A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?
A penetration tester is attempting to perform Kerberoasting using Impacket. Which specific service principal name (SPN) format must be requested against the target domain controller to successfully extract TGS-AEAD tickets that can be cracked offline?
An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?
Which TWO of the following Impacket tools can be utilized to perform credential dumping or secret extraction from Active Directory or target systems when valid administrator credentials are known?
In the context of AD CS abuse, which THREE vulnerabilities or template settings are categorized under certificate template misconfigurations that allow privilege escalation?
When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?
During an internal penetration test, an operator compromises a low-privileged domain user account and wishes to perform a Kerberoasting attack to harvest service principal name (SPN) tickets. Which standard utility included with Windows PowerShell or Sysinternals can be used to request these tickets without administrative privileges?
Which TWO methods can an operator use to verify whether an account has successfully been granted DCSync privileges after modifying access control lists (ACLs)?
A penetration tester has compromised an account that possesses the 'GenericAll' permission over a Group Policy Object (GPO) linked to the domain. How can this permission be leveraged to achieve remote code execution across systems affected by the GPO?
During an Active Directory assessment, an operator discovers that the KRBTGT account password has not been rotated in over ten years. They decide to craft a Golden Ticket to maintain persistent domain-wide access. Which critical piece of information, in addition to the KRBTGT NTLM hash and domain SID, is strictly required to generate a fully valid Golden Ticket that includes group membership and privilege attributes?
An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)
A penetration tester has obtained the NT hash of a domain user account through credential dumping. The tester wants to authenticate to a remote server using this hash without knowing the plaintext password. Which Impacket tool should the tester use?
During an internal penetration test, you have obtained the NTLM hash of a domain user account that has local administrative rights on a workstation. You want to move laterally to another workstation in the same domain using only this hash, without knowing the plaintext password. Which technique and tool combination would allow you to execute a remote command on the target workstation?
A penetration tester has gained access to a workstation and wants to enumerate Active Directory domain trusts to identify potential lateral movement paths to other domains. Which command-line tool can be used to list domain trusts from the compromised workstation?
An operator is performing an Active Directory penetration test and wants to enumerate all domain-joined computers to identify potential targets for lateral movement. Which TWO of the following tools or commands can be used to perform this enumeration from a domain-joined Windows host with standard domain user credentials? (Choose two.)
A penetration tester is performing an Active Directory assessment and wants to identify accounts that are vulnerable to Kerberoasting. Which TWO characteristics should the tester look for in user accounts? (Choose two.)
During a penetration test, you have obtained a Kerberos TGT for a domain user and want to use it to access a remote file share on a server. You have the ticket saved in a file named user.ccache. Which command would allow you to use this ticket with smbclient to list the shares on the target server?
A penetration tester has compromised a domain user account that has the 'GenericWrite' permission on a target user object. The tester wants to leverage this permission to gain access to the target user's account without changing its password. Which of the following techniques would BEST achieve this objective while minimizing the chance of detection?
During an internal penetration test, you have obtained the NT hash of a domain user account that is a member of the 'Account Operators' group. You want to escalate privileges to Domain Admin. Which TWO techniques are most likely to succeed? (Choose two.)
During a penetration test, you gain access to a domain-joined Linux host and obtain a valid Kerberos Ticket Granting Ticket (TGT) for a domain user. You want to use this TGT from the Linux host to access a Windows file share on a remote server. Which tool can you use to perform this action?
A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?
An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?
When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?
During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?
During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?
An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?
A tester has located a domain user account configured with Constrained Delegation (S4U2Self / S4U2Proxy) pointing to a target service. What tool and module in Impacket can be used to leverage this delegation to obtain a TGS for a privileged user (e.g., Administrator)?
A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?
An auditor is reviewing Active Directory Certificate Services and identifies ESC8. What exact AD CS endpoint is exploited during an ESC8 attack vector?
A penetration tester is performing an attack utilizing the PetitPotam (MS-EFSR) vulnerability against a domain controller. What is the primary objective of forcing the domain controller to authenticate via PetitPotam?
An operator has discovered a computer object with Unconstrained Delegation enabled in Active Directory. How can this configuration be abused if a Domain Administrator account can be coerced to authenticate to it?
A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?
A penetration tester is evaluating an Active Directory environment and discovers that LDAP signing is not enforced. Which attack technique does this misconfiguration directly facilitate?
An operator has gained administrative access to a subordinate domain in a multi-domain Active Directory forest and wishes to escalate privileges to Enterprise Admin across the entire forest. What object or group must be compromised to achieve forest-wide control?
When executing a DCSync attack programmatically via Impacket's secretsdump.py, how does the tool interact with Active Directory to request password data without running code on the domain controller?
When analyzing a compromised Active Directory environment using BloodHound, which THREE common node properties or paths typically signify a high-value target or an immediate path to Domain Admin?
Which TWO Active Directory mechanisms or configurations are commonly targeted during lateral movement to bypass traditional perimeter security and leverage built-in domain trust relationships?
Which TWO native Windows tools or Sysinternals utilities can be used by an operator during post-exploitation to dump credentials from the LSASS process memory?
Which THREE methods or attack primitives can be used to achieve domain escalation when an attacker has compromised an account with 'GenericAll' permissions over a Group Policy Object (GPO)?
Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?
An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?
An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?
An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?
An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?
During a Red Team assessment against an enterprise network, an operator wants to execute a Silver Ticket attack against a specific service (e.g., CIFS) on a target server. What is a key operational advantage of a Silver Ticket compared to a Golden Ticket?
Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)
An advanced adversary has gained Domain Administrator privileges and wants to establish stealthy, long-term persistence in Active Directory without relying solely on traditional user accounts or standard scheduled tasks. Which THREE advanced persistence mechanisms can be deployed in an Active Directory environment? (Choose THREE)
During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)
An operator has compromised a domain user account and wants to perform a Kerberoasting attack to extract service account hashes. The operator uses Rubeus with the kerberoast command. Which encryption type should the operator request to maximize the chance of cracking the extracted tickets?
An operator has obtained a valid Kerberos Ticket Granting Ticket (TGT) in the form of a .kirbi file from a compromised domain-joined Linux host. They want to convert this .kirbi file into a .ccache file so that it can be used with Impacket tools on their attack VM. Which of the following tools is specifically designed for this conversion?
A penetration tester has gained access to a workstation and wants to move laterally to a server using a Golden Ticket. The tester has the KRBTGT hash and the domain SID. Which tool from the Impacket suite should be used to forge and inject the Golden Ticket?
During an internal penetration test, an operator gains access to a domain-joined Windows workstation and discovers that the current user has local administrator rights on that machine. The operator wants to extract the NTLM hash of the domain administrator who previously logged into this workstation. Which of the following locations is MOST likely to contain this credential material?
During an Active Directory penetration test, an operator has compromised a user account and discovered that the account has GenericAll permissions on a computer object. The operator wants to abuse this permission to gain administrative access to the computer. Which technique should the operator use?
An operator is conducting an Active Directory penetration test and has obtained domain admin credentials. To maintain persistence, they want to create a backdoor that allows them to authenticate as any user without knowing their password, even if the domain admin password is changed. Which of the following techniques would BEST achieve this?
During a penetration test, you have compromised a workstation and obtained the NTLM hash of a domain user who is logged in. You want to move laterally to a server where this user has administrative rights. Which technique would allow you to authenticate to the server without knowing the plaintext password?
During an internal penetration test, you compromise a domain-joined Windows 10 workstation and obtain a SYSTEM-level shell. You extract the NTLM hash of a domain user from LSASS but cannot crack it. Which technique allows you to authenticate to a remote server as that domain user without knowing the plaintext password?
You have compromised a domain user account and discovered that the user has 'WriteDACL' permission on a sensitive Organizational Unit (OU). You want to escalate privileges by modifying the OU's ACL to grant yourself full control. Which built-in Windows command-line utility can you use to modify the ACL of the OU?