nerdexam
EC-Council

312-50V9 · Question #559

What tool can crack Windows SMB passwords simply by listening to network traffic? Select the best answer.

The correct answer is D. L0phtcrack. L0phtCrack is a Windows password auditing tool that passively captures NTLM authentication hashes from SMB network traffic and cracks them offline.

System Hacking

Question

What tool can crack Windows SMB passwords simply by listening to network traffic? Select the best answer.

Options

  • AThis is not possible
  • BNetbus
  • CNTFSDOS
  • DL0phtcrack

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    8% (4)
  • C
    2% (1)
  • D
    88% (43)

Why each option

L0phtCrack is a Windows password auditing tool that passively captures NTLM authentication hashes from SMB network traffic and cracks them offline.

AThis is not possible

Capturing and cracking SMB NTLM hashes from network traffic is entirely feasible with tools like L0phtCrack, so the premise that it is impossible is factually incorrect.

BNetbus

Netbus is a remote-access trojan designed for unauthorized remote control of a compromised system and has no password sniffing or hash-cracking functionality.

CNTFSDOS

NTFSDOS is a read-only utility for accessing NTFS volumes from a DOS boot environment and provides no network sniffing or credential cracking capability.

DL0phtcrackCorrect

L0phtCrack includes a built-in network sniffer that captures NTLM challenge-response hashes exchanged during SMB authentication sessions, then applies dictionary, hybrid, and brute-force attacks against those hashes to recover plaintext passwords without requiring active access to the target system.

Concept tested: Windows NTLM hash capture and offline password cracking via SMB

Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/ntlm-overview

Topics

#L0phtcrack#password cracking#SMB#network sniffing

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice