A penetration tester is able to capture the NTLM challenge-response traffic between a client and a server. Which of the following can be done with the pcap to gain access to the server?

Vertical privilege escalation refers to gaining higher privileges *after* initial access, not the method of gaining initial access from captured NTLM traffic.

NTLM challenge-response traffic is vulnerable to replay attacks. By capturing the legitimate challenge and response, a penetration tester can re-send this exact sequence to the server, which, in certain configurations or older implementations, may authenticate the attacker without requiring knowledge of the actual password hash. This allows the attacker to recreate the session and gain access.

While NTLM hashes *can* be cracked offline with tools like John the Ripper, the question asks what can be done *with the pcap* to gain access to the server directly, and a replay attack uses the captured challenge-response data without needing to crack the password.

A pass-the-hash attack involves using a captured NTLM hash (the user's password hash) directly for authentication, not the entire challenge-response *traffic*. Replaying the *traffic* is distinct from passing the hash.