocks and the password is 8 or more characters.

B44EFCE164AB921CQAAD3B435B51404EECorrect

The second 16 hex characters of this hash are 'AAD3B435B51404EE', which is the well-known LM hash value for an empty 7-byte block, confirming the password is fewer than 8 characters. LM splits a password into two 7-character halves, so if the password is 7 or fewer characters the second half is entirely null and always produces this constant hash. Note: the 'Q' character in this hash appears to be a typographic error in the original question.

C0182BD0BD4444BF836077A718CCDF409

The hash 0182BD0BD4444BF836077A718CCDF409 has a distinct second half and does not contain the null-block constant 'AAD3B435B51404EE', so the password is not shorter than 8 characters.

DCEC52EB9C8E3455DC2265B23734E0DAC

The hash CEC52EB9C8E3455DC2265B23734E0DAC does not contain 'AAD3B435B51404EE' in its second half, indicating the password uses characters in both 7-character LM blocks and is therefore 8 or more characters long.

EB757BF5C0D87772FAAD3B435B51404EECorrect

The hash B757BF5C0D87772FAAD3B435B51404EE contains 'AAD3B435B51404EE' as its second 16 hex characters, which is the known constant LM hash for a null 7-byte block, definitively proving the password is fewer than 8 characters. The first half 'B757BF5C0D87772F' represents the actual password characters while the null second half confirms no characters exist in positions 8 through 14.

FE52CAC67419A9A224A3B108F3FA6CB6D

The hash E52CAC67419A9A224A3B108F3FA6CB6D does not end with 'AAD3B435B51404EE', meaning both halves of the LM split contain non-null data and the password is 8 or more characters.

Concept tested: LM hash null second half identifies passwords under 8 characters

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password

Topics

#LM hash structure#password length detection#hash analysis#Windows authentication

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice