312-50V13 · Question #580
An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that…
The correct answer is C. The Windows system is Vista or a later version, where LM hashes are disabled by default. Blank LM hashes in a Windows SAM file typically indicate that the system is running Windows Vista or a later version where LM hash generation is disabled by default for security reasons.
Question
Options
- AThe SAM file has been encrypted using the SYSKEY function.
- BThe passwords exceeded 14 characters in length and therefore, the LM hashes were set to a
- CThe Windows system is Vista or a later version, where LM hashes are disabled by default.
- DThe Windows system is using the Kerberos authentication protocol as the default method.
How the community answered
(27 responses)- B7% (2)
- C89% (24)
- D4% (1)
Why each option
Blank LM hashes in a Windows SAM file typically indicate that the system is running Windows Vista or a later version where LM hash generation is disabled by default for security reasons.
SYSKEY encrypts the entire SAM database itself, and if active, it would prevent dumping or render the dumped hashes unusable without the SYSKEY, but wouldn't specifically cause LM hashes to be blank while others are present.
While LM hashes have a 14-character limitation, passwords exceeding this length would typically result in a fixed, non-blank LM hash being generated (e.g., 0xaaaaaaaa...) or the OS policy disabling it altogether, but not simply blanking it out without the policy.
Starting with Windows Vista and subsequent operating systems (including Windows Server 2008 and later), LM (LAN Manager) hash generation is disabled by default. This security measure prevents the creation of easily crackable LM hashes, leaving them blank when dumped from the SAM file, which is the most likely reason for their absence.
Kerberos is an authentication protocol, but its use does not directly cause the LM hash to be blank within the SAM file; rather, the operating system's security policy for LM hash generation dictates its presence.
Concept tested: Windows LM hash generation behavior
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change
Topics
Community Discussion
No community discussion yet for this question.