Next Step After Capturing NTLMv2 Hashes with Responder

PT0-002 By islever Editorial Last updated Aug 29, 2026

Short answer

D Crack the hash with Hashcat.

Question

During the reconnaissance phase, a penetration tester runs the following command: sudo responder -I tun0 The result of the command is a list of NTLMv2 hashes. Which of the following should the penetration tester do next?

Use the hash in a password spraying attack.
Use the hashes in a collision attack.
Attempt to pass the hash with CrackMapExec.
Crack the hash with Hashcat. Correct Answer

Key Takeaways

The exam tests the difference between NTLM hashes (usable for pass-the-hash) and NTLMv2 challenge-response hashes (must be cracked offline). The common trap is assuming all captured hashes can be used for pass-the-hash.

In CompTIA PenTest+ PT0-002, capturing NTLMv2 hashes with Responder during reconnaissance typically leads to cracking them with Hashcat, as these hashes cannot be directly used in pass-the-hash attacks.

Common mistake: Choosing C (pass the hash with CrackMapExec) is the most common mistake because testers often confuse NTLM hashes with NTLMv2 hashes. NTLMv2 includes a challenge-response component that prevents direct pass-the-hash reuse.

Expert Analysis

Why the Answer Is Correct

Responder captures NTLMv2 hashes, which are challenge-response based and cannot be directly replayed in a pass-the-hash attack. The recommended next step is to crack the hash offline using a tool like Hashcat, which can attempt to recover the plaintext password. This aligns with the typical penetration testing workflow: gather credentials, crack them, then use the recovered password for lateral movement or further attacks.

Why the Other Options Are Wrong

Option C (pass the hash with CrackMapExec) is incorrect because NTLMv2 hashes require a challenge-response interaction; they cannot be used directly as NTLM hashes. Option B (collision attack) is irrelevant; hashcat cracking uses brute force or dictionary attacks, not cryptographic collisions. Option A (password spraying) is not the immediate next step; spraying is a separate attack that uses known passwords, not the harvested hash itself.

Community Comment Notes

Comment [2] correctly explains why pass-the-hash fails for NTLMv2, a key technical distinction. Comment [1] argues for pass-the-hash first due to speed, but this is operationally risky and not the best exam answer because the hash type is not compatible. Comment [3] simply agrees with D, reflecting the majority consensus among test-takers.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question mentions NTLMv2 hashes, remember that they need to be cracked first, not passed. Distinguish between NTLM and NTLMv2: NTLM can be used for pass-the-hash, while NTLMv2 requires offline cracking with Hashcat or John the Ripper.

Community Votes

71%

29%

71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

Snagggggin 👍 2 Answered C

I would argue that passing the hash is much quicker and there is no guarantee the hash can be cracked. I believe it would be better to first attempt passing the hash and getting into the machine, if unsuccessful then you can easily pivot to cracking the hash.
kinny4000 👍 1 Answered D

The NTLMv2 hash cannot be used in a Pass-the-Hash (PtH) attack directly because it includes a challenge-response mechanism.
Snagggggin 👍 4 Answered D

D is correct.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to PT0-002 Study Guide