PEN-200 Password Attacks Practice Question
You have obtained a Windows domain user's NTLM hash and want to authenticate to a remote SMB service without cracking the hash or knowing the plaintext. Which tool and technique should you use to perform pass-the-hash against the target?
⚠ Common exam trap
Candidates often confuse pass-the-hash with password cracking or assuming any tool that handles SMB can accept a hash directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `crackmapexec smb <target> -u <user> -H <hash>` to authenticate with the NTLM hash.
Pass-the-hash allows an attacker to authenticate using the NTLM hash directly, bypassing the need to crack it. CrackMapExec (NetExec) is specifically designed for this and includes the `-H` flag to supply the hash. The other options either attempt to crack the hash, use tools that do not support hash authentication, or misconfigure the syntax. The correct approach leverages the hash as a credential in the NTLM challenge-response protocol.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use `crackmapexec smb <target> -u <user> -H <hash>` to authenticate with the NTLM hash.
Why this is correct
CrackMapExec (now NetExec) supports pass-the-hash via the `-H` flag, allowing SMB authentication with an NTLM hash without cracking it. It sends the hash in the NTLM authentication exchange, which the server accepts because it only verifies the hash. This is the standard method for lateral movement when only the hash is available, and it works against SMB services that permit NTLM authentication.
- ✗
Use `john --format=NT <hashfile>` to crack the hash and then log in with the recovered password.
Why it's wrong here
John the Ripper cracks the hash offline to recover the plaintext password, which is not pass-the-hash. The scenario specifies authenticating without cracking the hash or knowing the plaintext. While cracking may eventually yield the password, it is time-consuming and does not meet the requirement of using the hash directly for authentication. This approach is a fallback, not the requested technique.
- ✗
Use `smbclient -U <user>%<hash> //<target>/share` to authenticate with the hash.
Why it's wrong here
smbclient does not natively support pass-the-hash authentication. The `-U` option expects a username and password, not an NTLM hash. Although some SMB clients can be patched for pass-the-hash, the standard smbclient from Samba does not accept a hash in place of a password. Therefore, this command will fail to authenticate and is not a valid pass-the-hash method.
- ✗
Use `hydra -l <user> -P <hashfile> smb://<target>` to replay the hash as a password.
Why it's wrong here
Hydra's SMB module performs online password brute-forcing by sending plaintext passwords, not NTLM hashes. Supplying a hash file will cause Hydra to attempt each hash string as a password, which will fail because the server expects the plaintext password for NTLMv1/v2 authentication. Hydra cannot perform pass-the-hash; it is designed for credential guessing, not hash-based authentication.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.