During the reconnaissance phase, a penetration tester runs the following command: sudo responder -I tun0 The result of the command is a list of NTLMv2 hashes. Which of the following should the…

The correct answer is D. Crack the hash with Hashcat. The command sudo responder -I tun0 is used to perform an LLMNR/NBT-NS/mDNS poisoning attack. This can capture NTLMv2 hashes when network devices attempt to authenticate. These NTLMv2 hashes are encrypted and need to be cracked to reveal plaintext credentials. The next logical…

Attacks and Exploits

Question

During the reconnaissance phase, a penetration tester runs the following command:

sudo responder -I tun0 The result of the command is a list of NTLMv2 hashes. Which of the following should the penetration tester do next?

Options

AUse the hash in a password spraying attack.
BUse the hashes in a collision attack.
CAttempt to pass the hash with CrackMapExec.
DCrack the hash with Hashcat.

How the community answered

(58 responses)

A
7% (4)
B
12% (7)
C
3% (2)
D
78% (45)

Explanation

The command sudo responder -I tun0 is used to perform an LLMNR/NBT-NS/mDNS poisoning attack. This can capture NTLMv2 hashes when network devices attempt to authenticate. These NTLMv2 hashes are encrypted and need to be cracked to reveal plaintext credentials. The next logical step is to use a tool like Hashcat to attempt to crack the NTLMv2 hashes, either through dictionary attacks, brute-force attacks, or a combination of both, to obtain the plaintext passwords. Once the passwords are recovered, they can be used for further attacks, such as lateral movement or privilege escalation.

Topics

#Hash Cracking#Credential Access#Responder#Hashcat

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice