312-50V10 · Question #77
In cryptanalysis and computer security, 'pass the hash' is a hacking technique that allows an attacker to authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a…
The correct answer is A. LM:NT. The Metasploit psexec module accepts NTLM hashes in LM:NT format, where the LanManager hash comes first followed by the NT hash, separated by a colon.
Question
In cryptanalysis and computer security, 'pass the hash' is a hacking technique that allows an attacker to authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a user's password, instead of requiring the associated plaintext password as is normally the case. Metasploit Framework has a module for this technique: psexec. The psexec module is often used by penetration testers to obtain access to a given system whose credentials are known. It was written by sysinternals and has been integrated within the framework. The penetration testers successfully gain access to a system through some exploit, use meterpreter to grab the passwords or other methods like fgdump, pwdump, or cachedump and then utilize rainbowtables to crack those hash values. Which of the following is true hash type and sort order that is used in the psexec module's 'smbpass' option?
Options
- ALM:NT
- BNTLM:LM
- CNT:LM
- DLM:NTLM
How the community answered
(26 responses)- A81% (21)
- B12% (3)
- C4% (1)
- D4% (1)
Why each option
The Metasploit psexec module accepts NTLM hashes in LM:NT format, where the LanManager hash comes first followed by the NT hash, separated by a colon.
When using pass-the-hash with Metasploit's psexec module, the hash value must be supplied in LM:NT format - the LanManager (LM) hash is provided first, followed by a colon, then the NT hash. Tools like fgdump, pwdump, and cachedump dump credentials in this ordering, making the output directly usable in the module.
NTLM:LM reverses the required field order; the module expects the LM portion first, not the full NTLM label.
NT:LM inverts the correct ordering - NT hash is the second field in the required format, not the first.
LM:NTLM is not the correct token format; the second field label is NT (the raw NT hash), not the compound term NTLM.
Concept tested: Pass-the-hash NTLM credential format in Metasploit
Source: https://attack.mitre.org/techniques/T1550/002/
Topics
Community Discussion
No community discussion yet for this question.