312-50V9 · Question #559
What tool can crack Windows SMB passwords simply by listening to network traffic? Select the best answer.
The correct answer is D. L0phtcrack. L0phtCrack is a Windows password auditing tool that passively captures NTLM authentication hashes from SMB network traffic and cracks them offline.
Question
What tool can crack Windows SMB passwords simply by listening to network traffic? Select the best answer.
Options
- AThis is not possible
- BNetbus
- CNTFSDOS
- DL0phtcrack
How the community answered
(49 responses)- A2% (1)
- B8% (4)
- C2% (1)
- D88% (43)
Why each option
L0phtCrack is a Windows password auditing tool that passively captures NTLM authentication hashes from SMB network traffic and cracks them offline.
Capturing and cracking SMB NTLM hashes from network traffic is entirely feasible with tools like L0phtCrack, so the premise that it is impossible is factually incorrect.
Netbus is a remote-access trojan designed for unauthorized remote control of a compromised system and has no password sniffing or hash-cracking functionality.
NTFSDOS is a read-only utility for accessing NTFS volumes from a DOS boot environment and provides no network sniffing or credential cracking capability.
L0phtCrack includes a built-in network sniffer that captures NTLM challenge-response hashes exchanged during SMB authentication sessions, then applies dictionary, hybrid, and brute-force attacks against those hashes to recover plaintext passwords without requiring active access to the target system.
Concept tested: Windows NTLM hash capture and offline password cracking via SMB
Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/ntlm-overview
Topics
Community Discussion
No community discussion yet for this question.