[Tools and Code Analysis] During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine. Which of the following tools should the penetration tester use to continue the attack?

CrackMapExec (CME) is a post-exploitation tool designed for Windows/Active Directory environments. Its primary function in this scenario is to perform a "Pass-the-Hash" (PtH) attack. Using the obtained NTLM hash, a tester can authenticate to other network services (like SMB) as the compromised user without needing the cleartext password. This enables lateral movement, enumeration of system permissions, and execution of commands on remote machines, thereby effectively "continuing the attack." CME automates this process across multiple targets, making it the most suitable tool for leveraging a compromised NTLM hash.

A. Responder: This tool is used to poison local network name resolution to capture authentication hashes, not to utilize a hash that has already been acquired.
B. Hydra: This is a generic password-cracking tool for online brute-force attacks. It requires a wordlist of passwords, not an NTLM hash, for authentication attempts.
C. BloodHound: This is a reconnaissance and analysis tool used to map attack paths within Active Directory. It does not use hashes to perform attacks like PtH.

1. Porchetta-Industries

CrackMapExec Wiki. The official documentation explicitly details the tool's capabilities

including Pass-the-Hash. The -H flag is specified for using a hash for authentication.

Reference: Porchetta-Industries. (n.d.). Authentication - CrackMapExec Wiki. GitHub. Retrieved from https://mpgn.gitbook.io/crackmapexec/getting-started/authentication (Section: "Passing the Hashes").

2. MITRE ATT&CK Framework. The framework identifies CrackMapExec as a tool used by adversaries to perform Pass the Hash attacks.

Reference: MITRE. (2023). Use Alternate Authentication Material: Pass the Hash

T1550.002. MITRE ATT&CK. Retrieved from https://attack.mitre.org/techniques/T1550/002/ (See "Procedure Examples" and associated software).

3. Black Hat USA 2017 Presentation. A presentation on the tool from a reputable security conference details its use in lateral movement with hashes.

Reference: B. byt3bl33d3r (2017). Owning the Enterprise with CrackMapExec. Black Hat USA 2017. https://www.blackhat.com/us-17/arsenal/schedule/index.html#owning-the-enterprise-with-crackmapexec-7258 (The tool's core purpose described is post-exploitation using credentials

including hashes).