KC comes into work about 30 minutes early to start a ARP poisoned attack to sniff traffic between the workstation of a fellow coworker, Greg, and the domain controller. His boss compliments him for being so early and likes his work ethic.
KC waits until Greg comes to work logs in to the domain. He sniffs the passwords and spends the rest of the afternoon cracking it. What tool can be used to perform this entire sequence?
A) Rainbowcrack
B) L0phtcrack
C) Kerbcrack version 6
D) Cain and Abel

Question

Quizplus · Accepted Answer

This attack is possible if the Kerb-PreAuth key is captured. This one time a credential is exposed on a Windows network login attempt. The ARP poisoning was to defeat a switch and allow sniffing. Intrusion detection systems could have detected this part of the attack before it was successful.

KC Comes into Work About 30 Minutes Early to Start