CPENT Active Directory Attacks — 20 Questions

Question 1

A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

KRB5CCNAME. Impacket tools rely on the KRB5CCNAME environment variable to locate and parse the Kerberos credential cache file when performing operations with domain credentials via Kerberos.

Answer

KRB_TICKET_PATH

Answer

KERBEROS_CACHE

Answer

AD_TICKET_FILE

Question 2

An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?

Accepted Answer

ticketer.py. ticketer.py from the Impacket framework allows operators to forge custom Kerberos Golden and Silver tickets offline given the correct secret keys.

Answer

getTGT.py

Answer

goldenPac.py

Answer

raiseChild.py

Question 3

When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?

Accepted Answer

SharpHound.exe -CollectionMethod LocalAdmin. SharpHound uses the Session and LocalAdmin collection methods by default or explicitly specified via the -CollectionMethod flag to enumerate local administrators via API calls.

Answer

SharpHound.exe -CollectionMethod GPOChanges

Answer

SharpHound.exe -CollectionMethod TrustList

Answer

SharpHound.exe -CollectionMethod DCOptions

Question 4

A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?

Accepted Answer

AS-REP Roasting. AS-REP Roasting targets accounts where pre-authentication is disabled, allowing an attacker to request an AS-REP response containing ticket material encrypted with the user's password hash and crack it offline.

Answer

Silver Ticket Attack

Answer

DCShadow

Answer

Kerberoasting

Question 5

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

Accepted Answer

The template allows enrollees to supply alternate subject names (SAN) and authorizes low-privileged users to enroll with client authentication EKUs.. ESC1 occurs when a certificate template permits enrollment by low-privileged users, allows supply of an alternate subject (ENROLLEE_SUPPLIES_SUBJECT), and includes client authentication EKUs.

Answer

The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.

Answer

The template publishes certificates to Active Directory user objects automatically.

Answer

The template has Manager Approval enabled and requires enterprise admin signatures.

Question 6

During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?

Accepted Answer

Pass-the-Hash. Pass-the-Hash (PtH) involves using a captured NTLM hash directly for authentication without needing the plaintext password, leveraging the challenge-response mechanism of the NTLM protocol.

Answer

Pass-the-Ticket

Answer

Kerberoasting

Answer

Over-Pass-the-Hash

Question 7

An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?

Accepted Answer

Configure msDS-AllowedToActOnBehalfOfOtherIdentity to point to a controlled account, enabling Resource-Based Constrained Delegation.. GenericAll permissions on a computer object allow an attacker to modify the servicePrincipalName attribute or reset the computer password, but more commonly allows writing explicit delegation or adding user rights. Alternatively, adding a user to local groups via WinRM or modifying msDS-AllowedToActOnBehalfOfOtherIdentity enables constrained delegation abuse.

Answer

Modify the user's PrimaryGroupID to map to Domain Admins directly.

Answer

Execute a DCSync attack against the computer object's registry hive.

Answer

Directly modify the local SAM database of the target computer over RPC without credentials.

Question 8

A penetration tester is attempting to perform Kerberoasting using Impacket. Which specific service principal name (SPN) format must be requested against the target domain controller to successfully extract TGS-AEAD tickets that can be cracked offline?

Accepted Answer

MSSQLSvc/sqlserver01.corp.local:1433. Kerberoasting targets service principal names mapped to user accounts rather than machine accounts. Impacket's GetUserSPNs.py queries the Global Catalog for user accounts with a non-null servicePrincipalName attribute.

Answer

CIFS/dc01.corp.local

Answer

LDAP/dc01.corp.local

Answer

HOST/dc01.corp.local

Question 9

Which Active Directory right or permission allows a security principal to perform a DCSync attack, thereby replicating domain secrets?

Accepted Answer

DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. DCSync functionality requires the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights on the domain root object.

Answer

GenericAll over thekrbtgt account

Answer

FullControl over the Domain Controllers OU

Answer

WriteDACL on the builtin Administrators group

Question 10

A tester has located a domain user account configured with Constrained Delegation (S4U2Self / S4U2Proxy) pointing to a target service. What tool and module in Impacket can be used to leverage this delegation to obtain a TGS for a privileged user (e.g., Administrator)?

Accepted Answer

getST.py. Impacket's getST.py (GetServiceName / Get-ServiceTicket) implements Service for User (S4U) extensions to impersonate arbitrary users to targeted services using constrained delegation.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

addcomputer.py

Question 11

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

Accepted Answer

certipy req -u user@corp.local -p password -target ca.corp.local -template VulnerableTemplate -upn administrator@corp.local. Certipy is an industry-standard tool for auditing and abusing Active Directory Certificate Services. The 'certipy req' command handles certificate requests using specified templates and alternate subject names.

Answer

certipy shadow -username user -target dc01

Answer

certipy ca -backup -ca "corp-CA-1"

Answer

certipy template -update VulnerableTemplate -enrollee-supplies-subject True

Question 12

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Accepted Answer

Forest-wide privilege escalation via SID History injection. When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.

Answer

AD CS ESC8 NTLM relay attacks

Answer

Standard Kerberoasting against domain controllers

Answer

Unconstrained delegation exploitation via print spooler

Question 13

An auditor is reviewing Active Directory Certificate Services and identifies ESC8. What exact AD CS endpoint is exploited during an ESC8 attack vector?

Accepted Answer

The HTTP-based Web Enrollment (certsrv/) or Certificate Enrollment Web Service endpoints. ESC8 exploits AD CS Web Enrollment or Certificate Enrollment Web Services endpoints that have HTTP enabled and permit NTLM authentication, allowing NTLM relay from coerced machine accounts.

Answer

The Kerberos Key Distribution Center service on port 88

Answer

The LDAP signing and LDAP channel binding endpoints on port 636

Answer

The RPC-based DCOM interface on port 135

Question 14

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Accepted Answer

AddMember. In BloodHound, the 'GenericAll', 'GenericWrite', 'WriteDACL', or 'WriteOwner' edges denote modification rights, while 'MemberOf' indicates group membership. Specifically, 'AddMember' or 'GenericAll'/'GenericWrite' on group objects indicates control over membership.

Answer

AllowedToDelegate

Answer

ReadLAPSPassword

Answer

CoerceTo

Question 15

A penetration tester is performing an attack utilizing the PetitPotam (MS-EFSR) vulnerability against a domain controller. What is the primary objective of forcing the domain controller to authenticate via PetitPotam?

Accepted Answer

To coerce the domain controller's machine account to authenticate to an NTLM relay listener targeting AD CS.. PetitPotam coerces an authenticating machine (like a DC) to connect to an attacker-controlled listener via SMB or HTTP, which can then be relayed to Active Directory Certificate Services (AD CS) HTTP enrollment endpoints (ESC8) for NTLM relay attacks.

Answer

To corrupt the NTDS.dit database file on the remote domain controller.

Answer

To extract the plaintext password of the domain administrator from the LSASS process memory.

Answer

To bypass Kerberos pre-authentication requirements on user accounts.

Question 16

When generating a Silver Ticket using Impacket's ticketer.py, what specific piece of cryptographic material is required instead of the KRBTGT hash?

Accepted Answer

The NTLM password hash of the specific service account. A Silver Ticket is forged for a specific service using the NTLM hash of the service account running that service (e.g., MSSQL or CIFS service account), rather than the KRBTGT hash.

Answer

The plaintext password of the Domain Administrator

Answer

The Domain Controller's computer account machine password

Answer

The domain root CA private key (.pfx)

Question 17

An operator has discovered a computer object with Unconstrained Delegation enabled in Active Directory. How can this configuration be abused if a Domain Administrator account can be coerced to authenticate to it?

Accepted Answer

Capture the coerced Domain Admin's TGT from the machine's memory to impersonate them across the domain.. When unconstrained delegation is enabled, any service ticket sent to the machine caches the authenticating user's TGT in memory. If a Domain Admin authenticates (e.g., via PrinterBug), the operator can extract the cached TGT and perform DCSync.

Answer

Extract the NTLM hash of the domain controller directly from the SYSVOL share.

Answer

Forge a Kerberos ticket using the machine account's local SAM database.

Answer

Modify group policy objects via unauthenticated LDAP queries.

Question 18

A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?

Accepted Answer

WriteProperty, GenericAll, or GenericWrite over the msDS-KeyCredentialLink attribute / target object. Shadow credentials involve writing to the msDS-KeyCredentialLink attribute of an Active Directory object. Therefore, the attacker must have WriteProperty, GenericAll, or GenericWrite privileges over the target object.

Answer

ReadLAPSPassword extended right

Answer

DS-Replication-Get-Changes-All domain right

Answer

SeEnableDelegationPrivilege on the domain controller

Question 19

Which native Windows command-line tool can be used by a penetration tester to view cached Kerberos tickets currently loaded in the user session?

Accepted Answer

klist. klist is the built-in Windows utility used to query, display, and purge Kerberos tickets and ticket-granting tickets in the current logon session.

Answer

ticketmgr

Answer

winrm get tickets

Answer

kerbuse

Question 20

A penetration tester is evaluating an Active Directory environment and discovers that LDAP signing is not enforced. Which attack technique does this misconfiguration directly facilitate?

Accepted Answer

LDAP NTLM Relay. Lack of LDAP signing allows attackers to perform NTLM relay attacks against LDAP endpoints (port 389), potentially granting privileges like object creation or group modifications.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

Golden Ticket forgery