A penetration tester has extracted password hashes from the lsass.exe memory process. Which of the following should the tester perform NEXT to pass the hash and provide persistence with the newly…

The correct answer is D. Use Mimikatz to pass the hash and PsExec for persistence. Mimikatz is the industry-standard tool for credential harvesting and pass-the-hash (PtH) attacks on Windows systems. It can use NTLM hashes extracted from lsass.exe to authenticate to other systems without needing the plaintext password. PsExec (part of Sysinternals/Impacket)…

Post-exploitation and lateral movement

Question

A penetration tester has extracted password hashes from the lsass.exe memory process. Which of the following should the tester perform NEXT to pass the hash and provide persistence with the newly acquired credentials?

Options

AUse Patator to pass the hash and Responder for persistence.
BUse Hashcat to pass the hash and Empire for persistence.
CUse a bind shell to pass the hash and WMI for persistence.
DUse Mimikatz to pass the hash and PsExec for persistence.

How the community answered

(28 responses)

A
14% (4)
B
7% (2)
C
4% (1)
D
75% (21)

Explanation

Mimikatz is the industry-standard tool for credential harvesting and pass-the-hash (PtH) attacks on Windows systems. It can use NTLM hashes extracted from lsass.exe to authenticate to other systems without needing the plaintext password. PsExec (part of Sysinternals/Impacket) then leverages those credentials to execute commands remotely, establishing persistence. Patator (A) is a brute-force tool, not designed for PtH. Hashcat (B) is used to crack hashes offline, not pass them. A bind shell (C) is a connection technique, not a PtH tool. WMI can be used for lateral movement but the canonical PtH + persistence combo is Mimikatz + PsExec.

Topics

#Post-exploitation#Pass-the-Hash#Persistence#Mimikatz

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice