Exam 312-50v12 topic 1 question 142 discussion

Actual exam question from ECCouncil's 312-50v12

Question #: 142
Topic #: 1

An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?

A. The SAM file has been encrypted using the SYSKEY function.
B. The passwords exceeded 14 characters in length and therefore, the LM hashes were set to a “dummy" value.
C. The Windows system is Vista or a later version, where LM hashes are disabled by default.
D. The Windows system is using the Kerberos authentication protocol as the default method.

Show Suggested Answer

Suggested Answer: C 🗳️

by qwerty100 at Feb. 6, 2024, 6:54 p.m.

Comments

Submit Cancel

duke_of_kamulu

12 months ago

C is the ANSWER How Hash Passwords Are Stored in Windows SAM is very clear in pg 587 that new version dont support LM correct answer C

upvoted 1 times

...

insaniunt

1 year ago

Selected Answer: C

New versions of Windows still support LM hashes for backward compatibility; however, Vista and later Windows versions disable LM hashes by default. The LM hash is blank in the newer versions of Windows.

upvoted 2 times

...

qwerty100

1 year ago

Selected Answer: C

The storage of LM hashes is disabled by default since Windows Vista and Windows Server 2008 https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview#passwords-stored-in-the-local-sam

upvoted 1 times

...