nerdexam
GIAC

GPEN · Question #399

Which of the following describe the benefits to a pass-the-hash attack over traditional password cracking?

The correct answer is D. No account lockout, use of native file and print sharing tools on the compromisedsystem and. Pass-the-hash authenticates using a captured NTLM hash without cracking the plaintext password, avoiding account lockout and enabling use of native Windows sharing tools.

Exploitation & Post-Exploitation Techniques

Question

Which of the following describe the benefits to a pass-the-hash attack over traditional password cracking?

Options

  • ANo triggering of IDS signatures from the attack privileges at the level of theacquired password
  • BNo triggering of IDS signatures from the attack, no account lockout and use ofnative windows
  • CNo account lockout, privileges at the level of the acquired password hash and useof native
  • DNo account lockout, use of native file and print sharing tools on the compromisedsystem and

How the community answered

(33 responses)
  • A
    6% (2)
  • B
    3% (1)
  • C
    6% (2)
  • D
    85% (28)

Why each option

Pass-the-hash authenticates using a captured NTLM hash without cracking the plaintext password, avoiding account lockout and enabling use of native Windows sharing tools.

ANo triggering of IDS signatures from the attack privileges at the level of theacquired password

Pass-the-hash does not guarantee no IDS triggering - modern SIEM and IDS solutions can detect anomalous NTLM lateral movement patterns even when valid hashes are used.

BNo triggering of IDS signatures from the attack, no account lockout and use ofnative windows

This option incorrectly asserts no IDS signatures are triggered; behavioral analytics and event log monitoring can and do flag pass-the-hash activity in modern environments.

CNo account lockout, privileges at the level of the acquired password hash and useof native

This option omits the key benefit of using native Windows file and print sharing tools, which is central to why pass-the-hash is stealthier and more practical than traditional password cracking.

DNo account lockout, use of native file and print sharing tools on the compromisedsystem andCorrect

Pass-the-hash replays the captured NTLM password hash directly to the authentication service, so the account is never locked out because the system receives what it considers a valid credential. It also enables use of native Windows file and print sharing tools (SMB/CIFS) that natively speak NTLM, meaning the attacker needs no additional exploit tooling and blends into normal network traffic patterns.

Concept tested: Pass-the-hash NTLM attack benefits over cracking

Source: https://learn.microsoft.com/en-us/defender-for-identity/lateral-movement-alerts

Topics

#pass-the-hash#NTLM authentication#credential attacks#IDS evasion

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice