mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a Python script…
A penetration tester is analyzing a Python script that uses the Impacket library to perform an SMB relay attack. The script is failing to capture NTLM hashes from target machines. Which part of the script is MOST likely misconfigured?
⚠ Common exam trap
Many candidates confuse the listener IP with the target IP, assuming the script needs the target's IP to capture hashes, when in fact the listener IP must be the attacker's own IP to receive the relayed authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The listener IP address
In an SMB relay attack using Impacket, the listener IP address must be set to the attacker's IP address where the relayed authentication is received. If the listener IP is misconfigured (e.g., set to the target's IP or left as localhost), the relay server will not receive the forwarded NTLM hashes, causing the capture to fail. This is a common configuration error when using Impacket's 'smbrelayx' or similar scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The target IP address
Why it's wrong here
The target IP is the address of the SMB server the attacker wants to relay to, not the address the victim connects to for capture. If it is wrong, the subsequent relayed authentication fails, but the NTLM challenge/response is still collected by the listener before the relay step, so capture is unaffected. The listener IP alone determines whether the victim's SMB negotiation reaches the attacker at all.
- ✓
The listener IP address
Why this is correct
The listener IP defines the interface on which the malicious SMB server awaits the victim's connection and must be set to an address owned by the attacker and routable from the victim's network. If it is misconfigured, the victim's SMB client cannot establish the TCP session, so no NTLM handshake occurs and no hash is ever transmitted. Correctly setting this IP is therefore the primary requirement for hash capture.
- ✗
The SMB version negotiation
Why it's wrong here
SMB version negotiation is handled transparently by impacket and similar libraries: the client and server exchange SMB dialect blocks and automatically select the highest mutually supported version. A mismatch in supported versions (e.g., SMBv1 vs SMBv2.1) would cause a negotiation failure, but this is not a common misconfiguration in a properly set up relay listener. Even if the victim only supports an older dialect, the listener accommodates it, so version negotiation is rarely the reason no hash arrives.
- ✗
The authentication method (NTLMv1 vs NTLMv2)
Why it's wrong here
The authentication method refers to whether the victim sends an NTLMv1 or NTLMv2 response, which alters the format of the captured hash but not the fact that a hash is sent. The listener captures both variants through the same SMB session setup, and then stores them in a crackable format (e.g., NetNTLMv2). Thus, a failure to capture any hash indicates the authentication attempt never reached the listener, not that the script mis-handled a particular hash type.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.