Certified Ethical Hacker (CEH v10) — Question 138

In cryptanalysis and computer security, 'pass the hash' is a hacking technique that allows an attacker to authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a user's password, instead of requiring the associated plaintext password as is normally the case.
Metasploit Framework has a module for this technique: psexec. The psexec module is often used by penetration testers to obtain access to a given system whose credentials are known. It was written by sysinternals and has been integrated within the framework. The penetration testers successfully gain access to a system through some exploit, use meterpreter to grab the passwords or other methods like fgdump, pwdump, or cachedump and then utilize rainbowtables to crack those hash values.
Which of the following is true hash type and sort order that is used in the psexec module's 'smbpass' option?

Answer options

Correct answer: D

Explanation

The correct answer is D, LM:NTLM, as this specifies the order of the hash types used in the psexec module's 'smbpass' option. Options A, B, and C present the hash types in the wrong sequence or with incorrect naming, which would not align with how the psexec module operates.