In cryptanalysis and computer security, ‘pass the hash’ is a hacking technique that allows an attacker to
authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a user’s
password, instead of requiring the associated plaintext password as is normally the case.
Metasploit Framework has a module for this technique: psexec. The psexec module is often used by
penetration testers to obtain access to a given system that you already know the credentials for. It was written
by sysinternals and has been integrated within the framework. Often as penetration testers, successfully gain
access to a system through some exploit, use meterpreter to grab the passwords or other methods like
fgdump, pwdump, or cachedump and then utilize rainbowtables to crack those hash values.
Which of the following is true hash type and sort order that is using in the psexec module’s ‘smbpass’?
A.
NT:LM
B.
LM:NT
C.
LM:NTLM
D.
NTLM:LM