CPENT Active Directory Attacks — 25 Questions

Question 1

A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?

Accepted Answer

AS-REP Roasting. AS-REP Roasting exploits accounts with the DONT_REQUIRE_PREAUTH flag set, which allows an attacker to request an AS-REP (Authentication Service Response) from the Key Distribution Center (KDC) without providing valid credentials. The KDC returns a response encrypted with the user's password hash, which can be captured and cracked offline. This attack is possible because pre-authentication is disabled, meaning the KDC does not verify the user's identity before issuing a ticket-granting ticket (TGT).

Answer

Silver Ticket Attack

Answer

DCShadow

Answer

Kerberoasting

Question 2

A penetration tester is attempting to perform Kerberoasting using Impacket. Which specific service principal name (SPN) format must be requested against the target domain controller to successfully extract TGS-AEAD tickets that can be cracked offline?

Accepted Answer

MSSQLSvc/sqlserver01.corp.local:1433. Kerberoasting targets accounts with a registered Service Principal Name (SPN). Requesting a TGS for an SPN like MSSQLSvc/sqlserver01.corp.local:1433 causes the KDC to encrypt the ticket with the service account's password hash, which can be extracted and cracked offline. The SPN must correspond to a user or service account whose password the attacker wants to crack.

Answer

CIFS/dc01.corp.local

Answer

LDAP/dc01.corp.local

Answer

HOST/dc01.corp.local

Question 3

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Accepted Answer

Forest-wide privilege escalation via SID History injection. When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.

Answer

AD CS ESC8 NTLM relay attacks

Answer

Standard Kerberoasting against domain controllers

Answer

Unconstrained delegation exploitation via print spooler

Question 4

Which TWO of the following Impacket tools can be utilized to perform credential dumping or secret extraction from Active Directory or target systems when valid administrator credentials are known?

Accepted Answer

goldenPac.py. goldenPac.py [CORRECT] is an Impacket tool that combines MS14-068 exploitation with PsExec-style execution to obtain a Kerberos golden ticket and then dump credentials from a domain controller, making it valid for secret extraction when admin credentials are known. secretsdump.py [CORRECT] is Impacket's dedicated tool for remotely extracting SAM, LSA secrets, cached credentials, and NTDS.dit hashes via SMB, WMI, VSS, or DRS-RPC using supplied administrator credentials. ntlmrelayx.py is used for NTLM relay attacks, not credential dumping, and GetUserSPNs.py performs Kerberoasting to request service tickets for offline cracking rather than extracting stored secrets. lookupsid.py enumerates SIDs over MS-RPC for user/group discovery and does not dump credentials or secrets.

Answer

ntlmrelayx.py

Answer

GetUserSPNs.py

Answer

lookupsid.py

Question 5

Which TWO methods can an operator use to mitigate or prevent detection while performing Kerberoasting during an internal penetration test?

Accepted Answer

Use AES encryption types exclusively to prevent RC4 weak encryption analysis. Option A is correct because requesting service tickets with AES encryption types (e.g., AES256-CTS-HMAC-SHA1-96) instead of RC4-HMAC avoids generating the weak, easily cracked RC4-encrypted TGS tickets that Kerberoasting typically relies on, and it also reduces the distinctive RC4 ticket-request patterns that defenders and EDR/NDR tooling flag. Option D is correct because requesting TGS tickets for a small set of specific target SPNs, rather than enumerating and bulk-requesting tickets for every SPN in the domain, minimizes the volume and burst of 4769 events that detection logic (e.g., many TGS requests from one account in a short window) keys on. Option B is wrong because disabling Kerberos pre-authentication on service accounts is an AS-REP Roasting condition, not a Kerberoasting mitigation, and it actually increases exposure rather than preventing detection. Option C is wrong because exporting NTDS.dit over SMB is a domain-database theft technique (e.g., via Volume Shadow Copy or DRSUAPI), unrelated to Kerberoasting and highly detectable in its own right. Option E is wrong because offline cracking of retrieved TGS tickets is the post-exploitation cracking step of Kerberoasting itself; it does not mitigate or prevent detection of the ticket-request activity on the network.

Answer

Disable Kerberos pre-authentication on all service accounts

Answer

Export the NTDS.dit database directly over SMB

Answer

Perform offline cracking using dictionary and rule-based attacks against the retrieved TGS tickets

Question 6

In the context of AD CS abuse, which THREE vulnerabilities or template settings are categorized under certificate template misconfigurations that allow privilege escalation?

Accepted Answer

ESC1: Enrollee supplies subject and template permits client authentication for low-privileged users. Option A (ESC1) is correct because a template that sets Enrollee Supplies Subject (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT) while also allowing Client Authentication lets a low-privileged user request a certificate with an arbitrary SAN (e.g., an administrator's UPN) and authenticate as that user, yielding privilege escalation. Option B (ESC4) is correct because when low-privileged principals hold Write/Modify or WriteDACL rights over a template object, they can reconfigure it into an ESC1-style template (enabling enrollee-supplied subject and client auth) and then abuse it for escalation. Option E (ESC8) is correct because HTTP-based AD CS enrollment endpoints (e.g., the Web Enrollment /certsrv interface) that lack HTTPS with Extended Protection for Authentication and channel binding can be coerced into NTLM relay, letting an attacker obtain a certificate for a machine or user account and escalate privileges. Option C (ESC10) is not a template misconfiguration vulnerability — strict certificate mapping with strong SID binding is a hardening measure, not an escalation path. Option D (LDAP signing enforced) is likewise a defensive control that mitigates relay attacks and is unrelated to certificate template misconfigurations.

Answer

ESC10: Strict certificate mapping and strong SID binding enforced

Answer

LDAP signing enforced across all domain controllers

Question 7

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

Accepted Answer

The Active Directory domain functional level must be Windows Server 2012 or higher.. Option B is correct because Resource-Based Constrained Delegation relies on the msDS-AllowedToActOnBehalfOfOtherIdentity attribute, which was introduced with the Windows Server 2012 schema and requires a domain functional level of Windows Server 2012 or higher to be available and functional. Option D is correct because RBCD requires a principal that the attacker controls to be configured as the trusted account in the target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute; this is commonly achieved by creating a computer object through the MachineAccountQuota (default 10) or by taking over an existing account. Option E is correct because the attacker must be able to write to the target computer object's msDS-AllowedToActOnBehalfOfOtherIdentity attribute, typically via GenericAll, GenericWrite, WriteProperty, or WriteDACL permissions, in order to set the controlled principal as allowed to delegate to the target. Option A is not required: SMB signing being disabled is relevant to NTLM relay techniques such as those used to obtain the initial write primitive, but it is not a condition for RBCD itself. Option C is not required: resetting the KRBTGT password twice is a remediation step to invalidate forged Kerberos tickets, not a prerequisite for performing an RBCD attack.

Answer

Domain controllers must have SMB signing disabled globally.

Answer

The KRBTGT account password must be reset twice to invalidate existing tickets.

Question 8

Which TWO commands or tools are standard for performing AS-REP Roasting against an Active Directory domain from an external or internal position?

Accepted Answer

Rubeus.exe asreproast. Option B, Rubeus.exe asreproast, is correct because Rubeus is a C# toolset for Kerberos abuse and its asreproast command specifically requests AS-REPs for accounts with Kerberos pre-authentication disabled, extracting crackable hashes. Option D, Impacket's GetNPUsers.py script, is correct because it is the standard Python Impacket utility that enumerates and requests AS-REPs for users without pre-auth, outputting hashes in a format suitable for offline cracking with tools like Hashcat or John. Option A is incorrect because secretsdump.py does not have an -asrep flag; it is used for dumping SAM, LSA secrets, and NTDS.dit, not for AS-REP Roasting. Option C is incorrect because SharpHound is a BloodHound collector for AD relationship mapping and does not perform AS-REP Roasting, and -CollectionMethod ASREP is not a valid SharpHound collection method. Option E is incorrect because certipy is an AD Certificate Services enumeration and abuse tool, not an AS-REP Roasting utility, and it has no asrep command.

Answer

secretsdump.py -asrep

Answer

SharpHound.exe -CollectionMethod ASREP

Answer

certipy asrep

Question 9

Which TWO tools are commonly used for analyzing BloodHound database outputs or querying attack paths during an Active Directory penetration test?

Accepted Answer

The BloodHound graphical user interface application. Option B, the BloodHound graphical user interface application, is correct because it is the primary tool for visualizing and analyzing the Neo4j-backed BloodHound database, allowing testers to run built-in queries and explore attack paths such as shortest paths to Domain Admins. Option E, bloodhound-python ingester, is correct because it is a Python-based collector/ingester that gathers AD data (users, groups, sessions, ACLs, trusts) and loads it into BloodHound's database, enabling subsequent querying of attack paths. Option A, Mimikatz sekurlsa::logonpasswords, is a credential-dumping command, not a BloodHound analysis or querying tool. Option C, Impacket's GetUserSPNs.py, is used for Kerberoasting to request service tickets, not for BloodHound output analysis. Option D, Certipy find, enumerates AD Certificate Services misconfigurations for ESC attacks, which is unrelated to querying BloodHound attack paths.

Answer

Mimikatz sekurlsa::logonpasswords

Answer

Impacket's GetUserSPNs.py

Answer

Certipy find

Question 10

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Accepted Answer

Executing Kerberoasting against service principal names to crack hashes offline. Avoiding LSASS interaction can be achieved via DCSync (DRSUAPI replication), Kerberoasting (offline cracking of TGS), and NTDS.dit extraction using Volume Shadow Copies (VSS).

Answer

Running procdump.exe against the lsass.exe process on the domain controller

Answer

Injecting DLL payloads into the Local Security Authority Subsystem Service

Question 11

During an internal penetration test, an operator compromises a low-privileged domain user account and wishes to perform a Kerberoasting attack to harvest service principal name (SPN) tickets. Which standard utility included with Windows PowerShell or Sysinternals can be used to request these tickets without administrative privileges?

Accepted Answer

Invoke-Kerberoast via PowerView. Invoke-Kerberoast, part of the PowerView toolkit (PowerSploit), is designed specifically to enumerate accounts with Service Principal Names (SPNs) and request Kerberos service tickets (TGS) for them using the current user's context—no administrative rights required. It then extracts the ticket hashes in a format suitable for offline cracking (e.g., Hashcat mode 13100). Because any authenticated domain user can request a TGS for any SPN, this attack works from a low-privileged foothold.

Answer

Mimikatz lsadump::dcsync

Answer

Get-ADDefaultDomainPasswordPolicy

Answer

ntdsutil.vbs snapshot

Question 12

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

Accepted Answer

The template includes the Certificate Request Agent EKU (Enrollment Agent functionality).. Option A is correct because ESC3 requires a template that grants the Certificate Request Agent EKU (OID 1.3.6.1.4.1.311.20.2.1), which lets a principal act as an enrollment agent and request certificates on behalf of other users. Option B is correct because the attacker must be able to enroll in that enrollment-agent template, so low-privileged users holding Enroll or Autoenroll rights over it is what makes the abuse reachable. Option D is correct because if the target template lacks application policy constraints or authorized signature requirements (or they are set too permissively), the enrollment agent can request a certificate for any purpose and impersonate arbitrary users, which is the core of ESC3. Option C is not part of ESC3, since manager approval is a separate control and does not by itself enable enrollment-agent abuse. Option E is not relevant, as the domain functional level does not determine whether an enrollment-agent template can be abused.

Answer

The CA requires Manager Approval for all issued certificates.

Answer

The domain functional level is set to Windows Server 2003.

Question 13

Which TWO methods can an operator use to verify whether an account has successfully been granted DCSync privileges after modifying access control lists (ACLs)?

Accepted Answer

Query the domain object ACLs using PowerView's Get-DomainObjectAcl cmdlet.. Option B is correct because PowerView's Get-DomainObjectAcl cmdlet reads the domain object's security descriptor and enumerates the ACEs, allowing the operator to confirm whether the modified account now holds the extended rights that enable DCSync, specifically the Replicating Directory Changes (DS-Replication-Get-Changes) and Replicating Directory Changes All (DS-Replication-Get-Changes-All) GUIDs on the domain NC head. Option C is correct because secretsdump.py performs the actual DCSync attack by invoking DRSUAPI (Directory Replication Service) calls such as DRSGetNCChanges; if the account has been granted the replication rights, it will successfully pull domain hashes, providing functional proof of the privilege. Option A is incorrect because the local SAM database registry hive stores local account hashes and has no bearing on domain-level replication ACLs. Option D is incorrect because SharpHound's LocalAdmin collection flag gathers local administrator relationships, not domain object ACLs or DCSync rights. Option E is incorrect because klist only displays cached Kerberos tickets and their lifetimes, which reveals nothing about ACL-based replication privileges.

Answer

Inspect the local SAM database registry hive.

Answer

Run SharpHound with the LocalAdmin collection flag.

Answer

Run klist to check cached Kerberos ticket lifetimes.

Question 14

A penetration tester has compromised an account that possesses the 'GenericAll' permission over a Group Policy Object (GPO) linked to the domain. How can this permission be leveraged to achieve remote code execution across systems affected by the GPO?

Accepted Answer

Modify the GPO's SYSVOL folder contents to inject a malicious Immediate Task or startup script. Having GenericAll or WriteProperty rights over a GPO allows an attacker to modify the GPO settings, such as adding a Scheduled Task or an Immediate Task via 'Preferences -> Control Panel Settings -> Scheduled Tasks', which will execute commands on targets processing that GPO.

Answer

Extract domain administrator password hashes directly from the GPO ACL metadata

Answer

Request a TGT ticket with custom PAC extensions via Kerberos delegation

Question 15

During an Active Directory assessment, an operator discovers that the KRBTGT account password has not been rotated in over ten years. They decide to craft a Golden Ticket to maintain persistent domain-wide access. Which critical piece of information, in addition to the KRBTGT NTLM hash and domain SID, is strictly required to generate a fully valid Golden Ticket that includes group membership and privilege attributes?

Accepted Answer

The NTLM hash of the KRBTGT account and the Domain SID. A Golden Ticket is a forged Kerberos TGT (Ticket Granting Ticket) encrypted and signed with the KRBTGT account's NTLM hash. To create a valid TGT, the attacker must know the KRBTGT NTLM hash (to encrypt the ticket) and the domain SID (to construct the PAC and set the group memberships correctly). With these two pieces, tools like Mimikatz can generate a TGT that includes arbitrary group memberships (e.g., Domain Admins) and privileges, granting domain-wide access. The question explicitly states that the operator already has the KRBTGT hash and domain SID, so no additional information is strictly required beyond what is listed in option A.

Answer

The Enterprise Admin public key certificate stored in the NTDS.dit

Answer

An active session token issued by the Active Directory Certificate Services (AD CS)

Answer

The plaintext password of the Domain Administrator and SYSVOL shared secret

Question 16

An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)

Accepted Answer

Add a compromised or attacker-controlled user account to the privileged group using PowerView or net group. Option C is correct because GenericAll or WriteDacl over a privileged group like Domain Admins allows the operator to add an attacker-controlled or compromised account directly to that group, for example with PowerView's Add-DomainGroupMember or the built-in net group command, which immediately grants the new member all of the group's privileges. Option E is correct because WriteDacl specifically permits modifying the object's security descriptor, so the operator can use PowerView (e.g., Add-DomainObjectAcl) to grant their own user GenericAll or AddMember rights over the group, enabling subsequent membership changes even if direct add rights were not initially present. Option A is incorrect because Kerberoasting targets service accounts with SPNs by requesting TGS tickets and cracking them offline; it is not performed against the Active Directory Web Services endpoint and is unrelated to group ACL permissions. Option B is incorrect because the SAM hive stores local account hashes and cannot be extracted remotely via ping.exe, which is only an ICMP utility and has no file-read or registry-access capability. Option D is incorrect because the krbtgt account password cannot be reset through Group Policy Preferences, and doing so requires domain controller-level privileges and careful double-reset procedures, not group ACL rights.

Answer

Execute a Kerberoasting attack against the Active Directory Web Services endpoint

Answer

Extract plaintext passwords from the Windows Registry SAM hive remotely using ping.exe

Answer

Force an immediate password reset of the krbtgt account via Group Policy Preferences

Question 17

A penetration tester has obtained the NT hash of a domain user account through credential dumping. The tester wants to authenticate to a remote server using this hash without knowing the plaintext password. Which Impacket tool should the tester use?

Accepted Answer

atexec.py. The correct answer is atexec.py because it is specifically built to execute commands via the Task Scheduler and supports pass-the-hash authentication using the -hashes option. This allows the tester to use the NT hash to authenticate to the remote server and run commands, achieving the objective without knowing the plaintext password.

Answer

wmiexec.py

Answer

smbclient.py

Answer

psexec.py

Question 18

During an internal penetration test, you have obtained the NTLM hash of a domain user account that has local administrative rights on a workstation. You want to move laterally to another workstation in the same domain using only this hash, without knowing the plaintext password. Which technique and tool combination would allow you to execute a remote command on the target workstation?

Accepted Answer

Use Impacket's psexec.py with the -hashes option, specifying the LM:NT hash pair, to authenticate and execute a command.. The correct answer is Impacket's psexec.py with the -hashes option. This tool explicitly supports pass-the-hash authentication, allowing an operator to use an NTLM hash to authenticate to a remote system and execute commands. It is a standard and reliable method for lateral movement in Active Directory environments when only a hash is available. Other options either require additional steps, are less direct, or do not natively support hash-based authentication in the same way.

Answer

Use CrackMapExec with the -H option to pass the hash and execute a command via the smbexec module.

Answer

Use Rubeus with the asktgt command to request a TGT using the hash, then use PsExec with the resulting ticket.

Answer

Use Mimikatz with the sekurlsa::pth command to inject the hash into a new process, then use PsExec from Sysinternals to connect to the target.

Question 19

A penetration tester has gained access to a workstation and wants to enumerate Active Directory domain trusts to identify potential lateral movement paths to other domains. Which command-line tool can be used to list domain trusts from the compromised workstation?

Accepted Answer

nltest /domain_trusts. nltest /domain_trusts is the correct answer because nltest is a built-in Windows utility that is available on all Windows systems without additional installations. It provides a straightforward way to list domain trusts from a compromised workstation, making it ideal for penetration testers who need quick and reliable enumeration. Other tools like netdom, Get-ADTrust, and dsquery require RSAT or the Active Directory module, which may not be present on the target system.

Answer

netdom query trust

Answer

Get-ADTrust -Filter *

Answer

dsquery * -filter "(objectClass=trustedDomain)" -attr *

Question 20

An operator is performing an Active Directory penetration test and wants to enumerate all domain-joined computers to identify potential targets for lateral movement. Which TWO of the following tools or commands can be used to perform this enumeration from a domain-joined Windows host with standard domain user credentials? (Choose two.)

Accepted Answer

AdFind -f "(objectClass=computer)". net view /domain and AdFind are both viable from a standard domain-joined Windows host without additional administrative tools. net view /domain uses native Windows functionality to list domain computers, though it may be limited by the Computer Browser service. AdFind is a standalone executable that performs LDAP queries and can enumerate all computer objects with a simple filter. Both require only standard domain user credentials and network access to a domain controller.

Answer

nltest /domain_trusts

Answer

Get-ADComputer -Filter *

Answer

dsquery computer