CPENT Active Directory Attacks Practice Test 2 — 15 Questions

Question 1

An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a compromised or attacker-controlled user account to the privileged group using PowerView or net group. Option C is correct because GenericAll or WriteDacl over a privileged group like Domain Admins allows the operator to add an attacker-controlled or compromised account directly to that group, for example with PowerView's Add-DomainGroupMember or the built-in net group command, which immediately grants the new member all of the group's privileges. Option E is correct because WriteDacl specifically permits modifying the object's security descriptor, so the operator can use PowerView (e.g., Add-DomainObjectAcl) to grant their own user GenericAll or AddMember rights over the group, enabling subsequent membership changes even if direct add rights were not initially present. Option A is incorrect because Kerberoasting targets service accounts with SPNs by requesting TGS tickets and cracking them offline; it is not performed against the Active Directory Web Services endpoint and is unrelated to group ACL permissions. Option B is incorrect because the SAM hive stores local account hashes and cannot be extracted remotely via ping.exe, which is only an ICMP utility and has no file-read or registry-access capability. Option D is incorrect because the krbtgt account password cannot be reset through Group Policy Preferences, and doing so requires domain controller-level privileges and careful double-reset procedures, not group ACL rights.

Answer

Execute a Kerberoasting attack against the Active Directory Web Services endpoint

Answer

Extract plaintext passwords from the Windows Registry SAM hive remotely using ping.exe

Answer

Force an immediate password reset of the krbtgt account via Group Policy Preferences

Question 2

A penetration tester has obtained the NT hash of a domain user account through credential dumping. The tester wants to authenticate to a remote server using this hash without knowing the plaintext password. Which Impacket tool should the tester use?

Accepted Answer

atexec.py. The correct answer is atexec.py because it is specifically built to execute commands via the Task Scheduler and supports pass-the-hash authentication using the -hashes option. This allows the tester to use the NT hash to authenticate to the remote server and run commands, achieving the objective without knowing the plaintext password.

Answer

wmiexec.py

Answer

smbclient.py

Answer

psexec.py

Question 3

During an internal penetration test, you have obtained the NTLM hash of a domain user account that has local administrative rights on a workstation. You want to move laterally to another workstation in the same domain using only this hash, without knowing the plaintext password. Which technique and tool combination would allow you to execute a remote command on the target workstation?

Accepted Answer

Use Impacket's psexec.py with the -hashes option, specifying the LM:NT hash pair, to authenticate and execute a command.. The correct answer is Impacket's psexec.py with the -hashes option. This tool explicitly supports pass-the-hash authentication, allowing an operator to use an NTLM hash to authenticate to a remote system and execute commands. It is a standard and reliable method for lateral movement in Active Directory environments when only a hash is available. Other options either require additional steps, are less direct, or do not natively support hash-based authentication in the same way.

Answer

Use CrackMapExec with the -H option to pass the hash and execute a command via the smbexec module.

Answer

Use Rubeus with the asktgt command to request a TGT using the hash, then use PsExec with the resulting ticket.

Answer

Use Mimikatz with the sekurlsa::pth command to inject the hash into a new process, then use PsExec from Sysinternals to connect to the target.

Question 4

A penetration tester has gained access to a workstation and wants to enumerate Active Directory domain trusts to identify potential lateral movement paths to other domains. Which command-line tool can be used to list domain trusts from the compromised workstation?

Accepted Answer

nltest /domain_trusts. nltest /domain_trusts is the correct answer because nltest is a built-in Windows utility that is available on all Windows systems without additional installations. It provides a straightforward way to list domain trusts from a compromised workstation, making it ideal for penetration testers who need quick and reliable enumeration. Other tools like netdom, Get-ADTrust, and dsquery require RSAT or the Active Directory module, which may not be present on the target system.

Answer

netdom query trust

Answer

Get-ADTrust -Filter *

Answer

dsquery * -filter "(objectClass=trustedDomain)" -attr *

Question 5

An operator is performing an Active Directory penetration test and wants to enumerate all domain-joined computers to identify potential targets for lateral movement. Which TWO of the following tools or commands can be used to perform this enumeration from a domain-joined Windows host with standard domain user credentials? (Choose two.)

Accepted Answer

AdFind -f "(objectClass=computer)". net view /domain and AdFind are both viable from a standard domain-joined Windows host without additional administrative tools. net view /domain uses native Windows functionality to list domain computers, though it may be limited by the Computer Browser service. AdFind is a standalone executable that performs LDAP queries and can enumerate all computer objects with a simple filter. Both require only standard domain user credentials and network access to a domain controller.

Answer

nltest /domain_trusts

Answer

Get-ADComputer -Filter *

Answer

dsquery computer

Question 6

A penetration tester is performing an Active Directory assessment and wants to identify accounts that are vulnerable to Kerberoasting. Which TWO characteristics should the tester look for in user accounts? (Choose two.)

Accepted Answer

Accounts with a Service Principal Name (SPN) set. The correct answers are accounts with a Service Principal Name (SPN) set and accounts with weak passwords. Kerberoasting requires an SPN to request a service ticket, and weak passwords increase the chances of successfully cracking the extracted ticket. Other characteristics like pre-authentication disabled or unconstrained delegation relate to different attacks.

Answer

Accounts with Kerberos pre-authentication disabled

Answer

Accounts with adminCount set to 1

Answer

Accounts with unconstrained delegation enabled

Question 7

During a penetration test, you have obtained a Kerberos TGT for a domain user and want to use it to access a remote file share on a server. You have the ticket saved in a file named user.ccache. Which command would allow you to use this ticket with smbclient to list the shares on the target server?

Accepted Answer

export KRB5CCNAME=/path/to/user.ccache && smbclient -L //targetserver -k. The correct command sets the KRB5CCNAME environment variable to the ticket cache file, then runs smbclient with -L to list shares and -k to use Kerberos authentication. This properly leverages the TGT for SMB access. Other options either use incorrect flags, invalid options, or wrong argument order, which would prevent successful Kerberos authentication or share listing.

Answer

export KRB5CCNAME=/path/to/user.ccache && smbclient -k //targetserver -L

Answer

export KRB5CCNAME=/path/to/user.ccache && smbclient //targetserver/share -k --use-krb5-ccache=/path/to/user.ccache

Answer

export KRB5CCNAME=/path/to/user.ccache && smbclient -k //targetserver/share -N

Question 8

A penetration tester has compromised a domain user account that has the 'GenericWrite' permission on a target user object. The tester wants to leverage this permission to gain access to the target user's account without changing its password. Which of the following techniques would BEST achieve this objective while minimizing the chance of detection?

Accepted Answer

Set a Service Principal Name (SPN) on the target user account and perform Kerberoasting.. With GenericWrite on a user object, the operator can modify attributes of that user. Adding an SPN is a subtle change that enables Kerberoasting, where the operator requests a service ticket and cracks the hash offline. This does not alter the user's password or require additional privileges, and it is less likely to trigger alerts than disabling pre-authentication or modifying group memberships. It is a stealthy way to obtain credentials.

Answer

Modify the target user's userAccountControl attribute to disable pre-authentication and then perform an AS-REP roasting attack.

Answer

Perform a DCSync attack to replicate the target user's credentials.

Answer

Add the target user to a privileged group using the GenericWrite permission.

Question 9

During an internal penetration test, you have obtained the NT hash of a domain user account that is a member of the 'Account Operators' group. You want to escalate privileges to Domain Admin. Which TWO techniques are most likely to succeed? (Choose two.)

Accepted Answer

Modify the ACL of a target user account to grant your user DCSync rights, then perform DCSync.. The Account Operators group has permissions to modify user objects, including resetting passwords and modifying ACLs on some objects. By either resetting a Domain Admin's password or granting DCSync rights to a controlled account, an attacker can escalate to Domain Admin. These methods exploit the group's delegated rights without requiring direct membership in privileged groups.

Answer

Create a new user account and add it to the Domain Admins group.

Answer

Add your user to the Domain Admins group using the Add-ADGroupMember cmdlet.

Answer

Use Kerberoasting to extract the service account hash and crack it offline.

Question 10

During a penetration test, you gain access to a domain-joined Linux host and obtain a valid Kerberos Ticket Granting Ticket (TGT) for a domain user. You want to use this TGT from the Linux host to access a Windows file share on a remote server. Which tool can you use to perform this action?

Accepted Answer

Impacket's psexec.py with -k -no-pass. Impacket's psexec.py with Kerberos flags is designed to use an existing TGT from the credential cache on Linux. By setting KRB5CCNAME to the ticket file, you can authenticate to remote Windows systems without a password. The other tools either do not support using a TGT from a file directly or are not suited for Linux environments.

Answer

kinit

Answer

Mimikatz

Answer

Impacket's smbclient.py

Question 11

A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?

Accepted Answer

KRB5CCNAME. KRB5CCNAME is the standard MIT Kerberos environment variable that tells Kerberos-aware tools where to find the credential cache (ccache) file. Exporting it to point at the stolen .ccache lets Impacket tools like psexec.py, wmiexec.py, and smbclient.py authenticate using the ticket. This is the canonical pass-the-ticket workflow on Linux.

Answer

KRB_TICKET_PATH

Answer

KERBEROS_CACHE

Answer

AD_TICKET_FILE

Question 12

An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?

Accepted Answer

ticketer.py. ticketer.py from Impacket forges Kerberos tickets offline, including Golden Tickets (using the KRBTGT hash) and Silver Tickets (using a service account hash). It accepts the domain SID, krbtgt NTLM hash, and target username to produce a valid .ccache that can be injected via KRB5CCNAME. This is the standard tool for offline Golden Ticket creation.

Answer

getTGT.py

Answer

goldenPac.py

Answer

raiseChild.py

Question 13

When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?

Accepted Answer

SharpHound.exe -CollectionMethod LocalAdmin. SharpHound's LocalAdmin collection method enumerates local administrator rights on computers by querying each machine (via SAM-R, remote registry, or NetSessionEnum depending on privileges) and records which principals have admin access. This data feeds BloodHound's 'AdminTo' edges, which are essential for finding privilege-escalation paths from a low-privileged user to Domain Admin — and it can be collected with only the rights of the invoking user, not Domain Admin.

Answer

SharpHound.exe -CollectionMethod GPOChanges

Answer

SharpHound.exe -CollectionMethod TrustList

Answer

SharpHound.exe -CollectionMethod DCOptions

Question 14

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

Accepted Answer

The template allows enrollees to supply alternate subject names (SAN) and authorizes low-privileged users to enroll with client authentication EKUs.. ESC1 is defined by a certificate template that permits the enrollee to specify a Subject Alternative Name (SAN) and is enrollable by low-privileged users, while also including a client authentication EKU (e.g., Client Authentication, Smart Card Logon). This lets an attacker request a certificate with an arbitrary SAN (e.g., a Domain Admin's UPN) and authenticate as that user via PKINIT.

Answer

The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.

Answer

The template publishes certificates to Active Directory user objects automatically.

Answer

The template has Manager Approval enabled and requires enterprise admin signatures.

Question 15

During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?

Accepted Answer

Pass-the-Hash. Pass-the-Hash (PtH) abuses the NTLM authentication protocol by replaying a captured NTLM hash directly to authenticate to remote systems without ever cracking it to plaintext. CrackMapExec's smb/wmi/winrm modules accept the -H flag to inject the hash into the NTLM challenge-response, which is exactly the technique described. Because NTLMv1/NTLMv2 authentication only requires knowledge of the hash (not the password), the tester gains access to other workstations.

Answer

Pass-the-Ticket

Answer

Kerberoasting

Answer

Over-Pass-the-Hash