CPENT Active Directory Attacks Practice Test 3 — 15 Questions

Question 1

Which TWO native Windows tools or Sysinternals utilities can be used by an operator during post-exploitation to dump credentials from the LSASS process memory?

Accepted Answer

Sysinternals ProcDump.exe. Procdump (from Sysinternals) and Task Manager / comsvcs.dll or built-in tools likerundll32 with comsvcs.dll are common methods to dump LSASS. Tasklist is just for listing.

Answer

tasklist.exe /v

Answer

gpresult.exe /h report.html

Answer

netstat.exe -ano

Question 2

Which THREE methods or attack primitives can be used to achieve domain escalation when an attacker has compromised an account with 'GenericAll' permissions over a Group Policy Object (GPO)?

Accepted Answer

Adding a startup script or service configuration within the GPO file share path in SYSVOL. GPO abuse with GenericAll permissions allows modifying startup/shutdown scripts, injecting immediate tasks via Group Policy Preferences, or modifying registry.xml files containing credentials.

Answer

Modifying the KRBTGT account password directly through Group Policy settings

Answer

Directly modifying the NTDS.dit database via unauthenticated LDAP write operations

Question 3

Which TWO tools are commonly used for analyzing BloodHound database outputs or querying attack paths during an Active Directory penetration test?

Accepted Answer

The BloodHound graphical user interface application. BloodHound supports both the official BloodHound GUI (Electron app / web interface) and automated analysis tools like BloodHound Python (bloodhound-python) for collection, as well as Cypher queries within the GUI.

Answer

Mimikatz sekurlsa::logonpasswords

Answer

Impacket's GetUserSPNs.py

Answer

Certipy find

Question 4

Which TWO configuration checks should a penetration tester perform when auditing an Active Directory domain for potential NTLM Relay vulnerabilities?

Accepted Answer

Verify if LDAP signing is disabled or set to 'Not Required' on domain controllers.. Auditing NTLM relay involves checking whether LDAP/SMB signing is required and whether Extended Protection for Authentication (EPA) is configured on IIS/AD CS web services.

Answer

Check if the domain functional level is set to Windows 2000 native.

Answer

Verify that all user accounts have Kerberos pre-authentication disabled.

Answer

Enumerate the total number of Service Principal Names registered to machine accounts.

Question 5

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Accepted Answer

Executing Kerberoasting against service principal names to crack hashes offline. Avoiding LSASS interaction can be achieved via DCSync (DRSUAPI replication), Kerberoasting (offline cracking of TGS), and NTDS.dit extraction using Volume Shadow Copies (VSS).

Answer

Running procdump.exe against the lsass.exe process on the domain controller

Answer

Injecting DLL payloads into the Local Security Authority Subsystem Service

Question 6

During an internal penetration test, an operator compromises a low-privileged domain user account and wishes to perform a Kerberoasting attack to harvest service principal name (SPN) tickets. Which standard utility included with Windows PowerShell or Sysinternals can be used to request these tickets without administrative privileges?

Accepted Answer

Invoke-Kerberoast via PowerView. Kerberoasting targets service accounts with registered SPNs. Any authenticated domain user can request a TGS-SPN ticket for these services from the Domain Controller. The built-in .NET class System.IdentityModel.Tokens.KerberosRequestorSecurityToken or PowerShell scripts like PowerView use standard Windows APIs to request these tickets.

Answer

Mimikatz lsadump::dcsync

Answer

Get-ADDefaultDomainPasswordPolicy

Answer

ntdsutil.vbs snapshot

Question 7

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

Accepted Answer

The template includes the Certificate Request Agent EKU (Enrollment Agent functionality).. ESC3 involves a certificate template configured as an Enrollment Agent (containing the Certificate Request Agent EKU), allowing enrollment by low-privileged users, and permitting issuance of certificates on behalf of other users.

Answer

The CA requires Manager Approval for all issued certificates.

Answer

The domain functional level is set to Windows Server 2003.

Question 8

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

Accepted Answer

Disable HTTP-based web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA) enabled.. Securing AD CS involves disabling NTLM authentication on web enrollment endpoints, enabling Extended Protection for Authentication (EPA), disabling enrollee-supplied SANs on vulnerable templates, and auditing templates using tools like Certipy.

Answer

Disable Kerberos pre-authentication across all domain controller computer accounts.

Answer

Enforce unconstrained delegation on all certificate authority servers.

Question 9

Which TWO methods can an operator use to verify whether an account has successfully been granted DCSync privileges after modifying access control lists (ACLs)?

Accepted Answer

Query the domain object ACLs using PowerView's Get-DomainObjectAcl cmdlet.. After adding DCSync rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), an operator can test the capability using Impacket's secretsdump.py or check ACL modifications using PowerView (Get-DomainObjectAcl).

Answer

Inspect the local SAM database registry hive.

Answer

Run SharpHound with the LocalAdmin collection flag.

Answer

Run klist to check cached Kerberos ticket lifetimes.

Question 10

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

Accepted Answer

psexec.py from the Impacket toolkit. Pass-the-Hash relies on injecting or using the NTLM hash directly in place of the user's password during authentication. Impacket's psexec.py (or crackmapexec / netexec) natively supports NTLM hash authentication.

Answer

Windows Remote Desktop Connection (mstsc.exe)

Answer

Standard Windows net use command

Answer

WinRM standard client via browser

Question 11

A penetration tester has compromised an account that possesses the 'GenericAll' permission over a Group Policy Object (GPO) linked to the domain. How can this permission be leveraged to achieve remote code execution across systems affected by the GPO?

Accepted Answer

Modify the GPO's SYSVOL folder contents to inject a malicious Immediate Task or startup script. Having GenericAll or WriteProperty rights over a GPO allows an attacker to modify the GPO settings, such as adding a Scheduled Task or an Immediate Task via 'Preferences -> Control Panel Settings -> Scheduled Tasks', which will execute commands on targets processing that GPO.

Answer

Extract domain administrator password hashes directly from the GPO ACL metadata

Answer

Request a TGT ticket with custom PAC extensions via Kerberos delegation

Question 12

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

Accepted Answer

Mimikatz: kerberos::ptt ticket.kirbi. Pass-the-Ticket involves injecting exported ticket files (such as .kirbi or .ccache format) into memory. Mimikatz uses the 'kerberos::ptt' command to inject a ticket into the current Windows logon session.

Answer

Rubeus: golden /ticket:ticket.kirbi

Answer

PowerView: Invoke-TicketInjection -Path ticket.kirbi

Answer

Impacket: ticketer.py -nthash ...

Question 13

During an Active Directory assessment, an operator discovers that the KRBTGT account password has not been rotated in over ten years. They decide to craft a Golden Ticket to maintain persistent domain-wide access. Which critical piece of information, in addition to the KRBTGT NTLM hash and domain SID, is strictly required to generate a fully valid Golden Ticket that includes group membership and privilege attributes?

Accepted Answer

The NTLM hash of the KRBTGT account and the Domain SID. When forging a Golden Ticket using Impacket's ticketer or Mimikatz, specifying the target user's RID (Relative Identifier) and valid Group RIDs (such as Domain Admins RID 512) is necessary, but the foundational secret required is the KRBTGT NTLM hash and the Domain SID. Additionally, the FQDN and domain GUID are needed, but the primary cryptographic key is the KRBTGT NTLM hash.

Answer

The Enterprise Admin public key certificate stored in the NTDS.dit

Answer

An active session token issued by the Active Directory Certificate Services (AD CS)

Answer

The plaintext password of the Domain Administrator and SYSVOL shared secret

Question 14

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

Accepted Answer

SharpHound. SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.

Answer

BloodHound-Collector-GUI

Answer

AD-Collector-Pro

Answer

Responder

Question 15

An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?

Accepted Answer

Request a certificate specifying an arbitrary SAN (e.g., Domain Admin) and use it for PKINIT authentication. ESC1 occurs when a certificate template allows low-privileged users to enroll, permits client authentication, and allows the enrollee to supply an arbitrary Subject Alternative Name (SAN). An attacker can request a certificate with a SAN belonging to a high-privileged user (e.g., Domain Administrator) and use it for authentication.

Answer

Execute a DCSync attack directly against the Certification Authority web enrollment endpoint

Answer

Force the CA machine account to authenticate to an attacker-controlled SMB share using PetitPotam

Answer

Perform a Silver Ticket attack by decrypting the CA database with a captured machine hash