Exam PT0-001 topic 1 question 154 discussion

out of the options I will go with C & D. hashcat and john the ripper have ability to crack passwords from hashes. mimikatz is used to retrieve the hashes (but hashes were already captured), psexec more for pass the hash.

b,cccccccccccccccc

looks good to me

This Question is in regards to cracking the "hashed passwords" not to grab more hashes or uncover clear text credentials. With that said, C and D are the proper choices.

I found this, sounds a bit logic Mimikatz is a popular post-exploitation tool that dumps passwords, hashes, PINs, and Kerberos tickets from memory. It also allows for pass-the-hash, pass-the-ticket, and the creation of Golden Kerberos tickets, which are all useful attacks. This facilitates attackers' post-exploitation lateral mobility inside a network. PSExec is used by attackers for the same reasons: it allows them to travel laterally and communicate with distant machines while using compromised credentials. When used in conjunction with mimikatz, psexec enables attackers to make a lateral move without the need for a plaintext password.

C, D The tester already has the hashs next is to crack the hashs

C,D :Hashcat is a very fast cracking tool that uses CPUs or GPUs to perform hash cracking. Typically, John the Ripper is the go-to for CPU-based cracking. However, when Hashcat uses GPUs for cracking, it can be much faster than CPU cracking, even with John.

https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ I was uncertain of PSExec, according to this yes?