312-50V9 · Question #577
How can you determine if an LM hash you extracted contains a password that is less than 8 characters long?
The correct answer is B. The right most portion of the hash is always the same. LM hashes split a password into two 7-character halves and hash each independently. A password shorter than 8 characters leaves the second half empty, always producing the same hash value for that right portion.
Question
How can you determine if an LM hash you extracted contains a password that is less than 8 characters long?
Options
- AThere is no way to tell because a hash cannot be reversed
- BThe right most portion of the hash is always the same
- CThe hash always starts with AB923D
- DThe left most portion of the hash is always the same
- EA portion of the hash will be all 0's
How the community answered
(32 responses)- A6% (2)
- B91% (29)
- E3% (1)
Why each option
LM hashes split a password into two 7-character halves and hash each independently. A password shorter than 8 characters leaves the second half empty, always producing the same hash value for that right portion.
While hashes are one-way functions, the structural properties of LM hash (fixed right half for short passwords) do reveal information about password length without reversing the hash.
LM hashing divides the password into two 7-character chunks and encrypts each separately with DES. If the password is 7 characters or fewer, the second chunk is null-padded, and DES encryption of 7 null bytes always yields the constant value AAD3B435B51404EE. Recognizing this fixed right-half value immediately signals the password is under 8 characters.
LM hashes have no fixed prefix like AB923D - the left portion varies based on the actual first 7 characters of the password.
It is the right-most portion, not the left-most, that stays constant, because the left half is derived from the actual password characters and will differ per password.
The right half is not all zeros - it is a specific constant ciphertext value (AAD3B435B51404EE) resulting from DES encrypting seven null bytes.
Concept tested: LM hash structure revealing password length
Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview
Topics
Community Discussion
No community discussion yet for this question.