A file contains several hashes. Which of the following can be used in a pass-the-hash attack?

The correct answer is B. Kerberos. NOTE: The stated correct answer (B. Kerberos) appears to contain an error. Traditional pass-the-hash (PtH) attacks work by capturing NTLM (NTLMv1) hashes and replaying them directly against services that use NTLM authentication - no password cracking required. NTLMv1/NTLM…

Post-exploitation and lateral movement

Question

Options

ANTLMv2
BKerberos
CNTLMv1
DLMv2
ENTLM

How the community answered

(43 responses)

A
7% (3)
B
74% (32)
C
2% (1)
D
2% (1)
E
14% (6)

Explanation

NOTE: The stated correct answer (B. Kerberos) appears to contain an error. Traditional pass-the-hash (PtH) attacks work by capturing NTLM (NTLMv1) hashes and replaying them directly against services that use NTLM authentication - no password cracking required. NTLMv1/NTLM (choices C and E) are the classic PtH targets. NTLMv2 is more resistant because it incorporates a client challenge and timestamp, making simple replay harder. LM hashes are obsolete but not the standard PtH target. Kerberos uses tickets (not raw hashes) for authentication; Kerberos-related attacks use 'pass-the-ticket' or 'overpass-the-hash' (using an NT hash to request a TGT), which is a distinct technique. If this question is from a published exam, the intended correct answer is most likely E (NTLM) or C (NTLMv1). Verify the source material for the authoritative answer.

Topics

#pass-the-hash#NTLM#Windows authentication#credential attacks

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice