Question

During an internal penetration test, you dump the local SAM database on a compromised Windows workstation and recover the NTLM hash for a local administrator account. You discover that this same local admin account and password are reused across many hosts in the environment. The target hosts require NTLM authentication and you do not have the cleartext password. Which technique lets you authenticate to the other hosts and move laterally using only the recovered hash?

Accepted Answer

Pass-the-hash using a tool such as impacket-psexec or CrackMapExec with the NTLM hash

Answer

Kerberoasting to request and crack the service account TGS ticket offline

Answer

Perform an LLMNR/NBT-NS poisoning attack with Responder to relay credentials

Answer

Run a brute-force attack with Hydra against RDP using the hash as the password