whether the SSID is default or not - it is still can be seen easilly and this is the point
good luck with your exam

can you please be more specific about the conditions/limitations? the first answer that comes into the head is "sudo cat /etc/shadow"

i guess some other way to be a hero like saving rainforests etc. is more ethical
if you still need that kind of fame i'll suggest using several widely available online ntlm password "decrypting" sites

even if the threadstarter is not visiting - this software is worth to mention

http://golubev.com/rargpu.htm

Ants, frankly speaking, I doubt that anybody truly "ethical" will be able to provide you with a statistically-enough list of real-life hashes, i guess you should seek for more online password-cracking services/communities which have lists of cracked/uncracked hashes
for example:
http://cryptohaze.com/exporthashes.php
http://hash.insidepro.com
https://hashcracking.info/index.php?4
etc.

p.s. if speaking about statistics - have you seen John the Rippers's charsets and "Markovian filter" introduced lately in jumbo patches?

and you'll qualify for 40 ISC2 CPE Credits for OSCP certification, which is a good addition i think