312-50 Question 134
Single answer▪ Password CrackingDuring an internal authorized assessment, you obtain a copy of a Linux server's password hashes from /etc/shadow after gaining privileged access. The hashes use SHA-512 crypt format ($6$) with unique salts. The client wants you to identify weak passwords as efficiently as possible without generating additional network traffic or risking account lockouts. Which approach is the MOST appropriate?
- A
Perform an offline dictionary attack with rule-based mutations against the extracted hashes using a password-cracking tool such as John the Ripper or Hashcat
- B
Use a password spraying attack against the SSH service with a few common passwords to avoid locking out individual accounts
- C
Run a pass-the-hash attack against the Linux server because the SHA-512 hashes can be reused directly for authentication
- D
Capture another copy of the hashes and use rainbow tables to reverse the salted SHA-512 crypt hashes quickly
Show answer and explanation
Correct answer: A
Explanation
The key decision point is distinguishing offline password cracking from online guessing attacks. Once password hashes have been extracted from /etc/shadow, the assessor should crack them offline to avoid interacting further with production authentication services. Linux SHA-512 crypt hashes identified by the $6$ prefix include salts, which make rainbow tables impractical and require candidate passwords to be hashed with the same parameters during cracking. Rule-based dictionary attacks are often the best first step because they are efficient against common enterprise password habits. This aligns with standard password auditing practices supported by tools such as John the Ripper and Hashcat. From a best-practice standpoint, offline analysis minimizes operational risk, avoids account lockouts, and reduces detection compared with online attacks such as password spraying.
- A. Correct.
Correct. Because the assessor already has the password hashes, the safest and most efficient method is offline cracking. A dictionary attack combined with rule-based mutations targets realistic weak-password patterns such as season-year variations, appended digits, and simple substitutions. This avoids additional authentication attempts against live services, so it does not create network noise or trigger account lockout policies. Tools such as John the Ripper and Hashcat are commonly used for this purpose and support Linux crypt formats including SHA-512 crypt ($6$).
- B. Incorrect.
Incorrect. Password spraying is an online attack technique performed against a live authentication service. Even though spraying is designed to reduce the chance of lockouts compared to brute forcing a single account, it still generates network traffic and can trigger monitoring, alerts, or account lockout thresholds depending on policy. In this scenario, offline cracking is explicitly preferable because the hashes have already been obtained.
- C. Incorrect.
Incorrect. Pass-the-hash is primarily associated with protocols and authentication mechanisms that accept reusable hash material directly, such as certain Windows authentication scenarios involving NTLM. Standard Linux password verification with /etc/shadow SHA-512 crypt hashes does not allow the extracted hash to be directly replayed for authentication in the same way. The misconception is assuming all password hashes are reusable authentication tokens.
- D. Incorrect.
Incorrect. Rainbow tables are not well suited to modern salted password hashes. Unique salts significantly reduce the effectiveness of precomputed lookup tables because a separate table would be needed for each salt value. For salted SHA-512 crypt hashes, targeted offline cracking with dictionaries, masks, or rules is far more practical than relying on rainbow tables.