CAS-002 · Question #762
An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the penetration tester…
The correct answer is A. Use the pass the hash technique. Pass the hash allows an attacker to authenticate using a captured NTLM hash directly, without cracking the plaintext password or altering any system state.
Question
An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the penetration tester to MOST efficiently use any obtained administrative credentials on the client organization's other systems, without impacting the integrity of any of the systems?
Options
- AUse the pass the hash technique
- BUse rainbow tables to crack the passwords
- CUse the existing access to change the password
- DUse social engineering to obtain the actual password
How the community answered
(37 responses)- A78% (29)
- B5% (2)
- C3% (1)
- D14% (5)
Why each option
Pass the hash allows an attacker to authenticate using a captured NTLM hash directly, without cracking the plaintext password or altering any system state.
The pass-the-hash technique exploits NTLM authentication by replaying a captured password hash to authenticate to other systems, eliminating the need to know the cleartext password. Because no passwords are changed and no system files are modified, the integrity of all systems is preserved while the attacker efficiently reuses administrative credentials across the network.
Rainbow table attacks require significant computational time and may fail against salted or complex hashes, making them less efficient than directly replaying hashes that are already in a usable form.
Changing passwords would directly modify system state and violate the explicit requirement not to impact the integrity of any systems.
Social engineering does not leverage the already-obtained password database and introduces human unpredictability, making it a far less efficient use of the captured credentials.
Concept tested: Pass-the-hash lateral movement using NTLM credential reuse
Source: https://learn.microsoft.com/en-us/defender-for-identity/cas-isp-pass-the-hash
Topics
Community Discussion
No community discussion yet for this question.