CPENT Active Directory Attacks — 10 Questions

Question 1

A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?

Accepted Answer

AS-REP Roasting. AS-REP Roasting exploits accounts with the DONT_REQUIRE_PREAUTH flag set, which allows an attacker to request an AS-REP (Authentication Service Response) from the Key Distribution Center (KDC) without providing valid credentials. The KDC returns a response encrypted with the user's password hash, which can be captured and cracked offline. This attack is possible because pre-authentication is disabled, meaning the KDC does not verify the user's identity before issuing a ticket-granting ticket (TGT).

Answer

Silver Ticket Attack

Answer

DCShadow

Answer

Kerberoasting

Question 2

A penetration tester is attempting to perform Kerberoasting using Impacket. Which specific service principal name (SPN) format must be requested against the target domain controller to successfully extract TGS-AEAD tickets that can be cracked offline?

Accepted Answer

MSSQLSvc/sqlserver01.corp.local:1433. Kerberoasting targets accounts with a registered Service Principal Name (SPN). Requesting a TGS for an SPN like MSSQLSvc/sqlserver01.corp.local:1433 causes the KDC to encrypt the ticket with the service account's password hash, which can be extracted and cracked offline. The SPN must correspond to a user or service account whose password the attacker wants to crack.

Answer

CIFS/dc01.corp.local

Answer

LDAP/dc01.corp.local

Answer

HOST/dc01.corp.local

Question 3

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Accepted Answer

Forest-wide privilege escalation via SID History injection. When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.

Answer

AD CS ESC8 NTLM relay attacks

Answer

Standard Kerberoasting against domain controllers

Answer

Unconstrained delegation exploitation via print spooler

Question 4

Which TWO of the following Impacket tools can be utilized to perform credential dumping or secret extraction from Active Directory or target systems when valid administrator credentials are known?

Accepted Answer

goldenPac.py. goldenPac.py [CORRECT] is an Impacket tool that combines MS14-068 exploitation with PsExec-style execution to obtain a Kerberos golden ticket and then dump credentials from a domain controller, making it valid for secret extraction when admin credentials are known. secretsdump.py [CORRECT] is Impacket's dedicated tool for remotely extracting SAM, LSA secrets, cached credentials, and NTDS.dit hashes via SMB, WMI, VSS, or DRS-RPC using supplied administrator credentials. ntlmrelayx.py is used for NTLM relay attacks, not credential dumping, and GetUserSPNs.py performs Kerberoasting to request service tickets for offline cracking rather than extracting stored secrets. lookupsid.py enumerates SIDs over MS-RPC for user/group discovery and does not dump credentials or secrets.

Answer

ntlmrelayx.py

Answer

GetUserSPNs.py

Answer

lookupsid.py

Question 5

Which TWO methods can an operator use to mitigate or prevent detection while performing Kerberoasting during an internal penetration test?

Accepted Answer

Use AES encryption types exclusively to prevent RC4 weak encryption analysis. Option A is correct because requesting service tickets with AES encryption types (e.g., AES256-CTS-HMAC-SHA1-96) instead of RC4-HMAC avoids generating the weak, easily cracked RC4-encrypted TGS tickets that Kerberoasting typically relies on, and it also reduces the distinctive RC4 ticket-request patterns that defenders and EDR/NDR tooling flag. Option D is correct because requesting TGS tickets for a small set of specific target SPNs, rather than enumerating and bulk-requesting tickets for every SPN in the domain, minimizes the volume and burst of 4769 events that detection logic (e.g., many TGS requests from one account in a short window) keys on. Option B is wrong because disabling Kerberos pre-authentication on service accounts is an AS-REP Roasting condition, not a Kerberoasting mitigation, and it actually increases exposure rather than preventing detection. Option C is wrong because exporting NTDS.dit over SMB is a domain-database theft technique (e.g., via Volume Shadow Copy or DRSUAPI), unrelated to Kerberoasting and highly detectable in its own right. Option E is wrong because offline cracking of retrieved TGS tickets is the post-exploitation cracking step of Kerberoasting itself; it does not mitigate or prevent detection of the ticket-request activity on the network.

Answer

Disable Kerberos pre-authentication on all service accounts

Answer

Export the NTDS.dit database directly over SMB

Answer

Perform offline cracking using dictionary and rule-based attacks against the retrieved TGS tickets

Question 6

In the context of AD CS abuse, which THREE vulnerabilities or template settings are categorized under certificate template misconfigurations that allow privilege escalation?

Accepted Answer

ESC1: Enrollee supplies subject and template permits client authentication for low-privileged users. Option A (ESC1) is correct because a template that sets Enrollee Supplies Subject (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT) while also allowing Client Authentication lets a low-privileged user request a certificate with an arbitrary SAN (e.g., an administrator's UPN) and authenticate as that user, yielding privilege escalation. Option B (ESC4) is correct because when low-privileged principals hold Write/Modify or WriteDACL rights over a template object, they can reconfigure it into an ESC1-style template (enabling enrollee-supplied subject and client auth) and then abuse it for escalation. Option E (ESC8) is correct because HTTP-based AD CS enrollment endpoints (e.g., the Web Enrollment /certsrv interface) that lack HTTPS with Extended Protection for Authentication and channel binding can be coerced into NTLM relay, letting an attacker obtain a certificate for a machine or user account and escalate privileges. Option C (ESC10) is not a template misconfiguration vulnerability — strict certificate mapping with strong SID binding is a hardening measure, not an escalation path. Option D (LDAP signing enforced) is likewise a defensive control that mitigates relay attacks and is unrelated to certificate template misconfigurations.

Answer

ESC10: Strict certificate mapping and strong SID binding enforced

Answer

LDAP signing enforced across all domain controllers

Question 7

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

Accepted Answer

The Active Directory domain functional level must be Windows Server 2012 or higher.. Option B is correct because Resource-Based Constrained Delegation relies on the msDS-AllowedToActOnBehalfOfOtherIdentity attribute, which was introduced with the Windows Server 2012 schema and requires a domain functional level of Windows Server 2012 or higher to be available and functional. Option D is correct because RBCD requires a principal that the attacker controls to be configured as the trusted account in the target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute; this is commonly achieved by creating a computer object through the MachineAccountQuota (default 10) or by taking over an existing account. Option E is correct because the attacker must be able to write to the target computer object's msDS-AllowedToActOnBehalfOfOtherIdentity attribute, typically via GenericAll, GenericWrite, WriteProperty, or WriteDACL permissions, in order to set the controlled principal as allowed to delegate to the target. Option A is not required: SMB signing being disabled is relevant to NTLM relay techniques such as those used to obtain the initial write primitive, but it is not a condition for RBCD itself. Option C is not required: resetting the KRBTGT password twice is a remediation step to invalidate forged Kerberos tickets, not a prerequisite for performing an RBCD attack.

Answer

Domain controllers must have SMB signing disabled globally.

Answer

The KRBTGT account password must be reset twice to invalidate existing tickets.

Question 8

Which TWO commands or tools are standard for performing AS-REP Roasting against an Active Directory domain from an external or internal position?

Accepted Answer

Rubeus.exe asreproast. Option B, Rubeus.exe asreproast, is correct because Rubeus is a C# toolset for Kerberos abuse and its asreproast command specifically requests AS-REPs for accounts with Kerberos pre-authentication disabled, extracting crackable hashes. Option D, Impacket's GetNPUsers.py script, is correct because it is the standard Python Impacket utility that enumerates and requests AS-REPs for users without pre-auth, outputting hashes in a format suitable for offline cracking with tools like Hashcat or John. Option A is incorrect because secretsdump.py does not have an -asrep flag; it is used for dumping SAM, LSA secrets, and NTDS.dit, not for AS-REP Roasting. Option C is incorrect because SharpHound is a BloodHound collector for AD relationship mapping and does not perform AS-REP Roasting, and -CollectionMethod ASREP is not a valid SharpHound collection method. Option E is incorrect because certipy is an AD Certificate Services enumeration and abuse tool, not an AS-REP Roasting utility, and it has no asrep command.

Answer

secretsdump.py -asrep

Answer

SharpHound.exe -CollectionMethod ASREP

Answer

certipy asrep

Question 9

Which TWO tools are commonly used for analyzing BloodHound database outputs or querying attack paths during an Active Directory penetration test?

Accepted Answer

The BloodHound graphical user interface application. Option B, the BloodHound graphical user interface application, is correct because it is the primary tool for visualizing and analyzing the Neo4j-backed BloodHound database, allowing testers to run built-in queries and explore attack paths such as shortest paths to Domain Admins. Option E, bloodhound-python ingester, is correct because it is a Python-based collector/ingester that gathers AD data (users, groups, sessions, ACLs, trusts) and loads it into BloodHound's database, enabling subsequent querying of attack paths. Option A, Mimikatz sekurlsa::logonpasswords, is a credential-dumping command, not a BloodHound analysis or querying tool. Option C, Impacket's GetUserSPNs.py, is used for Kerberoasting to request service tickets, not for BloodHound output analysis. Option D, Certipy find, enumerates AD Certificate Services misconfigurations for ESC attacks, which is unrelated to querying BloodHound attack paths.

Answer

Mimikatz sekurlsa::logonpasswords

Answer

Impacket's GetUserSPNs.py

Answer

Certipy find

Question 10

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Accepted Answer

Executing Kerberoasting against service principal names to crack hashes offline. Avoiding LSASS interaction can be achieved via DCSync (DRSUAPI replication), Kerberoasting (offline cracking of TGS), and NTDS.dit extraction using Volume Shadow Copies (VSS).

Answer

Running procdump.exe against the lsass.exe process on the domain controller

Answer

Injecting DLL payloads into the Local Security Authority Subsystem Service