nerdexam
EC-Council

312-50V9 · Question #571

Which of the following LM hashes represent a password of less than 8 characters? (Select 2)

The correct answer is B. 44EFCE164AB921CQAAD3B435B51404EE E. B757BF5C0D87772FAAD3B435B51404EE. When an LM hash second half equals AAD3B435B51404EE, it indicates the second 7-character password segment was entirely null, meaning the password was 7 characters or fewer (less than 8). Both B and E contain this known-null second half.

System Hacking

Question

Which of the following LM hashes represent a password of less than 8 characters? (Select 2)

Options

  • ABA810DBA98995F1817306D272A9441BB
  • B44EFCE164AB921CQAAD3B435B51404EE
  • C0182BD0BD4444BF836077A718CCDF409
  • DCEC52EB9C8E3455DC2265B23734E0DAC
  • EB757BF5C0D87772FAAD3B435B51404EE
  • FE52CAC67419A9A224A3B108F3FA6CB6D

How the community answered

(30 responses)
  • A
    3% (1)
  • B
    73% (22)
  • C
    13% (4)
  • D
    3% (1)
  • F
    7% (2)

Why each option

When an LM hash second half equals AAD3B435B51404EE, it indicates the second 7-character password segment was entirely null, meaning the password was 7 characters or fewer (less than 8). Both B and E contain this known-null second half.

ABA810DBA98995F1817306D272A9441BB

Choice A has a non-null second half (98995F1817306D272...) indicating both 7-character halves contained actual password characters, meaning the password is 8-14 characters long.

B44EFCE164AB921CQAAD3B435B51404EECorrect

Choice B ends with AAD3B435B51404EE, which is the well-known LM hash value produced when DES encrypts the constant 'KGS!@#$%' using a key of seven null bytes - indicating the password's second half was empty and therefore the password is 7 characters or fewer.

C0182BD0BD4444BF836077A718CCDF409

Choice C has a unique, non-null second half, indicating the password is at least 8 characters with content in both halves.

DCEC52EB9C8E3455DC2265B23734E0DAC

Choice D's second half is not AAD3B435B51404EE, so the password has content in both halves and is 8 or more characters in length.

EB757BF5C0D87772FAAD3B435B51404EECorrect

Choice E (B757BF5C0D87772FAAD3B435B51404EE) also terminates with AAD3B435B51404EE for the same reason - the second 7-character block of the password was null-padded, confirming the password length is less than 8 characters.

FE52CAC67419A9A224A3B108F3FA6CB6D

Choice F ends with E52CAC67419A9A224A3B108F3FA6CB6D - neither half matches the null-second-half signature, indicating a password of 8 or more characters.

Concept tested: LM hash null second-half signature for short passwords

Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc736842(v=ws.10)

Topics

#LM hash structure#password length detection#Windows authentication#hash analysis

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice