OSCP Password Attacks 3

Question 1

Which tool is used to extract password hashes and plaintext credentials from Windows LSASS process memory?

Accepted Answer

Mimikatz

Answer

Mimikatz uses its sekurlsa module to extract plaintext passwords, NTLM hashes, and Kerberos tickets directly from LSASS memory.

Question 2

What Hashcat attack mode number (-a) is used for mask (pattern-based brute force) attacks?

Accepted Answer

-a 3

Answer

Hashcat's -a 3 performs mask attacks where character placeholders like ?u, ?l, and ?d define the password pattern to enumerate.

Question 3

Which Hashcat hash mode number (-m) is used to crack NTLM hashes?

Accepted Answer

1000

Answer

Hashcat mode 1000 (-m 1000) targets NTLM hashes, the standard Windows password hash format stored in the SAM database and LSASS.

Question 4

What is a pass-the-hash (PtH) attack?

Accepted Answer

Authenticating with a captured NTLM hash without needing the plaintext password

Answer

Pass-the-hash exploits NTLM by supplying the captured hash directly as the authentication credential, completely bypassing the need to crack it.

Question 5

Which Impacket script is commonly used to perform pass-the-hash attacks and obtain a remote shell on Windows systems?

Accepted Answer

impacket-psexec

Answer

impacket-psexec (psexec.py) accepts an NTLM hash via the -hashes flag (format: LM:NT) to authenticate and execute commands remotely.

OSCP Practice Test