GPEN Attacking Password Hashes — 20 Questions

Question 1

A penetration tester has successfully obtained a SAM database file. Which technique is most effective for extracting NTLM hashes while avoiding detection by traditional file-integrity monitoring systems that flag direct reads of the active SYSTEM hive?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mounting a Volume Shadow Copy to extract the files offline.. To bypass file locks and integrity monitors, testers often utilize Volume Shadow Copies (VSS) to create a snapshot of the live system files. By reading the SAM and SYSTEM hives from the shadow copy, the tester avoids triggering alerts associated with accessing protected files currently in use by the OS kernel, ensuring the integrity of the extraction process while maintaining operational security during the post-exploitation phase.

Answer

Using a standard copy command to move the SAM file to a network share.

Answer

Executing an in-memory credential harvesting tool like Mimikatz without administrative privileges.

Answer

Restarting the system to force it into a recovery mode.

Question 2

Refer to the exhibit. Given the Hashcat output, what is the most significant bottleneck affecting the efficiency of the NTLM password cracking attack?

Accepted Answer

Thermal throttling of the GPU is reducing compute throughput.. The exhibit shows a relatively low hash-cracking speed for NTLM, which is typically capable of billions of hashes per second on modern hardware. The primary bottleneck here is the thermal throttling indicated by the high GPU temperature (78C) and high fan utilization. As the hardware reaches thermal limits, the GPU automatically reduces clock speeds to prevent physical damage, drastically slowing the overall computation performance during the password attack.

Answer

The choice of the wordlist is too small to find a match.

Answer

The hash type (mode 1000) is inherently slower than others.

Answer

The system memory is insufficient to load the full wordlist.

Question 3

Which TWO of the following factors most significantly increase the time required to crack a password hash using offline brute-force attacks?

Accepted Answer

The use of a unique salt for each user.. The time required for an offline attack is driven by the complexity of the cryptographic algorithm and the presence of randomness. Salting prevents the use of precomputed rainbow tables, forcing a unique attack per user. Key stretching algorithms, such as those found in modern password schemes, purposefully slow down individual hash calculations to make brute-forcing computationally expensive, even when utilizing specialized hardware like GPUs or ASICs.

Answer

The password length requirement for users.

Answer

The total number of users in the target environment.

Answer

The use of a multi-core CPU for the attack.

Question 4

A tester is performing an offline attack against a Kerberos TGT (Ticket Granting Ticket) hash. What is this specific attack vector commonly known as in a Windows Active Directory environment?

Accepted Answer

Kerberoasting. The Kerberoasting attack focuses on requesting service tickets for accounts with Service Principal Names (SPNs) from the Domain Controller. The resulting service ticket is encrypted with the service account's password hash. Because the TGS-REP response is encrypted using a weak algorithm (like RC4-HMAC), the tester can extract the hash and perform offline brute-force or dictionary attacks to recover the plain-text password without interacting with the Domain Controller again.

Answer

Golden Ticket Attack

Answer

Pass-the-Hash

Answer

AS-REP Roasting

Question 5

Which THREE of the following are common indicators that a Windows environment is vulnerable to credential extraction from the LSASS process?

Accepted Answer

Credential Guard is not enabled.. Vulnerabilities in LSASS interaction often stem from outdated security configurations. Lack of Credential Guard allows the process to remain unprotected in memory. Additionally, overly permissive administrative rights allow tools like Mimikatz to escalate and inject code. Finally, the absence of modern EDR solutions means that suspicious memory reads are not blocked, allowing attackers to dump sensitive credentials easily from the Local Security Authority Subsystem Service.

Answer

The system uses NTLM instead of Kerberos for everything.

Answer

The SAM database is stored on a network share.

Question 6

You have successfully obtained a copy of the NTDS.dit database and the SYSTEM registry hive during a domain controller compromise. Which TWO tools can you use offline to extract the password hashes from these files without relying on living-off-the-land binaries on a live system? (Choose TWO)

Accepted Answer

Impacket's secretsdump.py script. Both Impacket's secretsdump.py and the standalone utility NTDSXtract are industry-standard tools designed for offline parsing of NTDS.dit files when combined with the SYSTEM hive. Pentesters must know how to perform offline extraction to minimize forensic footprint and bypass endpoint detection systems running on live domain controllers during active assessments.

Answer

Windows Sysinternals ProcDump utility

Answer

BloodHound GUI collector

Answer

Responder network poisoning tool

Question 7

A penetration tester extracts a Kerberos 5 TGS-REP hash (etype 23) from a service account and attempts to crack it offline using Hashcat. The tester uses mode 13100. After running Hashcat, the tester notices that the hash is not being cracked despite using a large wordlist. Which of the following is the most likely reason for the failure?

Accepted Answer

The hash file does not include the required salt (username and realm) for TGS-REP cracking.. Kerberos 5 TGS-REP hashes require the salt (username and realm) to be present in the hash file for Hashcat to compute the correct encryption key. Without it, cracking will fail. The tester used the correct mode, so the problem is likely the missing salt. Other options are either incorrect modes or less likely explanations.

Answer

Hashcat mode 13100 is for Kerberos 5 AS-REP, not TGS-REP.

Answer

The hash is actually a Kerberos 5 AS-REP hash, not a TGS-REP hash.

Answer

The service account password is longer than 14 characters, making it uncrackable.

Question 8

You have extracted a set of NTLM hashes from a Windows domain controller and want to crack them using Hashcat. Which TWO of the following are effective strategies to increase cracking success? (Choose two.)

Accepted Answer

Use a rule-based attack with a comprehensive wordlist. Rule-based attacks and mask attacks are effective because they generate candidates based on common password patterns and transformations. These methods optimize the use of GPU power by focusing on likely passwords, increasing the chance of cracking NTLM hashes. Other techniques like rainbow tables or distributed cracking may have limitations or do not directly enhance success rates.

Answer

Use a hybrid attack combining wordlist and mask

Answer

Use a rainbow table attack with precomputed NTLM hashes

Answer

Use a distributed cracking setup with multiple GPUs

Question 9

A penetration tester has obtained a set of NTLM hashes from a compromised Windows system and wants to crack them using a rule-based dictionary attack. Which TWO of the following Hashcat options are essential to perform this attack effectively? (Choose two.)

Accepted Answer

-a 0. To perform a rule-based dictionary attack with Hashcat, the tester must specify the straight dictionary attack mode with -a 0 and provide a rule file with -r. These two options enable the use of a wordlist and transformation rules to generate candidate passwords. The hash type -m 1000 is also needed but is not specific to the rule-based aspect. The other options are for different attack modes or safety bypasses.

Answer

--force

Answer

-m 1000

Answer

--increment

Question 10

A penetration tester extracts a local user account's NT hash from a Windows workstation and wants to use it to authenticate to other workstations in the same domain. The domain has NTLM authentication enabled. Which of the following conditions is necessary for the Pass-the-Hash attack to succeed?

Accepted Answer

The target workstations must have the same local administrator password as the source workstation.. Pass-the-Hash leverages the hash as a credential, so the key requirement is that the target system accepts that hash for authentication. In many networks, local administrator passwords are reused across workstations, allowing an attacker to move laterally using the same hash. Cracking the hash is unnecessary, and domain administrator rights are not required. The attack works on various Windows versions, so the specific OS version is not a limiting factor. The critical condition is credential reuse.

Answer

The tester must have domain administrator privileges to perform the attack.

Answer

The target workstations must be running Windows Server 2008 or later.

Answer

The tester must first crack the NT hash to recover the plaintext password.

Question 11

When conducting a penetration test, why is it critical to assess the hashing algorithm used for storing passwords rather than focusing solely on the password policy itself?

Accepted Answer

Weak algorithms allow rapid recovery of passwords once a breach occurs.. Even with a strong password policy, an organization remains vulnerable if the hashing algorithm is cryptographically broken or lacks proper salting. A weak algorithm like MD5 or NTLM allows attackers to crack even complex passwords almost instantaneously using modern hardware. Evaluating the hashing implementation ensures that the organization is protected against offline attacks, providing a necessary layer of defense that policies alone cannot guarantee if the underlying data storage mechanism is compromised.

Answer

Password policies are easily bypassed by users sharing credentials.

Answer

Passwords are always transmitted in plain text over the network.

Answer

The password policy is only effective for local accounts.

Question 12

Which THREE of the following are primary reasons why the NTLM authentication protocol is considered insecure for modern enterprise environments?

Accepted Answer

Lack of mutual authentication allows for relay attacks.. NTLM is inherently insecure because it is a challenge-response protocol that does not provide mutual authentication, making it susceptible to relay attacks. Furthermore, the NTLM hash is stored in a format that does not include a salt, allowing for the use of precomputed tables. Finally, because NTLM hashes are treated as the 'equivalent' of a password in many contexts, once stolen, they can be reused without needing to crack them.

Answer

NTLM requires a connection to a Domain Controller for every login.

Answer

The protocol uses hard-coded encryption keys for every session.

Question 13

During a penetration test, you successfully dump the LSASS memory space and extract a set of NTLM hashes. Which of the following is the most efficient next step if the goal is to determine the plaintext password of a high-value administrator account?

Accepted Answer

Run Hashcat with a combination of wordlists and mask attacks.. Once NTLM hashes are acquired, the most efficient method to recover the password is using an optimized GPU-based cracking tool like Hashcat. By employing a hybrid attack strategy—starting with a dictionary list supplemented by mask-based brute forcing—the tester can maximize the likelihood of recovering passwords that follow common corporate complexity patterns. This is significantly faster than manual analysis and allows for rapid testing against high-value target accounts.

Answer

Use the hashes to perform a Pass-the-Hash attack on every server.

Answer

Submit the hashes to an online cloud-based cracking service.

Answer

Reverse the MD4 algorithm to recover the original string.

Question 14

Refer to the exhibit. Given the output from Mimikatz, what is the most appropriate interpretation of the 'LM NTLM' value provided for the administrator account?

Accepted Answer

The hash can be used directly for Pass-the-Hash authentication.. The exhibit displays a captured NTLM hash. In modern Windows environments, the 'LM' (LAN Manager) portion is often empty or disabled for security, leaving only the NTLM hash. The value shown is a hexadecimal representation of the NTLM hash, which acts as the equivalent of a password for authentication. A penetration tester can use this specific string to perform a Pass-the-Hash attack without needing to crack it to plaintext.

Answer

The hash is a salt-based hash requiring a rainbow table.

Answer

The value represents the plaintext password in hex format.

Answer

The session has expired and the hash is now unusable.

Question 15

Which of the following describes the risk associated with cached credentials in the Windows operating system during a penetration test?

Accepted Answer

They provide a target for offline cracking to recover domain passwords.. Windows caches credentials for domain accounts that have previously logged into a machine to allow users to sign in when the domain controller is unavailable. These cached entries, often stored in the registry, can be extracted by an attacker with administrative privileges. This provides a persistent source of credentials that, if cracked, could grant an attacker access to the domain even when the targeted user is not currently logged on.

Answer

Cached credentials only store the user's username.

Answer

They allow offline authentication, but are stored in plain text.

Answer

They are automatically wiped upon every system reboot.

Question 16

Why are GPUs significantly more effective than CPUs for brute-forcing unsalted NTLM hashes?

Accepted Answer

GPUs handle massive parallel operations on simple math.. GPUs feature thousands of small, specialized cores designed for massive parallel processing, which is ideal for the simple, iterative nature of hashing. While a CPU excels at complex, branch-heavy tasks, a GPU can process thousands of password guesses simultaneously. For an unsalted algorithm like NTLM, this parallelism results in a performance increase of several orders of magnitude, allowing testers to exhaust large keyspaces in seconds rather than days.

Answer

GPUs have larger cache sizes for storing wordlists.

Answer

GPUs have a faster instruction set for MD4 algorithms.

Answer

GPUs can bypass the salt requirement during the attack.

Question 17

Which of the following actions is the best way to detect an attacker performing an offline hash-cracking operation within a corporate network?

Accepted Answer

Logging access to the LSASS process and SAM hives.. Detecting an offline attack is challenging because the actual computation happens on the attacker's hardware. However, the initial phase—dumping the hashes from memory or the SAM file—requires access to sensitive system files or processes. By monitoring for access to the LSASS process or reading the SAM/SYSTEM registry hives, security teams can identify the signature of a credential dumping attempt, which is the necessary precursor to any offline attack.

Answer

Monitoring for high CPU usage on all workstations.

Answer

Scanning for the use of the Hashcat tool on the network.

Answer

Monitoring for network traffic to known cracking websites.

Question 18

During a penetration test, you successfully obtain an encrypted NTLM hash but are unable to crack it. What is the most effective alternative strategy to gain access to the system?

Accepted Answer

Perform a Pass-the-Hash attack using the captured hash.. When an NTLM hash cannot be cracked, the most effective alternative is a Pass-the-Hash (PtH) attack. Because NTLM authentication verifies the user based on the knowledge of the hash rather than the plaintext password, an attacker can use the captured hash to authenticate to various network services directly. This approach is highly effective for lateral movement, bypassing the need for plaintext recovery while maintaining the ability to compromise the target system.

Answer

Attempt a brute-force attack on the Kerberos TGT.

Answer

Use a social engineering attack to reset the password.

Answer

Re-run the cracking attack with a longer wordlist.

Question 19

During an internal penetration test, you capture NTLMv2 hashes from a network segment. You want to crack these hashes using Hashcat on a dedicated GPU rig. Which Hashcat mode number corresponds directly to the NTLMv2 hash format commonly captured via LLMNR/NBT-NS poisoning?

Accepted Answer

Hashcat mode 5600 targets NetNTLMv2 hashes captured during network authentication processes like SMB or HTTP challenges.. Hashcat mode 5600 is specifically designed for NetNTLMv2 hashes, which are generated during SMB authentication challenges captured through poisoning tools like Responder. Understanding these specific hash modes is critical for pentesters to quickly transition from passive or active credential capture to offline brute-forcing and dictionary attacks against Windows domain environments.

Answer

Hashcat mode 1000 represents standard NTLM password hashes extracted from the Windows SAM database or NTDS.dit.

Answer

Hashcat mode 3000 handles LANMAN hashes, which are legacy Windows password hashes stored for backwards compatibility on older systems.

Answer

Hashcat mode 13100 is utilized for Kerberos 5 TGS-REP etype 23 hashes gathered through service ticket requests.

Question 20

During an internal penetration test, you capture an NTLMv2 hash challenge-response pair from a network segment. You want to crack the user's password using Hashcat. Which hashcat attack mode and hash format identifier should you use to crack this specific challenge-response pair efficiently on a modern GPU?

Accepted Answer

Mode 5600, which targets NetNTLMv2 hashes captured during network authentication events or LLMNR/NBT-NS spoofing attacks.. Hashcat utilizes mode 5600 specifically for NetNTLMv2 hashes, which allows leveraging high-speed GPU acceleration to perform dictionary and mask attacks against captured enterprise authentication handshakes. Selecting the correct mode ensures hashcat parses the challenge, username, domain, and response fields accurately according to the standard NTLMv2 response format specification.

Answer

Mode 1000, which targets local Windows SAM NT hashes extracted from a compromised registry hive export.

Answer

Mode 5500, which is designed exclusively for cracking legacy NTLMv1 network authentication challenge-response pairs.

Answer

Mode 3000, which processes LanMan hashes historically found on very old Windows NT and 95 operating systems.