nerdexam
EC-Council

312-50V9 · Question #295

In cryptanalysis and computer security, 'pass the hash' is a hacking technique that allows an attacker to authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a…

The correct answer is B. LM:NT. In pass-the-hash attacks using Metasploit's psexec module, credential dumping tools output Windows password hashes in LM:NT format, where the LM hash precedes the NT hash separated by a colon.

System Hacking

Question

In cryptanalysis and computer security, 'pass the hash' is a hacking technique that allows an attacker to authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a user's password, instead of requiring the associated plaintext password as is normally the case. Metasploit Framework has a module for this technique: psexec. The psexec module is often used by penetration testers to obtain access to a given system that you already know the credentials for. It was written by sysinternals and has been integrated within the framework. Often as penetration testers, successfully gain access to a system through some exploit, use meterpreter to grab the passwords or other methods like fgdump, pwdump, or cachedump and then utilize rainbowtables to crack those hash values. Which of the following is true hash type and sort order that is using in the psexec module's 'smbpass'?

Options

  • ANT:LM
  • BLM:NT
  • CLM:NTLM
  • DNTLM:LM

How the community answered

(33 responses)
  • A
    9% (3)
  • B
    82% (27)
  • C
    3% (1)
  • D
    6% (2)

Why each option

In pass-the-hash attacks using Metasploit's psexec module, credential dumping tools output Windows password hashes in LM:NT format, where the LM hash precedes the NT hash separated by a colon.

ANT:LM

This reverses the correct order - the LM hash must come before the NT hash, not after it.

BLM:NTCorrect

Tools such as pwdump, fgdump, and cachedump output hashes in LM:NT order, placing the LM hash first followed by the NT hash. The Metasploit psexec module expects this exact LM:NT format when performing pass-the-hash authentication. Providing hashes in any other order or format will cause the authentication attempt to fail.

CLM:NTLM

NTLM is the name of the authentication protocol, not the identifier for the hash component; the individual hash is called the NT hash.

DNTLM:LM

This incorrectly uses the protocol name NTLM as the first component and also reverses the correct LM:NT ordering.

Concept tested: Pass-the-hash NTLM credential format and usage

Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/ntlm-overview

Topics

#pass the hash#NTLM#LM hash#Metasploit psexec

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice