PT0-002 Attacks and Exploits Practice Question

A penetration tester wants to crack NTLM hashes captured during an internal test. Which hashcat mode should the tester use for NTLM hashes?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

1000

Hashcat mode 1000 is specifically for NTLM hashes.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
0
Why it's wrong here
Mode 0 in Hashcat is the raw MD5 hash algorithm, which produces a 128-bit digest from arbitrary data. NTLM hashes are not MD5; they are based on the MD4 cryptographic hash function applied to the UTF-16LE encoded password, so using mode 0 would incorrectly interpret the captured hash format and fail to crack it.
✗
22000
Why it's wrong here
Mode 22000 is used for WPA-PBKDF2-PMKID and EAPOL-PMK, which target WPA/WPA2 wireless network handshakes. These hashes are derived from the PBKDF2 key derivation function with a salted password, completely unrelated to the MD4-based NTLM hash used in Windows authentication, so this mode is inappropriate for cracking NTLM hashes.
✓
1000
Why this is correct
Mode 1000 is the correct Hashcat mode for NTLM hashes, which are computed as MD4(UTF-16LE(password)). This mode directly tells Hashcat to treat the input as an NTLM hash and attempt password recovery using the correct algorithm, making it the only valid choice among the listed options for cracking captured NTLM hashes.
✗
13100
Why it's wrong here
Mode 13100 is designated for Kerberos 5 TGS-REP hashes, which are encrypted service tickets obtained from a Kerberos Key Distribution Center. These hashes use a different structure and encryption scheme (often AES or RC4) than NTLM hashes, and they are specific to Kerberos authentication rather than the NTLM challenge-response protocol, so mode 13100 would not process NTLM hashes correctly.

Go deeper