PT0-002 Practice Question: A penetration tester is using Hashcat to crack…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  -m 1000

  Why this is correct

  Mode 1000 is the correct hashcat mode for pure NTLM hashes, which are the MD4 digest of the user's password encoded in UTF-16LE and stored in the Windows SAM database or NTDS.dit. This mode directly feeds the raw 32-character hexadecimal NTLM hash into hashcat's cracking algorithms, such as dictionary, rule-based, or brute-force attacks. Selecting any other mode will cause hashcat to parse the hash incorrectly, leading to false negatives or incorrect crack attempts.

• ✗

  -m 1100

  Why it's wrong here

  Mode 1100 is designated for Domain Cached Credentials (DCC), also known as cached domain logons. These are not plain NTLM hashes but a salted and iterated derivative: the hash is computed by passing the NTLM hash through MD4 with the username as a salt, then repeating the MD4 operation for 1024 iterations. Because the transformation includes the username and multiple iterations, attempting to crack a standard NTLM hash with mode 1100 will fail, as hashcat will expect a different hash format and structure.

• ✗

  -m 3000

  Why it's wrong here

  Mode 3000 targets LM hashes, an obsolete Windows authentication mechanism that predates NTLM. LM hashes are derived by splitting the password into two 7-character uppercase halves, padding each with null bytes, and DES-encrypting a fixed constant, making them trivially weak and vulnerable to rainbow tables. NTLM hashes, by contrast, use a single MD4 hash of the UTF-16LE password with no case conversion or split, so they are not compatible with mode 3000 and that mode will not correctly parse an NTLM hash.

• ✗

  -m 5500

  Why it's wrong here

  Mode 5500 is used for NetNTLMv2 challenge-response values captured during network authentication, such as those obtained with Responder or other MITM tools. Unlike a static NTLM hash stored in the SAM, NetNTLMv2 is a challenge-response pair that involves a server challenge and a client response computed from the NTLM hash via HMAC-MD5, along with a timestamp and other data. Cracking a stored NTLM hash with mode 5500 will not work because the input format expects a different structure (with the challenge appended), and the attack is performed on the network protocol exchange rather than the locally stored hash.

Go deeper

Related to this question