nerdexam
GIAC

GPEN · Question #250

LM hash is one of the password schemes that Microsoft LAN Manager and Microsoft Windows versions prior to the Windows Vista use to store user passwords that are less than 15 characters long. If you pr

The correct answer is A. 0xAAD3B435B51404EE. The LM hash algorithm splits a password into two 7-character halves; when the password is 7 characters or fewer, the second half is all null bytes, which always hashes to the fixed value 0xAAD3B435B51404EE.

Exploitation & Post-Exploitation Techniques

Question

LM hash is one of the password schemes that Microsoft LAN Manager and Microsoft Windows versions prior to the Windows Vista use to store user passwords that are less than 15 characters long. If you provide a password seven characters or less, the second half of the LM hash is always __________.

Options

  • A0xAAD3B435B51404EE
  • B0xBBD3B435B51504FF
  • C0xBBC3C435C51504EF
  • D0xAAD3B435B51404FF

How the community answered

(69 responses)
  • A
    72% (50)
  • B
    14% (10)
  • C
    10% (7)
  • D
    3% (2)

Why each option

The LM hash algorithm splits a password into two 7-character halves; when the password is 7 characters or fewer, the second half is all null bytes, which always hashes to the fixed value 0xAAD3B435B51404EE.

A0xAAD3B435B51404EECorrect

LM hashing pads the password to 14 characters, then splits it into two 7-character chunks, each hashed independently using DES. When the original password is 7 characters or fewer, the second 7-byte chunk is entirely null bytes (0x00000000000000), and DES encryption of that constant null value with the fixed LM key always produces 0xAAD3B435B51404EE. This predictable constant makes LM hashes trivially identifiable and exploitable.

B0xBBD3B435B51504FF

0xBBD3B435B51504FF is not a value produced by any LM hash operation and does not correspond to the DES encryption of a null 7-byte block.

C0xBBC3C435C51504EF

0xBBC3C435C51504EF is also a fabricated value that does not match any known LM hash output for null or empty password halves.

D0xAAD3B435B51404FF

0xAAD3B435B51404FF differs from the correct answer only in the last byte (FF vs EE) and is not the actual DES output for the null 7-byte padding block.

Concept tested: LM hash weakness with short passwords

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change

Topics

#LM hash#password hashing#Windows authentication#hash analysis

Community Discussion

No community discussion yet for this question.

Full GPEN Practice