PT0-001 · Question #78
If a security consultant comes across a password hash that resembles the following: b117525b345470c29ca3d8ac0b556ba8 Which of the following formats is the correct hash type?
The correct answer is C. NTLM. A 32-character hexadecimal string is the characteristic format of an NTLM hash, which uses the MD4 algorithm to produce a 128-bit output.
Question
If a security consultant comes across a password hash that resembles the following:
b117525b345470c29ca3d8ac0b556ba8 Which of the following formats is the correct hash type?
Options
- AKerberos
- BNetNTLMvl
- CNTLM
- DSHA-1
How the community answered
(43 responses)- A7% (3)
- B2% (1)
- C88% (38)
- D2% (1)
Why each option
A 32-character hexadecimal string is the characteristic format of an NTLM hash, which uses the MD4 algorithm to produce a 128-bit output.
Kerberos uses ticket-based authentication and does not produce simple standalone 32-character hex hashes in this format.
NetNTLMv1 is a challenge-response authentication protocol format that includes additional fields such as username, challenge, and response - it is not a standalone 32-character hex string.
NTLM hashes are generated using the MD4 hashing algorithm and produce a 32-character hexadecimal string representing a 128-bit value. The hash b117525b345470c29ca3d8ac0b556ba8 is exactly 32 hex characters long, which precisely matches the NTLM NT hash format that Windows uses for storing and transmitting password credentials.
SHA-1 produces a 40-character hexadecimal string representing a 160-bit output, which is longer than the 32-character hash shown in the question.
Concept tested: Identifying NTLM password hash by format
Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview
Topics
Community Discussion
No community discussion yet for this question.