312-50V10 · Question #669
Which of the following LM hashes represent a password of less than 8 characters? (Select 2)
The correct answer is B. 44EFCE164AB921CQAAD3B435B51404EE E. B757BF5C0D87772FAAD3B435B51404EE. LM hashes with a second half equal to 'AAD3B435B51404EE' indicate the password is 7 characters or fewer, because that constant is the DES encryption result of an all-null 7-byte block.
Question
Which of the following LM hashes represent a password of less than 8 characters? (Select 2)
Options
- ABA810DBA98995F1817306D272A9441BB
- B44EFCE164AB921CQAAD3B435B51404EE
- C0182BD0BD4444BF836077A718CCDF409
- DCEC52EB9C8E3455DC2265B23734E0DAC
- EB757BF5C0D87772FAAD3B435B51404EE
- FE52CAC67419A9A224A3B108F3FA6CB6D
How the community answered
(36 responses)- A3% (1)
- B72% (26)
- C3% (1)
- D17% (6)
- F6% (2)
Why each option
LM hashes with a second half equal to 'AAD3B435B51404EE' indicate the password is 7 characters or fewer, because that constant is the DES encryption result of an all-null 7-byte block.
The hash BA810DBA98995F1817306D272A9441BB does not end with 'AAD3B435B51404EE' as its second half, indicating non-null characters exist in both 7-character blocks and the password is 8 or more characters.
The second 16 hex characters of this hash are 'AAD3B435B51404EE', which is the well-known LM hash value for an empty 7-byte block, confirming the password is fewer than 8 characters. LM splits a password into two 7-character halves, so if the password is 7 or fewer characters the second half is entirely null and always produces this constant hash. Note: the 'Q' character in this hash appears to be a typographic error in the original question.
The hash 0182BD0BD4444BF836077A718CCDF409 has a distinct second half and does not contain the null-block constant 'AAD3B435B51404EE', so the password is not shorter than 8 characters.
The hash CEC52EB9C8E3455DC2265B23734E0DAC does not contain 'AAD3B435B51404EE' in its second half, indicating the password uses characters in both 7-character LM blocks and is therefore 8 or more characters long.
The hash B757BF5C0D87772FAAD3B435B51404EE contains 'AAD3B435B51404EE' as its second 16 hex characters, which is the known constant LM hash for a null 7-byte block, definitively proving the password is fewer than 8 characters. The first half 'B757BF5C0D87772F' represents the actual password characters while the null second half confirms no characters exist in positions 8 through 14.
The hash E52CAC67419A9A224A3B108F3FA6CB6D does not end with 'AAD3B435B51404EE', meaning both halves of the LM split contain non-null data and the password is 8 or more characters.
Concept tested: LM hash null second half identifies passwords under 8 characters
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
Topics
Community Discussion
No community discussion yet for this question.