312-50 Question 135
Single answer▪ Password CrackingDuring an authorized internal assessment, you obtain a copy of a Windows workstation's SAM and SYSTEM registry hives from a domain-joined but currently offline laptop. The client wants you to validate password strength as efficiently as possible without generating account lockouts or additional network traffic. Which approach is the MOST appropriate for cracking the stored Windows passwords in this scenario?
- A
Extract the NTLM password hashes from the SAM using the SYSTEM hive to recover the boot key, then perform an offline dictionary/rule-based attack with a tool such as Hashcat or John the Ripper
- B
Use Hydra to repeatedly authenticate against SMB on the laptop until valid credentials are found, because online guessing is faster than offline cracking
- C
Capture NTLMv2 challenge-response traffic with Responder from the offline laptop and crack the intercepted handshake
- D
Run a rainbow table attack directly against Kerberos tickets exported from memory, because SAM files primarily store Kerberos ticket data
Show answer and explanation
Correct answer: A
Explanation
The key to this scenario is recognizing the difference between offline and online password attacks. When a tester has acquired the SAM and SYSTEM hives from a Windows system, the standard workflow is to use the SYSTEM hive to obtain the boot key and then extract local account NTLM hashes from the SAM for offline cracking. This method is efficient, produces no authentication attempts, and therefore avoids account lockouts. In practice, tools such as Impacket's secretsdump, pwdump-style utilities, Hashcat, and John the Ripper are commonly used in this workflow. Online tools like Hydra are appropriate when testing live services, but they are the wrong choice when hashes are already available offline. Likewise, Responder is useful for capturing NetNTLM challenge-response exchanges on a network, not for processing registry hive data. This aligns with standard Windows credential handling and password auditing practices documented in Microsoft security architecture references and widely used password auditing tool documentation.
- A. Correct.
Correct. Windows stores local account password verifiers in the SAM, and the SYSTEM hive is needed to derive the boot key used to decrypt protected SAM secrets. Once NTLM hashes are extracted, the most appropriate method here is offline cracking with dictionary, mask, or rule-based attacks using tools such as Hashcat or John the Ripper. This avoids account lockouts and network noise, which matches the scenario requirements.
- B. Incorrect.
Incorrect. Hydra is commonly used for online password guessing against services such as SMB, RDP, SSH, or HTTP forms. In this scenario, the laptop is offline and the client explicitly wants to avoid lockouts and network traffic. Online authentication attempts would be noisier, slower, and risk triggering lockout policies if the host were reachable.
- C. Incorrect.
Incorrect. Responder is used to poison name resolution and capture authentication material such as NetNTLM challenge-response hashes on a live network. Because the target system is offline and you already possess the SAM and SYSTEM hives, there is no opportunity or need to capture NTLMv2 handshakes from network traffic.
- D. Incorrect.
Incorrect. SAM files do not primarily store Kerberos tickets; they store local account password data, including NTLM password hashes. Kerberos tickets are separate artifacts typically found in memory on active systems or in specific credential caches, not in the SAM database. Rainbow tables are also far less practical today for general use due to storage requirements and are not the direct fit for this artifact.