GPEN Advanced Password Attacks — Timed 15 Questions

Question 1

Which TWO techniques are highly effective at mitigating the risk of Pass-the-Hash (PtH) attacks in a Windows environment?

Accepted Answer

Disabling NTLM authentication in favor of Kerberos. Pass-the-Hash relies on the fact that NTLM authentication only requires the hash of a password, not the cleartext password itself. By restricting the caching of these hashes and limiting administrative access, organizations can significantly reduce the impact of a compromised workstation. These measures are vital for preventing lateral movement within a domain, ensuring that attackers cannot easily escalate privileges after a single system compromise.

Answer

Increasing password rotation frequency to every 24 hours

Answer

Enabling cleartext password logging in Group Policy

Answer

Requiring 32-character passwords for all users

Question 2

When conducting password spraying, which THREE factors should a penetration tester consider to minimize the risk of triggering account lockouts?

Accepted Answer

The account lockout policy of the target organization. Password spraying is a technique where a single password is tested against many usernames. It is effective but dangerous if it triggers account lockout policies. Testers must carefully calibrate the rate of attempts and choose intervals that blend in with normal traffic. Mastering this technique is essential for testers to gain initial access without being blocked by automated security controls or triggering security alerts.

Answer

The use of a high-entropy, complex password for every attempt

Answer

The total volume of usernames in the target domain

Question 3

Which of the following is the most effective way to prevent Kerberoasting?

Accepted Answer

Using long, complex passwords for service accounts.. Kerberoasting is possible because service account passwords are often weak and rarely changed. By enforcing a policy of long, complex passwords (ideally 25+ characters) for all service accounts, the cost of cracking the TGS ticket offline becomes prohibitively high. This is the most effective defense because it directly addresses the root cause: the vulnerability of the offline hash to brute-force or dictionary attacks.

Answer

Disabling NTLM authentication.

Answer

Implementing a strict account lockout policy.

Answer

Restricting RDP access to service accounts.

Question 4

A penetration tester is performing a password audit against an organization utilizing Microsoft Azure AD with synchronized hybrid identities. The tester wants to bypass traditional smart lockout mechanisms and cloud-based velocity checks while testing weak passwords. Which advanced technique best achieves this objective?

Accepted Answer

Executing a low-and-slow password spraying attack against target accounts using a curated list of seasonal passwords.. Password spraying involves testing a single common password against a massive list of user accounts over extended time intervals to avoid triggering account lockouts or velocity-based detection rules. This strategy exploits human predictability while evading standard rate-limiting heuristics implemented by cloud identity providers like Microsoft Entra ID, making it superior for hybrid environments.

Answer

Deploying a distributed credential stuffing framework using leaked credential databases against the primary login portal simultaneously.

Answer

Performing an immediate brute-force attack against a single privileged administrator account using a GPU cluster and rule-based wordlists.

Answer

Intercepting Azure AD primary refresh tokens via adversary-in-the-middle phishing pages to bypass multi-factor authentication.

Question 5

A penetration tester is conducting an assessment against an Active Directory environment. The tester has obtained a set of NTLM hashes for domain user accounts and wants to perform a Pass-the-Hash attack to move laterally. Which two conditions are necessary for a successful Pass-the-Hash attack using the NTLM hash? (Choose two.)

Accepted Answer

The target account must have local administrative privileges on the target system.. Pass-the-Hash succeeds when the attacker can authenticate using the NTLM hash and the target account has sufficient privileges to perform actions. Disabled or non-required SMB signing allows the hash to be used over SMB, and local administrative rights enable lateral movement and execution. Without these, the attack may authenticate but fail to achieve meaningful access.

Answer

The attacker must have network access to the target system's SMB port 445.

Answer

The attacker must possess the plaintext password of the target account.

Answer

The target system must be running Windows Server 2008 or later.

Question 6

A penetration tester has obtained a non-privileged shell on a Windows 10 workstation that is domain-joined. The tester wants to extract cached domain credentials that would allow authentication to other systems if the domain controller is unreachable. Which built-in Windows mechanism stores these credentials, and what is the most likely location the tester should target for extraction?

Accepted Answer

LSASS process memory, specifically the SECURITY hive's cached domain logon information (msv1_0 cache). Cached domain credentials (DCC) are stored in the SECURITY registry hive under the Cache key and are also present in LSASS memory. Extracting them from LSASS using tools like Mimikatz allows an attacker to obtain the hashes, which can then be cracked offline or used in pass-the-hash attacks if the hash format permits. This is a common post-exploitation step to enable lateral movement when the domain controller is not reachable.

Answer

The NTDS.dit file on the local workstation, which replicates domain password hashes

Answer

The Credential Manager vault, which stores domain cached credentials in encrypted form accessible to the user

Answer

The SAM database file located at %SystemRoot%\System32\config\SAM, which contains cached domain credentials

Question 7

A penetration tester is conducting an offline password attack against a set of Kerberos 5 TGS-REP hashes obtained from a Kerberoasting attack. The tester wants to use Hashcat to crack these hashes. Which Hashcat mode should be used for Kerberos 5 TGS-REP (etype 23) hashes?

Accepted Answer

Hashcat mode 13100. Kerberos 5 TGS-REP hashes with etype 23 (RC4-HMAC) are cracked using Hashcat mode 13100. This mode is designed specifically for Kerberoasting hashes and correctly implements the RC4-HMAC decryption. Other modes target different Kerberos ticket types or encryption types, such as AS-REP or AES. Therefore, mode 13100 is the only correct choice for this scenario.

Answer

Hashcat mode 7500

Answer

Hashcat mode 18200

Answer

Hashcat mode 19800

Question 8

A penetration tester is conducting an assessment against a web application that uses a custom login form. The tester wants to perform a password spraying attack to avoid account lockouts while still testing common weak passwords. Which tool is specifically designed for password spraying and can automatically handle lockout thresholds and delays?

Accepted Answer

Spray. Password spraying requires a tool that can systematically try a few common passwords against many accounts while avoiding lockouts. Spray is designed for this purpose, with features to detect lockout thresholds and automatically adjust attempts. Other tools like Hydra, Medusa, and Patator are general-purpose brute-forcers that can be adapted but lack built-in spraying intelligence.

Answer

Patator

Answer

Medusa

Answer

Hydra

Question 9

An operator has obtained a hash from a Windows system and needs to determine if it is an LM hash, an NT hash, or a NetNTLMv2 hash. The hash is a 32-character hexadecimal string. Which type of hash is this most likely to be, and what are the implications for cracking?

Accepted Answer

NT hash, which is the raw MD4 hash of the password and can be used for pass-the-hash attacks. A 32-character hexadecimal string is the standard format for an NT hash, which is the MD4 hash of a user's password. NT hashes are commonly extracted from SAM or NTDS.dit and can be used in pass-the-hash attacks. LM hashes, while also 32 characters, are legacy and less common. NetNTLMv2 and Kerberos hashes have more complex formats with multiple fields.

Answer

Kerberos TGS-REP hash, which is used in Kerberoasting and requires a different cracking mode

Answer

NetNTLMv2 hash, which is a challenge-response hash and cannot be used for pass-the-hash

Answer

LM hash, which can be cracked quickly due to its weak encryption and splitting into two 7-character halves

Question 10

A penetration tester is performing an offline attack against a Windows domain. They have obtained the NTDS.dit file and the SYSTEM hive. Which tool is most effective for extracting the NTLM hashes for offline cracking?

Accepted Answer

secretsdump.py. Impacket's secretsdump.py is the industry standard for parsing NTDS.dit files and SYSTEM hives to extract domain credentials. It leverages the boot key stored in the SYSTEM hive to decrypt the encrypted hashes within the NTDS.dit database. Understanding this process is critical for penetration testers because it represents the most common method of achieving domain-wide compromise after gaining the necessary domain controller files.

Answer

Hashcat

Answer

Mimikatz

Answer

John the Ripper

Question 11

Which attack targets service accounts by requesting a service ticket (TGS) from the domain controller and cracking the ticket offline?

Accepted Answer

Kerberoasting. Kerberoasting exploits the nature of Kerberos service tickets, which are encrypted using the hash of the target service account's password. Because the ticket is encrypted with the service account's hash, an attacker who can request a ticket can attempt to brute-force or dictionary-attack that ticket offline. This is a highly stealthy method because no malicious traffic is sent to the target service itself.

Answer

Pass-the-Ticket

Answer

AS-REP Roasting

Answer

Golden Ticket Attack

Question 12

Which file in a Windows system is required, along with the NTDS.dit file, to decrypt cached credentials stored in the database?

Accepted Answer

SYSTEM hive. The NTDS.dit file is the primary database for Active Directory, but it is encrypted. The encryption key, known as the boot key, is stored in the SYSTEM registry hive. Without access to the SYSTEM hive, the NTDS.dit file is useless for offline credential extraction. This relationship underscores the need for testers to obtain both files during a post-exploitation phase to achieve successful credential recovery.

Answer

SAM hive

Answer

SOFTWARE hive

Answer

SECURITY hive

Question 13

Which of the following is a primary advantage of using a 'Golden Ticket' attack over other credential-based attacks?

Accepted Answer

It provides persistent access even after the user changes their password.. A Golden Ticket attack involves the compromise of the KRBTGT account, which is the master account for the Kerberos service in a domain. This allows an attacker to forge TGTs that can request access to any resource. Because the attacker controls the TGT, they can grant themselves administrative privileges and bypass standard password changes, making it a highly persistent and difficult-to-detect method of maintaining domain control.

Answer

It does not require administrative privileges to execute.

Answer

It is easily detectable by standard antivirus software.

Answer

It is limited to a single service on the network.

Question 14

In the context of password attacks, what is the primary purpose of a 'mask' in Hashcat?

Accepted Answer

To define the structure and character sets to be tested.. A mask attack is a sophisticated form of brute-forcing where the tester defines the character set and structure of the password (e.g., ?d?d?d?d for a four-digit numeric password). By limiting the search space to patterns that are likely to be used, the tester can crack passwords significantly faster than a pure brute-force approach. This is an essential skill for optimizing cracking sessions against complex password policies.

Answer

To hide the password hash from security logs.

Answer

To decrypt hashes using a known public key.

Answer

To automatically rotate the password in the target account.

Question 15

Which THREE conditions must be met for a successful AS-REP Roasting attack?

Accepted Answer

The account must have the 'Do not require Kerberos pre-authentication' flag set.. AS-REP Roasting targets accounts configured with the 'Do not require Kerberos pre-authentication' flag. This vulnerability allows an attacker to request a TGT without providing the user's password. The KDC responds with an encrypted structure that can be cracked offline. Understanding this process is vital for identifying misconfigured service accounts that provide a low-hanging fruit for attackers to gain credentials without triggering common alerts.

Answer

The attacker must have Domain Admin credentials.

Answer

The service account must have AES-256 encryption enabled.