GPEN · Question #466
A pen tester is able to pull credential information from memory on a Windows system. Based on the command and output below, what advantage does this technique give a penetration tester when trying to
The correct answer is A. The technique is more effective through perimeter firewalls than otherauthentication attacks.. Extracting NTLM hashes from Windows memory enables pass-the-hash attacks over standard Windows authentication protocols, which perimeter firewalls commonly permit as legitimate traffic.
Question
A pen tester is able to pull credential information from memory on a Windows system. Based on the command and output below, what advantage does this technique give a penetration tester when trying to access another windows system on the network?
Exhibit
Options
- AThe technique is more effective through perimeter firewalls than otherauthentication attacks.
- BIt allows the tester to escalate the privilege level of the account,
- CAccess to the system can be gained without password guessing or cracking.
- DSalts are removed from the hashes to allow for faster, offline cracking
How the community answered
(24 responses)- A75% (18)
- B4% (1)
- C4% (1)
- D17% (4)
Why each option
Extracting NTLM hashes from Windows memory enables pass-the-hash attacks over standard Windows authentication protocols, which perimeter firewalls commonly permit as legitimate traffic.
Pass-the-hash leverages captured NTLM hashes to authenticate over protocols such as SMB and WinRM, which perimeter firewalls frequently allow because they carry normal Windows business traffic. Unlike brute-force or cracking techniques that may be recognized and blocked by application-layer controls, pass-the-hash traffic blends with legitimate authentication flows, making it more likely to traverse filtering boundaries unimpeded.
Pass-the-hash reuses the captured account's existing hash for authentication and cannot grant privileges beyond those already assigned to that account.
While pass-the-hash does eliminate the need to crack or guess a password, the question asks about the advantage specifically when accessing another networked Windows system, and the primary advantage in that context is protocol-level firewall traversal.
NTLM hashes are not salted, so no salt removal occurs; pass-the-hash uses the full hash directly for network authentication rather than preparing it for offline cracking.
Concept tested: Pass-the-hash lateral movement using extracted NTLM hashes
Source: https://attack.mitre.org/techniques/T1550/002/
Topics
Community Discussion
No community discussion yet for this question.