CPENT Active Directory Attacks Practice Test 3 — 15 Questions

Question 1

An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?

Accepted Answer

Configure msDS-AllowedToActOnBehalfOfOtherIdentity to point to a controlled account, enabling Resource-Based Constrained Delegation.. GenericAll on a computer object allows full control, including the ability to write to the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. By setting this attribute to a controlled account, an attacker can configure Resource-Based Constrained Delegation (RBCD), enabling that account to impersonate any user to the target computer and achieve code execution via Kerberos delegation. This is a well-known privilege escalation path in Active Directory.

Answer

Modify the user's PrimaryGroupID to map to Domain Admins directly.

Answer

Execute a DCSync attack against the computer object's registry hive.

Answer

Directly modify the local SAM database of the target computer over RPC without credentials.

Question 2

Which Active Directory right or permission allows a security principal to perform a DCSync attack, thereby replicating domain secrets?

Accepted Answer

DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. DCSync abuses the Directory Replication Service (DRS) Remote Protocol by impersonating a domain controller and requesting replication of directory changes. The specific rights required are the extended rights DS-Replication-Get-Changes and DS-Replication-Get-Changes-All (GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2), typically granted to Domain Admins, Enterprise Admins, and the DC computer accounts themselves.

Answer

GenericAll over thekrbtgt account

Answer

FullControl over the Domain Controllers OU

Answer

WriteDACL on the builtin Administrators group

Question 3

A tester has located a domain user account configured with Constrained Delegation (S4U2Self / S4U2Proxy) pointing to a target service. What tool and module in Impacket can be used to leverage this delegation to obtain a TGS for a privileged user (e.g., Administrator)?

Accepted Answer

getST.py. Impacket's getST.py is purpose-built to abuse Kerberos delegation by performing the S4U2Self and S4U2Proxy extensions. Given a constrained-delegation account's credentials (or hash) and the target SPN, it requests a service ticket impersonating an arbitrary user such as Administrator, which can then be used with other Impacket tools. This directly leverages the delegation trust configured on the account.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

addcomputer.py

Question 4

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

Accepted Answer

certipy req -u user@corp.local -p password -target ca.corp.local -template VulnerableTemplate -upn administrator@corp.local. The Certipy tool's 'req' command is used to request a certificate from a Certificate Authority (CA). By specifying the vulnerable template and the '-upn' flag with a high-privileged user's UPN (e.g., administrator@corp.local), the pentester can request a certificate that allows authentication as that privileged user. This exploits the ESC1 misconfiguration where the template allows the enrollee to supply the subject and permits client authentication. The other options do not perform this specific action.

Answer

certipy shadow -username user -target dc01

Answer

certipy ca -backup -ca "corp-CA-1"

Answer

certipy template -update VulnerableTemplate -enrollee-supplies-subject True

Question 5

An auditor is reviewing Active Directory Certificate Services and identifies ESC8. What exact AD CS endpoint is exploited during an ESC8 attack vector?

Accepted Answer

The HTTP-based Web Enrollment (certsrv/) or Certificate Enrollment Web Service endpoints. ESC8 exploits AD CS HTTP enrollment endpoints — specifically the Web Enrollment interface (certsrv/) and the Certificate Enrollment Web Service (CES) — which are vulnerable to NTLM relay when they accept HTTP-based authentication without requiring HTTPS or Extended Protection for Authentication (EPA). An attacker relays a coerced machine account authentication to these endpoints to obtain a certificate for that machine, enabling domain privilege escalation.

Answer

The Kerberos Key Distribution Center service on port 88

Answer

The LDAP signing and LDAP channel binding endpoints on port 636

Answer

The RPC-based DCOM interface on port 135

Question 6

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Accepted Answer

AddMember. In BloodHound, the 'AddMember' edge indicates that a user or group has the ability to add members to a group. This is a direct privilege escalation path because adding a user to a high-privileged group (e.g., Domain Admins) grants that user the group's privileges. Therefore, the visual edge that indicates user 'A' can modify the membership of group 'B' is 'AddMember'.

Answer

AllowedToDelegate

Answer

ReadLAPSPassword

Answer

CoerceTo

Question 7

A penetration tester is performing an attack utilizing the PetitPotam (MS-EFSR) vulnerability against a domain controller. What is the primary objective of forcing the domain controller to authenticate via PetitPotam?

Accepted Answer

To coerce the domain controller's machine account to authenticate to an NTLM relay listener targeting AD CS.. PetitPotam (CVE-2021-36942) abuses the MS-EFSRPC interface (EfsRpcOpenFileRaw) to force a Windows host — including a domain controller — to initiate an outbound NTLM authentication to an attacker-controlled UNC path. The attacker's real goal is not to read files or dump memory, but to capture that machine-account NTLM authentication and relay it to a service that accepts NTLM, most classically Active Directory Certificate Services (AD CS) via the ESC8 web enrollment endpoint. Relaying the DC's machine account to AD CS allows the attacker to request a certificate on behalf of the DC, which can then be used for domain takeover (e.g., via PKINIT to obtain a TGT for the DC).

Answer

To corrupt the NTDS.dit database file on the remote domain controller.

Answer

To extract the plaintext password of the domain administrator from the LSASS process memory.

Answer

To bypass Kerberos pre-authentication requirements on user accounts.

Question 8

When generating a Silver Ticket using Impacket's ticketer.py, what specific piece of cryptographic material is required instead of the KRBTGT hash?

Accepted Answer

The NTLM password hash of the specific service account. A Silver Ticket is forged for a specific service using the NTLM hash of the service account running that service (e.g., MSSQL or CIFS service account), rather than the KRBTGT hash.

Answer

The plaintext password of the Domain Administrator

Answer

The Domain Controller's computer account machine password

Answer

The domain root CA private key (.pfx)

Question 9

An operator has discovered a computer object with Unconstrained Delegation enabled in Active Directory. How can this configuration be abused if a Domain Administrator account can be coerced to authenticate to it?

Accepted Answer

Capture the coerced Domain Admin's TGT from the machine's memory to impersonate them across the domain.. When Unconstrained Delegation is enabled on a computer, the machine caches the TGT of any user who authenticates to it in LSASS memory so it can reuse that TGT for downstream services. If a Domain Admin is coerced (e.g., via PrinterBug/SpoolSample or PetitPotam) into authenticating to that host, the attacker can extract the DA's TGT and inject it to impersonate the administrator domain-wide.

Answer

Extract the NTLM hash of the domain controller directly from the SYSVOL share.

Answer

Forge a Kerberos ticket using the machine account's local SAM database.

Answer

Modify group policy objects via unauthenticated LDAP queries.

Question 10

A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?

Accepted Answer

WriteProperty, GenericAll, or GenericWrite over the msDS-KeyCredentialLink attribute / target object. Shadow Credentials abuse requires write access to the target object's msDS-KeyCredentialLink attribute. Permissions such as GenericAll, GenericWrite, or the specific WriteProperty right over that attribute allow an attacker to inject a Key Credential, which can then be used with PKINIT to obtain a TGT for the target account without knowing its password.

Answer

ReadLAPSPassword extended right

Answer

DS-Replication-Get-Changes-All domain right

Answer

SeEnableDelegationPrivilege on the domain controller

Question 11

Which native Windows command-line tool can be used by a penetration tester to view cached Kerberos tickets currently loaded in the user session?

Accepted Answer

klist. klist is the native Windows command-line utility that displays currently cached Kerberos tickets (TGTs and service tickets) for the logged-on user session. Penetration testers use it to enumerate available tickets before attempting pass-the-ticket or Kerberoasting. It is built into Windows and requires no additional tooling.

Answer

ticketmgr

Answer

winrm get tickets

Answer

kerbuse

Question 12

A penetration tester is evaluating an Active Directory environment and discovers that LDAP signing is not enforced. Which attack technique does this misconfiguration directly facilitate?

Accepted Answer

LDAP NTLM Relay. When LDAP signing is not enforced, an attacker can perform an NTLM relay attack against the LDAP service. By relaying NTLM authentication attempts to a domain controller's LDAP endpoint, the attacker can gain access to directory services, potentially creating or modifying objects, and escalating privileges. This is because without signing, the LDAP server accepts unsigned authentication requests, making it vulnerable to relay.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

Golden Ticket forgery

Question 13

An operator has gained administrative access to a subordinate domain in a multi-domain Active Directory forest and wishes to escalate privileges to Enterprise Admin across the entire forest. What object or group must be compromised to achieve forest-wide control?

Accepted Answer

The Enterprise Admins group in the forest root domain. The Enterprise Admins group resides in the forest root domain and grants full administrative control over all domains in the forest. Compromising this group (or adding an account to it) is the definitive way to achieve forest-wide privilege escalation. In a multi-domain forest, even Domain Admin in a child domain does not automatically confer Enterprise Admin rights, so the attacker must target the forest root's Enterprise Admins group.

Answer

The Cert Publishers group on any workstation

Answer

The Domain Admins group of the subordinate domain

Answer

The Account Operators group in the builtin container

Question 14

When executing a DCSync attack programmatically via Impacket's secretsdump.py, how does the tool interact with Active Directory to request password data without running code on the domain controller?

Accepted Answer

It connects via RPC and invokes the DRSUAPI protocol (DsGetNCChanges) to request replication data.. Impacket's secretsdump.py performs DCSync by authenticating to a domain controller and invoking the DRSUAPI (Directory Replication Service Remote Protocol) interface, specifically the DsGetNCChanges method. This RPC call is the same mechanism legitimate DCs use to replicate directory data, so the DC treats the request as a normal replication pull and returns password hashes (NTLM, Kerberos keys) without the attacker ever executing code on the DC.

Answer

It executes an LDAP search request asking for the plaintext password attribute.

Answer

It queries the Active Directory Web Services (ADWS) REST API on port 9389.

Answer

It reads the NTDS.dit file directly over standard SMB file shares using administrator credentials.

Question 15

When analyzing a compromised Active Directory environment using BloodHound, which THREE common node properties or paths typically signify a high-value target or an immediate path to Domain Admin?

Accepted Answer

Principals with GenericAll or WriteDACL over the Domain object. Option A is correct because GenericAll or WriteDACL rights over the Domain object allow an attacker to modify the domain's ACLs or grant themselves DCSync rights, effectively leading to full domain compromise. Option D is correct because members of Domain Admins inherently possess the highest privileges in the domain, making them direct high-value targets and a clear path to Domain Admin. Option E is correct because computers configured with Unconstrained Delegation cache TGTs of any user who authenticates to them, so compromising such a host can yield Domain Admin credentials when a privileged account connects. Option B is not correct because membership in a departmental security group typically grants only limited, scoped access and does not by itself indicate a high-value target or Domain Admin path. Option C is not correct because default password policies on standard user accounts are a general hygiene weakness, not a specific BloodHound node property or path that directly signifies Domain Admin escalation.

Answer

Standard users with 'MemberOf' a departmental security group

Answer

Standard domain user accounts with default password policies