nerdexam
EC-Council

312-50V12 · Question #160

An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that…

The correct answer is C. The Windows system is Vista or a later version, where LM hashes are disabled by default. The ethical hacker observed blank LM hashes because Windows Vista and later versions disable LM hashing by default, a security measure to prevent the storage of easily crackable hashes. This default configuration stores dummy values instead of actual LM hashes, making them…

Submitted by rachelw· Mar 4, 2026System Hacking Phases and Attack Techniques

Question

An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?

Options

  • AThe SAM file has been encrypted using the SYSKEY function.
  • BThe passwords exceeded 14 characters in length and therefore, the LM hashes were set to a
  • CThe Windows system is Vista or a later version, where LM hashes are disabled by default.
  • DThe Windows system is using the Kerberos authentication protocol as the default method.

How the community answered

(28 responses)
  • A
    11% (3)
  • B
    7% (2)
  • C
    79% (22)
  • D
    4% (1)

Why each option

The ethical hacker observed blank LM hashes because Windows Vista and later versions disable LM hashing by default, a security measure to prevent the storage of easily crackable hashes. This default configuration stores dummy values instead of actual LM hashes, making them appear blank.

AThe SAM file has been encrypted using the SYSKEY function.

SYSKEY encrypts the entire SAM database, and if enabled, would prevent successful dumping or access to any readable hash data, not just specific blank LM hashes.

BThe passwords exceeded 14 characters in length and therefore, the LM hashes were set to a

Passwords exceeding 14 characters *result* in a blank LM hash for *that specific password*, but this is not a system-wide default that would cause *all* LM hashes to be blank regardless of password length.

CThe Windows system is Vista or a later version, where LM hashes are disabled by default.Correct

Starting with Windows Vista and Windows Server 2008, LM hashing is disabled by default to mitigate security risks associated with its weak cryptographic design. When this feature is disabled, the operating system no longer generates actual LM hashes for user passwords, instead storing a dummy or null hash value (e.g., AAD3B435B51404EEAAD3B435B51404EE) in the SAM file. This prevents rainbow table attacks against the easily crackable LM hash, making them appear blank to an attacker.

DThe Windows system is using the Kerberos authentication protocol as the default method.

Kerberos is an authentication protocol primarily used in domain environments and does not directly cause LM hashes to be disabled or blanked in the local SAM file.

Concept tested: Windows LM hash disabling and security defaults

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change

Topics

#NTLM hashes#LM hashes#password cracking#Windows security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice