GPEN Advanced Password Attacks Practice Test 2 — 15 Questions

Question 1

What is the primary risk associated with storing credentials in plain text within scripts or configuration files?

Accepted Answer

It allows an attacker to bypass authentication without cracking.. Storing cleartext credentials is a critical security failure because it provides an immediate, usable password to any attacker who gains read access to the file system. This often leads to lateral movement and privilege escalation because these scripts are frequently used by administrators to automate tasks across multiple servers. Identifying these files is a major component of any internal penetration test's post-exploitation phase.

Answer

It increases the complexity of the password hashes.

Answer

It prevents the use of multi-factor authentication.

Answer

It triggers an alert in the Windows Event Logs.

Question 2

During an internal penetration test, an attacker intercepts an Active Directory Kerberos AS-REQ for a user account that does not have Kerberos pre-authentication enabled. What is the most effective post-exploitation technique for the operator to perform offline credential cracking against this captured artifact?

Accepted Answer

Conduct an AS-REP roasting attack to extract the encrypted ticket portion and crack the underlying user password offline.. Disabling Kerberos pre-authentication allows an attacker to request an AS-REP for any targeted user account without knowing their password. The returned ticket contains a portion encrypted with the user's NTLM hash, which can then be attacked offline using hashcat or John the Ripper to recover the plaintext password. This attack vector bypasses standard lockout policies completely since no actual authentication attempts are made against the Domain Controller during the cracking phase.

Answer

Execute a DCSync attack using volume shadow copies to extract the NTDS.dit database directly from the primary domain controller.

Answer

Perform a Kerberoasting attack to harvest service ticket hashes for accounts with registered Service Principal Names.

Answer

Inject a malicious golden ticket into memory after dumping the krbtgt account credentials from the lsass process.

Question 3

During a red team engagement, an operator successfully dumps the LSA secrets and NTDS.dit database from a Windows domain controller. Which TWO advanced password extraction and analysis techniques should the operator prioritize to uncover administrative access vectors? (Choose two)

Accepted Answer

Performing offline dictionary and rule-based cracking against extracted NTLM hashes using high-performance GPU clusters.. Extracting credentials from NTDS.dit allows the recovery of NTLM hashes and potentially cleartext passwords stored via reversible encryption. Pass-the-hash utilizes captured NTLM hashes for lateral movement without cracking, while offline dictionary cracking recovers original plaintext passwords for reuse against external portals or multi-factor authentication boundaries where hash reuse fails.

Answer

Injecting malicious DLL payloads into the Local Security Authority Subsystem Service to capture plaintext credentials in real-time.

Answer

Executing Kerberoasting against all user accounts to extract service tickets encrypted with legacy RC4 encryption keys.

Answer

Running a responder-based LLMNR/NBT-NS poisoning campaign to capture incoming network authentication challenge-response pairs.

Question 4

During an internal penetration test, an operator intercepts an AS-REP response for a user account that does not have Kerberos pre-authentication enabled. What is the most efficient next step to recover the account password offline?

Accepted Answer

Use GetNPUsers.py to request the AS-REP ticket and crack the derived hash offline using Hashcat mode 18200.. Disabling Kerberos pre-authentication allows any unauthenticated user to request an AS-REP for that account, containing a ticket encrypted with the user's secret key. Tools like Rubeus or GetNPUsers.py can harvest these tickets, which are formatted specifically for offline cracking using hashcat mode 18200 without requiring valid domain credentials initially.

Answer

Run GetUserSPNs.py to request service ticket hashes for Kerberoasting against the domain controller.

Answer

Capture an NTLMv1 challenge-response handshake by forcing authentication over SMB using Responder.

Answer

Execute Hashcat with mode 13100 against the captured NTLM hash dumped from the local security authority subsystem service.

Question 5

During an internal penetration test, you capture an NTLMv2 net-NTLM hash using LLMNR/NBT-NS poisoning. You attempt to crack the hash offline using Hashcat with a standard rockyou.txt wordlist, but the operation yields no plaintext. What is the most effective next step to recover the credentials given that the password complexity requirements were met?

Accepted Answer

Apply rule-based attack modes or hybrid mask attacks in Hashcat to mutate base wordlist entries with common character substitutions, appending numbers, and special symbols.. NTLMv2 hashes utilize a challenge-response mechanism that cannot be reversed directly, requiring offline brute-forcing or rule-based attacks against the captured challenge and response. Because standard wordlists often fail against complex alphanumeric passwords, applying dynamic rule sets or combining masks significantly expands the search space to cover permutations users typically create to satisfy strict corporate password policies during assessments.

Answer

Re-capture the hash using Kerberoasting to obtain a valid Ticket Granting Service ticket for a service principal name instead of relying on the LLMNR response.

Answer

Convert the net-NTLMv2 hash format directly into an MD5 hash format using a custom script so that standard rainbow tables can instantly identify the plaintext password string.

Answer

Downgrade the captured authentication traffic by forcing the domain controller to negotiate LM hashing during the next SMB session establishment phase to simplify cracking.

Question 6

During an internal network penetration test, you capture NetNTLMv2 challenge-response hashes. You decide to perform a relay attack rather than cracking them offline. Which protocol characteristic makes SMB relaying feasible against a target host?

Accepted Answer

The target machine has disabled SMB signing, allowing challenge-response reuse.. SMB relaying succeeds when message signing is disabled on the target server, allowing an attacker to intercept authentication requests and forward them to another machine. GPEN candidates must understand that signing protects the integrity of SMB sessions. Without it, session hijacking and relaying become trivial threats within local area networks.

Answer

The target machine enforces mandatory SMB signing across all network shares.

Answer

The user account used for authentication has a blank password stored.

Answer

Kerberos protocol is exclusively enforced for all domain controller communications.

Question 7

When conducting an advanced credential harvesting assessment against an Active Directory environment, a penetration tester attempts Kerberoasting. Which TWO actions or conditions are required to successfully extract and crack service tickets using this technique? (Choose TWO)

Accepted Answer

Possession of a standard domain user account to request service tickets from the Key Distribution Center.. Kerberoasting requires requesting a Ticket Granting Service ticket for any domain user account associated with a Service Principal Name, followed by offline cracking since the ticket is encrypted with the service account password hash. GPEN testers leverage this to extract credentials without touching the target server directly.

Answer

Direct administrative access to the primary Domain Controller file system to steal the NTDS.dit database.

Answer

An active session running specialized exploitation tools on the specific host running the target service.

Answer

Unconstrained Kerberos delegation configured specifically on the local workstation operating system.

Question 8

A penetration tester has obtained a single NT hash for a domain user account during an internal engagement. The tester wants to authenticate to a remote Windows 10 workstation as that user without knowing the plaintext password. Which tool is designed to perform this authentication using only the NT hash?

Accepted Answer

Mimikatz with the sekurlsa::pth module. Pass-the-Hash uses the NT hash itself as the credential to authenticate to remote systems. Mimikatz's sekurlsa::pth module injects the hash into a new logon session, enabling the tester to access resources as the target user without recovering the plaintext password. Other tools listed perform different functions such as poisoning, enumeration, or online brute-force, and cannot authenticate with an NT hash.

Answer

Responder with the -w flag

Answer

Hydra with the -H option

Answer

Nmap with the smb-enum-users script

Question 9

During an internal penetration test, you capture a NetNTLMv2 challenge-response hash from a workstation. You attempt to crack it offline using Hashcat, but after several hours with a large wordlist and rules, the hash remains uncracked. Which factor most directly determines the feasibility of cracking this hash?

Accepted Answer

The length and complexity of the user's password. The feasibility of cracking a NetNTLMv2 hash offline is fundamentally governed by the password's entropy. NetNTLMv2 uses HMAC-MD5 with the user's NT hash and a server challenge, making it resistant to precomputation and requiring brute-force or dictionary attacks. If the password is long and complex, the search space becomes too large for practical cracking, regardless of hardware or network factors.

Answer

The version of the SMB protocol used during authentication

Answer

The network speed between the attacker and the victim

Answer

The amount of RAM available on the cracking machine

Question 10

A penetration tester is conducting an offline password attack against a set of NTLM hashes extracted from a Windows domain. The tester wants to maximize the efficiency of the cracking process by using Hashcat. Which two techniques are most effective for this goal? (Choose two.)

Accepted Answer

Utilizing a rule-based attack with a comprehensive rule set like best64.rule. Rule-based attacks and mask attacks are both highly effective for offline NTLM cracking because they intelligently reduce the search space by applying common transformations or adhering to known password policies. Pure brute-force is impractical for long passwords, while options like ignoring usernames or oversubscribing threads do not enhance cracking efficiency.

Answer

Increasing the number of threads to exceed the number of CPU cores

Answer

Using the --username option to ignore usernames during cracking

Answer

Running a pure brute-force attack with all printable ASCII characters up to 12 characters

Question 11

During an internal penetration test, you gain access to a Windows workstation and discover that a domain user's password hash is cached in the registry. You extract the hash and want to crack it offline. Which Hashcat mode should you use to attack the cached domain credential?

Accepted Answer

Hashcat mode 2100 (Domain Cached Credentials 2, MS Cache 2). Cached domain credentials are stored as MSCache v2 hashes in the SECURITY registry hive. Hashcat mode 2100 is purpose-built to crack these hashes offline. Other modes target different hash types such as NTLM, LM, or NetNTLMv2, which are not applicable here. Using the correct mode ensures efficient and successful cracking of the cached credential.

Answer

Hashcat mode 1000 (NTLM)

Answer

Hashcat mode 5500 (NetNTLMv2)

Answer

Hashcat mode 3000 (LM)

Question 12

A penetration tester has captured a NetNTLMv2 challenge-response hash from a Windows workstation over SMB. The tester plans to recover the plaintext password offline using Hashcat on a workstation with a dedicated GPU. The hash file is saved as 'capture.txt' in the format 'username::domain:challenge:response:blob'. Which Hashcat mode should the tester specify to correctly crack this hash?

Accepted Answer

Hashcat mode 5600. The captured hash is a NetNTLMv2 challenge-response, which requires Hashcat mode 5600. This mode correctly emulates the NetNTLMv2 protocol, allowing the GPU to compute the HMAC-MD5 response for each password candidate. Other modes target different hash types such as NTLM, NetNTLMv1, or LM, and will not parse or crack the hash. Therefore, mode 5600 is the only correct choice for this scenario.

Answer

Hashcat mode 5500

Answer

Hashcat mode 1000

Answer

Hashcat mode 3000

Question 13

During an internal penetration test, a tester gains access to a Windows domain controller and extracts the NTDS.dit file along with the SYSTEM registry hive. The tester wants to extract all domain user password hashes for offline cracking. Which tool, when used with the appropriate arguments, can parse these files to retrieve the hashes?

Accepted Answer

secretsdump.py. secretsdump.py is the correct tool because it can parse an offline NTDS.dit file when paired with the SYSTEM hive to decrypt the encrypted password hashes. It extracts NTLM hashes and other secrets, which can then be cracked offline. Mimikatz is used for live memory extraction, while hashcat and John the Ripper are cracking tools that require pre-extracted hashes. Therefore, secretsdump.py is the only tool that directly accomplishes the extraction from the given files.

Answer

Mimikatz

Answer

John the Ripper

Answer

hashcat

Question 14

A penetration tester is conducting a password attack against a Windows Active Directory environment. The tester has obtained a list of usernames and wants to perform a password spraying attack to avoid account lockouts. Which two considerations are most important when executing this attack? (Choose two.)

Accepted Answer

Use a small number of common passwords across many accounts.. Password spraying aims to avoid lockouts by trying a few common passwords across many accounts. The two most important considerations are using a small number of common passwords and ensuring the lockout threshold is not exceeded for any account. These directly address the goal of avoiding lockouts while maximizing coverage. The other options either describe brute-force tactics or focus on evasion rather than the fundamental spraying methodology.

Answer

Perform the attack during non-business hours to avoid detection.

Answer

Target only privileged accounts to maximize impact.

Answer

Use a large list of unique passwords for each account.

Question 15

A penetration tester is performing a password audit and has obtained a set of NTLM hashes from a Windows system. The tester wants to use Hashcat to crack these hashes but needs to choose the correct mode. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

Hashcat mode 1000. NTLM hashes are MD4-based and are cracked using Hashcat mode 1000. This mode correctly interprets the hash format and applies the appropriate algorithm. Other modes target different hash types such as NetNTLMv1, NetNTLMv2, or LM, and will not work for NTLM hashes. Therefore, mode 1000 is the only correct choice for this scenario.

Answer

Hashcat mode 3000

Answer

Hashcat mode 5500

Answer

Hashcat mode 5600