Exam SY0-601 topic 1 question 419 discussion

The command "crackmapexec smb" is used to perform password attacks against SMB protocol, which is used for file and printer sharing on Windows-based networks. The "-u" option specifies the username, while the "-H" option specifies the password hash. Therefore, the command is attempting to use a password hash to authenticate as the local administrator on the host with IP address 192.168.10.232. Based on this, the attack that occurred is Pass the Hash. This attack technique involves stealing password hashes from compromised machines and using them to authenticate to other machines on the network without knowing the actual passwords.

Passing-the-Hash CME supports authenticating via SMB using Passing-The-Hash attacks with the -H flag: crackmapexec smb <target(s)> -u username -H LMHASH:NTHASH crackmapexec smb <target(s)> -u username -H NTHASH

B. Pass the hash crackmapexec can run a pass the hash attack. From the man page: -H HASH [HASH ...], --hash HASH [HASH ...]

The command "crackmapexec smb 192.168.10.232 -u localadmin -H 0A3CE8D07A46E5C51070F03593E0A5E6" is attempting to use a stolen hash to access the SMB service on a host with IP address 192.168.10.232.

Pass The Hash is correct.

-B is correct The command crackmapexec smb is a tool used to perform attacks against SMB (Server Message Block) services running on Windows operating systems. The -u flag specifies a user account to use for authentication, and the -H flag specifies a password hash. In this case, the attacker used a password hash to authenticate as the localadmin user, without actually knowing the password. This technique is called Pass the Hash and is often used by attackers to escalate privileges or move laterally within a network.

B. Pass the Hash