A network penetration tester successfully performs a man-in-the-middle attack on an internal network using ARP poisoning and captures NTLMv2 hashes. Which technique represents the correct next step to leverage this access?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because NTLMv2 hashes captured via MITM can be cracked offline with hashcat (requiring only the attacker's own hardware) or relayed in real-time to other services that accept NTLM authentication (NTLM relay attack, Responder + ntlmrelayx). C is wrong because NTLMv2 challenge-response hashes are not directly usable for Pass-the-Hash (which requires NT hashes, not NTLMv2 responses).
Full explanation below image
Full Explanation
A is correct because NTLMv2 hashes captured via MITM can be cracked offline with hashcat (requiring only the attacker's own hardware) or relayed in real-time to other services that accept NTLM authentication (NTLM relay attack, Responder + ntlmrelayx). C is wrong because NTLMv2 challenge-response hashes are not directly usable for Pass-the-Hash (which requires NT hashes, not NTLMv2 responses). B is wrong because forwarding hashes to the IT team before completing the assessment is premature and the hashes should be handled securely. D is wrong because submitting client credentials to external online services violates data handling obligations and confidentiality.