312-50V11 · Question #669
Which of the following LM hashes represent a password of less than 8 characters? (Select 2)
The correct answer is B. 44EFCE164AB921CQAAD3B435B51404EE E. B757BF5C0D87772FAAD3B435B51404EE. LM hashes split a password into two 7-character halves; if the password is 7 characters or fewer, the second half is all null bytes, producing the constant sentinel value AAD3B435B51404EE in the second 16 hex characters of the hash.
Question
Which of the following LM hashes represent a password of less than 8 characters? (Select 2)
Options
- ABA810DBA98995F1817306D272A9441BB
- B44EFCE164AB921CQAAD3B435B51404EE
- C0182BD0BD4444BF836077A718CCDF409
- DCEC52EB9C8E3455DC2265B23734E0DAC
- EB757BF5C0D87772FAAD3B435B51404EE
- FE52CAC67419A9A224A3B108F3FA6CB6D
How the community answered
(28 responses)- A4% (1)
- B71% (20)
- C4% (1)
- D14% (4)
- F7% (2)
Why each option
LM hashes split a password into two 7-character halves; if the password is 7 characters or fewer, the second half is all null bytes, producing the constant sentinel value AAD3B435B51404EE in the second 16 hex characters of the hash.
BA810DBA98995F1817306D272A9441BB does not contain AAD3B435B51404EE as its second 16-character segment, indicating both 7-character halves held real password characters and the password is 8 or more characters long.
Choice B ends with AAD3B435B51404EE, which is the well-known LM hash of seven null bytes, proving the password's second half was entirely null-padded and therefore the password is 7 characters or fewer. The 'Q' character visible in the displayed string is a transcription artifact and does not affect identification of the sentinel suffix.
0182BD0BD4444BF836077A718CCDF409 does not end with the null-padding sentinel, meaning the second block represents actual password characters rather than padding.
CEC52EB9C8E3455DC2265B23734E0DAC does not contain AAD3B435B51404EE as its second half, so the password is at least 8 characters.
Choice E also ends with AAD3B435B51404EE, confirming the same condition - the password is 7 characters or fewer because the second 7-character chunk was padded entirely with null bytes before DES hashing.
E52CAC67419A9A224A3B108F3FA6CB6D does not end with AAD3B435B51404EE, confirming both halves were populated and the password is 8 or more characters.
Concept tested: LM hash null padding sentinel for short passwords
Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview
Topics
Community Discussion
No community discussion yet for this question.