OSCP Password Attacks and Cracking 2 — Questions and Answers
Question 1: What is a rainbow table attack and why is it less effective against salted hashes?
- A precomputed table of hash-to-plaintext mappings; salting adds random data making each hash unique and invalidating precomputed tables (Correct answer)
- A GPU-accelerated brute-force attack; salting slows GPU computations
- A dictionary attack using colorful wordlists; salting encrypts the wordlist
- A network-based attack; salting hides the hash from network sniffers
Correct answer: A precomputed table of hash-to-plaintext mappings; salting adds random data making each hash unique and invalidating precomputed tables
Rainbow tables are precomputed hash-to-password lookup tables; adding a unique salt to each password before hashing means the same password produces different hashes, making precomputed tables useless.
Question 2: What does the Responder tool do and how is it used in OSCP for credential capture?
- It brute-forces passwords against network services
- It poisons LLMNR/NBT-NS/mDNS broadcast queries to capture NTLMv2 hashes from network hosts (Correct answer)
- It replays captured tickets against Kerberos services
- It performs ARP spoofing to intercept cleartext credentials
Correct answer: It poisons LLMNR/NBT-NS/mDNS broadcast queries to capture NTLMv2 hashes from network hosts
Responder responds to LLMNR, NBT-NS, and mDNS broadcast queries with poisoned responses, tricking Windows hosts into authenticating to the attacker's machine and capturing their NTLMv2 hashes.
Question 3: What hashcat command cracks an NTLM hash using the rockyou wordlist?
- hashcat -a 0 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt (Correct answer)
- hashcat -mode ntlm -list rockyou.txt hashes.txt
- hashcat --ntlm -w rockyou.txt -o cracked.txt
- hashcat -a 3 -m 0 hashes.txt ?a?a?a?a
Correct answer: hashcat -a 0 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
The command uses -a 0 for wordlist attack mode, -m 1000 which is the hashcat module number for NTLM hashes, then specifies the hash file and wordlist.
Question 4: What is the purpose of adding rules (like best64.rule) when cracking passwords with hashcat?
- Rules limit which hashes are targeted to the easiest 64 per run
- Rules apply transformations to wordlist words (capitalize, add numbers, leet speak) to create more password candidates (Correct answer)
- Rules set the maximum thread count for GPU cracking
- Rules filter out false positives from the cracking results
Correct answer: Rules apply transformations to wordlist words (capitalize, add numbers, leet speak) to create more password candidates
Hashcat rules apply mutations to each wordlist entry (e.g., capitalize, append digits, leet substitutions), dramatically expanding the candidate pool without requiring a larger wordlist.
Question 5: What are NTLMv2 challenge-response hashes and how are they typically cracked in OSCP?
- They are stored in the SAM database and cracked with secretsdump.py
- They are captured during authentication challenges (via Responder) and cracked offline with hashcat using module 5600 (Correct answer)
- They require a live connection to crack via pass-the-hash
- They are base64-encoded and can be decoded directly
Correct answer: They are captured during authentication challenges (via Responder) and cracked offline with hashcat using module 5600
NTLMv2 hashes are challenge-response authentication tokens captured from network traffic or via tools like Responder, and are cracked offline using hashcat module 5600 (NetNTLMv2).
Question 6: What is the CrackMapExec (CME/NetExec) tool primarily used for in OSCP Windows environments?
- Cracking captured password hashes offline
- Executing commands, spraying credentials, and enumerating Windows/AD environments over SMB/WinRM (Correct answer)
- Generating custom wordlists from target information
- Performing web application SQL injection attacks
Correct answer: Executing commands, spraying credentials, and enumerating Windows/AD environments over SMB/WinRM
CrackMapExec (now NetExec) is a Swiss army knife for Windows/AD environments, supporting credential spraying, command execution, secrets dumping, and enumeration over SMB, WinRM, LDAP, and MSSQL.
OSCP Password Attacks and Cracking 2
What is a rainbow table attack and why is it less effective against salted hashes?