GPEN Attacking Password Hashes Practice Test 2 — 15 Questions

Question 1

Why are GPUs significantly more effective than CPUs for brute-forcing unsalted NTLM hashes?

Accepted Answer

GPUs handle massive parallel operations on simple math.. GPUs feature thousands of small, specialized cores designed for massive parallel processing, which is ideal for the simple, iterative nature of hashing. While a CPU excels at complex, branch-heavy tasks, a GPU can process thousands of password guesses simultaneously. For an unsalted algorithm like NTLM, this parallelism results in a performance increase of several orders of magnitude, allowing testers to exhaust large keyspaces in seconds rather than days.

Answer

GPUs have larger cache sizes for storing wordlists.

Answer

GPUs have a faster instruction set for MD4 algorithms.

Answer

GPUs can bypass the salt requirement during the attack.

Question 2

Which of the following actions is the best way to detect an attacker performing an offline hash-cracking operation within a corporate network?

Accepted Answer

Logging access to the LSASS process and SAM hives.. Detecting an offline attack is challenging because the actual computation happens on the attacker's hardware. However, the initial phase—dumping the hashes from memory or the SAM file—requires access to sensitive system files or processes. By monitoring for access to the LSASS process or reading the SAM/SYSTEM registry hives, security teams can identify the signature of a credential dumping attempt, which is the necessary precursor to any offline attack.

Answer

Monitoring for high CPU usage on all workstations.

Answer

Scanning for the use of the Hashcat tool on the network.

Answer

Monitoring for network traffic to known cracking websites.

Question 3

During a penetration test, you successfully obtain an encrypted NTLM hash but are unable to crack it. What is the most effective alternative strategy to gain access to the system?

Accepted Answer

Perform a Pass-the-Hash attack using the captured hash.. When an NTLM hash cannot be cracked, the most effective alternative is a Pass-the-Hash (PtH) attack. Because NTLM authentication verifies the user based on the knowledge of the hash rather than the plaintext password, an attacker can use the captured hash to authenticate to various network services directly. This approach is highly effective for lateral movement, bypassing the need for plaintext recovery while maintaining the ability to compromise the target system.

Answer

Attempt a brute-force attack on the Kerberos TGT.

Answer

Use a social engineering attack to reset the password.

Answer

Re-run the cracking attack with a longer wordlist.

Question 4

During an internal penetration test, you capture NTLMv2 hashes from a network segment. You want to crack these hashes using Hashcat on a dedicated GPU rig. Which Hashcat mode number corresponds directly to the NTLMv2 hash format commonly captured via LLMNR/NBT-NS poisoning?

Accepted Answer

Hashcat mode 5600 targets NetNTLMv2 hashes captured during network authentication processes like SMB or HTTP challenges.. Hashcat mode 5600 is specifically designed for NetNTLMv2 hashes, which are generated during SMB authentication challenges captured through poisoning tools like Responder. Understanding these specific hash modes is critical for pentesters to quickly transition from passive or active credential capture to offline brute-forcing and dictionary attacks against Windows domain environments.

Answer

Hashcat mode 1000 represents standard NTLM password hashes extracted from the Windows SAM database or NTDS.dit.

Answer

Hashcat mode 3000 handles LANMAN hashes, which are legacy Windows password hashes stored for backwards compatibility on older systems.

Answer

Hashcat mode 13100 is utilized for Kerberos 5 TGS-REP etype 23 hashes gathered through service ticket requests.

Question 5

During an internal penetration test, you capture an NTLMv2 hash challenge-response pair from a network segment. You want to crack the user's password using Hashcat. Which hashcat attack mode and hash format identifier should you use to crack this specific challenge-response pair efficiently on a modern GPU?

Accepted Answer

Mode 5600, which targets NetNTLMv2 hashes captured during network authentication events or LLMNR/NBT-NS spoofing attacks.. Hashcat utilizes mode 5600 specifically for NetNTLMv2 hashes, which allows leveraging high-speed GPU acceleration to perform dictionary and mask attacks against captured enterprise authentication handshakes. Selecting the correct mode ensures hashcat parses the challenge, username, domain, and response fields accurately according to the standard NTLMv2 response format specification.

Answer

Mode 1000, which targets local Windows SAM NT hashes extracted from a compromised registry hive export.

Answer

Mode 5500, which is designed exclusively for cracking legacy NTLMv1 network authentication challenge-response pairs.

Answer

Mode 3000, which processes LanMan hashes historically found on very old Windows NT and 95 operating systems.

Question 6

During an internal penetration test, an attacker successfully captures an NTLMv2 challenge-response authentication exchange from a network segment. The adversary wishes to perform an offline brute-force cracking attack against the captured hash using Hashcat. Which specific Hashcat attack mode and hash format identifier must be specified to successfully crack this captured challenge-response pair?

Accepted Answer

Mode 5600, targeting NetNTLMv2 network authentication captures.. Hashcat mode 5600 specifically targets NetNTLMv2 authentication exchanges captured during network sniffing or LLMNR/NBT-NS poisoning attacks. Using the correct mode ensures Hashcat formats the challenge, username, domain, and response fields properly for structural verification and decryption. Selecting incorrect modes results in immediate errors or zero matches during computation, making accurate identification of authentication protocols a vital pentesting skill.

Answer

Mode 1000, targeting local SAM database NTLM hashes.

Answer

Mode 1300, targeting legacy Windows NT hashes.

Answer

Mode 3000, targeting LM hashes with challenge data.

Question 7

A penetration tester has obtained a set of Linux shadow file hashes. The hashes begin with $6$ and the tester intends to perform an offline brute-force attack using Hashcat. Which mode should the tester select to ensure Hashcat correctly interprets these hashes?

Accepted Answer

1800 (sha512crypt). The $6$ prefix in a Linux shadow file indicates the sha512crypt algorithm, which is supported by Hashcat mode 1800. Choosing the correct mode is essential because Hashcat must parse the hash structure, including salt and iteration count, to perform the attack. Other modes correspond to different algorithms and will not work with this hash type.

Answer

500 (md5crypt)

Answer

3200 (bcrypt)

Answer

1000 (NTLM)

Question 8

A penetration tester has captured a set of NTLMv2 challenge-response pairs from a network segment. The tester wants to crack these hashes offline using Hashcat. Which TWO of the following statements are true regarding the cracking of NTLMv2 hashes with Hashcat? (Choose two.)

Accepted Answer

Hashcat mode 5600 is used for NTLMv2 hashes.. NTLMv2 challenge-response pairs are cracked using Hashcat mode 5600, and the captured hash must include the server challenge for the computation to be possible. The challenge is unique per authentication, so precomputed tables are useless. The username is part of the hash but does not act as a salt. An attack mode must always be specified.

Answer

NTLMv2 hashes can be cracked using precomputed rainbow tables.

Answer

Hashcat can crack NTLMv2 hashes without specifying a wordlist or mask.

Answer

NTLMv2 hashes are salted with the username, making them more resistant to cracking.

Question 9

You are conducting an internal penetration test and have obtained a set of NTLM hashes from a compromised server. You want to crack them using Hashcat on a dedicated GPU rig. Which hash mode should you use?

Accepted Answer

Hashcat mode 1000 (NTLM). NTLM hashes are stored in Windows systems and are commonly extracted during penetration tests. Hashcat mode 1000 is designed to crack these hashes efficiently. Other modes correspond to different hash types, such as NetNTLMv2, Kerberos, or Linux crypt formats, and would not correctly process NTLM hashes.

Answer

Hashcat mode 1800 (sha512crypt)

Answer

Hashcat mode 13100 (Kerberos 5 TGS-REP)

Answer

Hashcat mode 5500 (NetNTLMv2)

Question 10

A penetration tester has obtained the NTLM hash of a domain user and wants to authenticate to a remote server without cracking the password. Which of the following techniques allows the tester to use the hash directly for authentication?

Accepted Answer

Pass-the-Hash (PtH) using Mimikatz sekurlsa::pth. Pass-the-Hash allows an attacker to authenticate using the NTLM hash without cracking it. Tools like Mimikatz can inject the hash into a session, enabling lateral movement or access to resources. Other options involve cracking or forging tickets, which are different attack vectors. The scenario emphasizes using the hash directly, making Pass-the-Hash the correct technique.

Answer

Golden Ticket attack using the KRBTGT hash

Answer

Kerberoasting to request a service ticket

Answer

Rainbow table lookup to recover the plaintext password

Question 11

A penetration tester captures a NetNTLMv2 hash from a network segment using Responder. The tester wants to crack this hash using Hashcat. Which Hashcat mode should be used?

Accepted Answer

5600. NetNTLMv2 hashes captured from network traffic require Hashcat mode 5600. This mode is tailored to the NetNTLMv2 challenge-response format, which uses HMAC-MD5. Other modes correspond to different hash types: 1000 for NTLM, 2500 for NetNTLMv1, and 13100 for Kerberos TGS-REP. Using the correct mode is essential for successful cracking.

Answer

2500

Answer

1000

Answer

13100

Question 12

During a penetration test, you obtain a password hash from a Linux system's /etc/shadow file. The hash starts with '$6$'. Which Hashcat mode should you use to crack it?

Accepted Answer

Hashcat mode 1800 (sha512crypt). The '$6$' prefix unambiguously identifies a SHA-512 crypt hash. Hashcat mode 1800 is specifically built for this format, ensuring correct salt handling and efficient cracking. Other modes correspond to different hash algorithms and would not successfully crack the hash.

Answer

Hashcat mode 3200 (bcrypt)

Answer

Hashcat mode 500 (md5crypt)

Answer

Hashcat mode 1500 (DEScrypt)

Question 13

During a penetration test, a tester extracts the SAM database from a Windows system. Which of the following tools is specifically designed to extract password hashes from the SAM file?

Accepted Answer

secretsdump.py. secretsdump.py is specifically designed to extract password hashes from Windows registry hives, including SAM, SYSTEM, and SECURITY. It can operate offline on extracted files, making it ideal for this scenario. Mimikatz is more for live memory extraction, while Hashcat and John the Ripper are cracking tools. Thus, secretsdump.py is the correct choice for extracting hashes from a SAM file.

Answer

John the Ripper

Answer

Mimikatz

Answer

Hashcat

Question 14

A penetration tester extracts a domain user's NT hash from the SAM database of a workstation and wants to authenticate to a file share on a different server without knowing the plaintext password. Which of the following techniques should the tester use?

Accepted Answer

Pass-the-Hash using the NT hash directly in an authentication request. Pass-the-Hash is the correct technique because Windows authentication protocols accept the NT hash as a valid credential. An attacker who extracts the hash can use it to authenticate to remote services without cracking the plaintext. The other options either aim at password recovery or rely on different credential material, such as Kerberos tickets, which are not present in this scenario. The key distinction is that Pass-the-Hash uses the hash directly for authentication.

Answer

Pass-the-Ticket by injecting a forged Kerberos TGT into memory

Answer

Kerberoasting the target service account to obtain its TGS ticket

Answer

Rainbow table lookup against the NT hash to recover the plaintext password

Question 15

A penetration tester is reviewing a captured NTLMv2 challenge-response pair and wants to crack it offline using Hashcat. Which Hashcat mode should the tester use to attack this specific hash type?

Accepted Answer

Hashcat mode 5600 (NetNTLMv2). Hashcat mode 5600 is the correct choice because it is tailored for NetNTLMv2 challenge-response pairs, which are commonly captured during penetration tests. This mode understands the structure of the NTLMv2 response, including the server challenge and the HMAC-MD5 computation. Other modes target different hash types, such as raw NT hashes or Kerberos tickets, and would not correctly parse or crack the captured NTLMv2 data. Using the right mode ensures efficient and successful cracking.

Answer

Hashcat mode 0 (MD5)

Answer

Hashcat mode 13100 (Kerberos 5 TGS-REP)

Answer

Hashcat mode 1000 (NTLM)