GPEN Advanced Password Attacks — Timed 25 Questions

Question 1

Which TWO techniques are highly effective at mitigating the risk of Pass-the-Hash (PtH) attacks in a Windows environment?

Accepted Answer

Disabling NTLM authentication in favor of Kerberos. Pass-the-Hash relies on the fact that NTLM authentication only requires the hash of a password, not the cleartext password itself. By restricting the caching of these hashes and limiting administrative access, organizations can significantly reduce the impact of a compromised workstation. These measures are vital for preventing lateral movement within a domain, ensuring that attackers cannot easily escalate privileges after a single system compromise.

Answer

Increasing password rotation frequency to every 24 hours

Answer

Enabling cleartext password logging in Group Policy

Answer

Requiring 32-character passwords for all users

Question 2

When conducting password spraying, which THREE factors should a penetration tester consider to minimize the risk of triggering account lockouts?

Accepted Answer

The account lockout policy of the target organization. Password spraying is a technique where a single password is tested against many usernames. It is effective but dangerous if it triggers account lockout policies. Testers must carefully calibrate the rate of attempts and choose intervals that blend in with normal traffic. Mastering this technique is essential for testers to gain initial access without being blocked by automated security controls or triggering security alerts.

Answer

The use of a high-entropy, complex password for every attempt

Answer

The total volume of usernames in the target domain

Question 3

Which of the following is the most effective way to prevent Kerberoasting?

Accepted Answer

Using long, complex passwords for service accounts.. Kerberoasting is possible because service account passwords are often weak and rarely changed. By enforcing a policy of long, complex passwords (ideally 25+ characters) for all service accounts, the cost of cracking the TGS ticket offline becomes prohibitively high. This is the most effective defense because it directly addresses the root cause: the vulnerability of the offline hash to brute-force or dictionary attacks.

Answer

Disabling NTLM authentication.

Answer

Implementing a strict account lockout policy.

Answer

Restricting RDP access to service accounts.

Question 4

A penetration tester is performing a password audit against an organization utilizing Microsoft Azure AD with synchronized hybrid identities. The tester wants to bypass traditional smart lockout mechanisms and cloud-based velocity checks while testing weak passwords. Which advanced technique best achieves this objective?

Accepted Answer

Executing a low-and-slow password spraying attack against target accounts using a curated list of seasonal passwords.. Password spraying involves testing a single common password against a massive list of user accounts over extended time intervals to avoid triggering account lockouts or velocity-based detection rules. This strategy exploits human predictability while evading standard rate-limiting heuristics implemented by cloud identity providers like Microsoft Entra ID, making it superior for hybrid environments.

Answer

Deploying a distributed credential stuffing framework using leaked credential databases against the primary login portal simultaneously.

Answer

Performing an immediate brute-force attack against a single privileged administrator account using a GPU cluster and rule-based wordlists.

Answer

Intercepting Azure AD primary refresh tokens via adversary-in-the-middle phishing pages to bypass multi-factor authentication.

Question 5

A penetration tester is conducting an assessment against an Active Directory environment. The tester has obtained a set of NTLM hashes for domain user accounts and wants to perform a Pass-the-Hash attack to move laterally. Which two conditions are necessary for a successful Pass-the-Hash attack using the NTLM hash? (Choose two.)

Accepted Answer

The target account must have local administrative privileges on the target system.. Pass-the-Hash succeeds when the attacker can authenticate using the NTLM hash and the target account has sufficient privileges to perform actions. Disabled or non-required SMB signing allows the hash to be used over SMB, and local administrative rights enable lateral movement and execution. Without these, the attack may authenticate but fail to achieve meaningful access.

Answer

The attacker must have network access to the target system's SMB port 445.

Answer

The attacker must possess the plaintext password of the target account.

Answer

The target system must be running Windows Server 2008 or later.

Question 6

A penetration tester has obtained a non-privileged shell on a Windows 10 workstation that is domain-joined. The tester wants to extract cached domain credentials that would allow authentication to other systems if the domain controller is unreachable. Which built-in Windows mechanism stores these credentials, and what is the most likely location the tester should target for extraction?

Accepted Answer

LSASS process memory, specifically the SECURITY hive's cached domain logon information (msv1_0 cache). Cached domain credentials (DCC) are stored in the SECURITY registry hive under the Cache key and are also present in LSASS memory. Extracting them from LSASS using tools like Mimikatz allows an attacker to obtain the hashes, which can then be cracked offline or used in pass-the-hash attacks if the hash format permits. This is a common post-exploitation step to enable lateral movement when the domain controller is not reachable.

Answer

The NTDS.dit file on the local workstation, which replicates domain password hashes

Answer

The Credential Manager vault, which stores domain cached credentials in encrypted form accessible to the user

Answer

The SAM database file located at %SystemRoot%\System32\config\SAM, which contains cached domain credentials

Question 7

A penetration tester is conducting an offline password attack against a set of Kerberos 5 TGS-REP hashes obtained from a Kerberoasting attack. The tester wants to use Hashcat to crack these hashes. Which Hashcat mode should be used for Kerberos 5 TGS-REP (etype 23) hashes?

Accepted Answer

Hashcat mode 13100. Kerberos 5 TGS-REP hashes with etype 23 (RC4-HMAC) are cracked using Hashcat mode 13100. This mode is designed specifically for Kerberoasting hashes and correctly implements the RC4-HMAC decryption. Other modes target different Kerberos ticket types or encryption types, such as AS-REP or AES. Therefore, mode 13100 is the only correct choice for this scenario.

Answer

Hashcat mode 7500

Answer

Hashcat mode 18200

Answer

Hashcat mode 19800

Question 8

A penetration tester is conducting an assessment against a web application that uses a custom login form. The tester wants to perform a password spraying attack to avoid account lockouts while still testing common weak passwords. Which tool is specifically designed for password spraying and can automatically handle lockout thresholds and delays?

Accepted Answer

Spray. Password spraying requires a tool that can systematically try a few common passwords against many accounts while avoiding lockouts. Spray is designed for this purpose, with features to detect lockout thresholds and automatically adjust attempts. Other tools like Hydra, Medusa, and Patator are general-purpose brute-forcers that can be adapted but lack built-in spraying intelligence.

Answer

Patator

Answer

Medusa

Answer

Hydra

Question 9

An operator has obtained a hash from a Windows system and needs to determine if it is an LM hash, an NT hash, or a NetNTLMv2 hash. The hash is a 32-character hexadecimal string. Which type of hash is this most likely to be, and what are the implications for cracking?

Accepted Answer

NT hash, which is the raw MD4 hash of the password and can be used for pass-the-hash attacks. A 32-character hexadecimal string is the standard format for an NT hash, which is the MD4 hash of a user's password. NT hashes are commonly extracted from SAM or NTDS.dit and can be used in pass-the-hash attacks. LM hashes, while also 32 characters, are legacy and less common. NetNTLMv2 and Kerberos hashes have more complex formats with multiple fields.

Answer

Kerberos TGS-REP hash, which is used in Kerberoasting and requires a different cracking mode

Answer

NetNTLMv2 hash, which is a challenge-response hash and cannot be used for pass-the-hash

Answer

LM hash, which can be cracked quickly due to its weak encryption and splitting into two 7-character halves

Question 10

A penetration tester is performing an offline attack against a Windows domain. They have obtained the NTDS.dit file and the SYSTEM hive. Which tool is most effective for extracting the NTLM hashes for offline cracking?

Accepted Answer

secretsdump.py. Impacket's secretsdump.py is the industry standard for parsing NTDS.dit files and SYSTEM hives to extract domain credentials. It leverages the boot key stored in the SYSTEM hive to decrypt the encrypted hashes within the NTDS.dit database. Understanding this process is critical for penetration testers because it represents the most common method of achieving domain-wide compromise after gaining the necessary domain controller files.

Answer

Hashcat

Answer

Mimikatz

Answer

John the Ripper

Question 11

Which attack targets service accounts by requesting a service ticket (TGS) from the domain controller and cracking the ticket offline?

Accepted Answer

Kerberoasting. Kerberoasting exploits the nature of Kerberos service tickets, which are encrypted using the hash of the target service account's password. Because the ticket is encrypted with the service account's hash, an attacker who can request a ticket can attempt to brute-force or dictionary-attack that ticket offline. This is a highly stealthy method because no malicious traffic is sent to the target service itself.

Answer

Pass-the-Ticket

Answer

AS-REP Roasting

Answer

Golden Ticket Attack

Question 12

Which file in a Windows system is required, along with the NTDS.dit file, to decrypt cached credentials stored in the database?

Accepted Answer

SYSTEM hive. The NTDS.dit file is the primary database for Active Directory, but it is encrypted. The encryption key, known as the boot key, is stored in the SYSTEM registry hive. Without access to the SYSTEM hive, the NTDS.dit file is useless for offline credential extraction. This relationship underscores the need for testers to obtain both files during a post-exploitation phase to achieve successful credential recovery.

Answer

SAM hive

Answer

SOFTWARE hive

Answer

SECURITY hive

Question 13

Which of the following is a primary advantage of using a 'Golden Ticket' attack over other credential-based attacks?

Accepted Answer

It provides persistent access even after the user changes their password.. A Golden Ticket attack involves the compromise of the KRBTGT account, which is the master account for the Kerberos service in a domain. This allows an attacker to forge TGTs that can request access to any resource. Because the attacker controls the TGT, they can grant themselves administrative privileges and bypass standard password changes, making it a highly persistent and difficult-to-detect method of maintaining domain control.

Answer

It does not require administrative privileges to execute.

Answer

It is easily detectable by standard antivirus software.

Answer

It is limited to a single service on the network.

Question 14

In the context of password attacks, what is the primary purpose of a 'mask' in Hashcat?

Accepted Answer

To define the structure and character sets to be tested.. A mask attack is a sophisticated form of brute-forcing where the tester defines the character set and structure of the password (e.g., ?d?d?d?d for a four-digit numeric password). By limiting the search space to patterns that are likely to be used, the tester can crack passwords significantly faster than a pure brute-force approach. This is an essential skill for optimizing cracking sessions against complex password policies.

Answer

To hide the password hash from security logs.

Answer

To decrypt hashes using a known public key.

Answer

To automatically rotate the password in the target account.

Question 15

Which THREE conditions must be met for a successful AS-REP Roasting attack?

Accepted Answer

The account must have the 'Do not require Kerberos pre-authentication' flag set.. AS-REP Roasting targets accounts configured with the 'Do not require Kerberos pre-authentication' flag. This vulnerability allows an attacker to request a TGT without providing the user's password. The KDC responds with an encrypted structure that can be cracked offline. Understanding this process is vital for identifying misconfigured service accounts that provide a low-hanging fruit for attackers to gain credentials without triggering common alerts.

Answer

The attacker must have Domain Admin credentials.

Answer

The service account must have AES-256 encryption enabled.

Question 16

What is the primary risk associated with storing credentials in plain text within scripts or configuration files?

Accepted Answer

It allows an attacker to bypass authentication without cracking.. Storing cleartext credentials is a critical security failure because it provides an immediate, usable password to any attacker who gains read access to the file system. This often leads to lateral movement and privilege escalation because these scripts are frequently used by administrators to automate tasks across multiple servers. Identifying these files is a major component of any internal penetration test's post-exploitation phase.

Answer

It increases the complexity of the password hashes.

Answer

It prevents the use of multi-factor authentication.

Answer

It triggers an alert in the Windows Event Logs.

Question 17

During an internal penetration test, an attacker intercepts an Active Directory Kerberos AS-REQ for a user account that does not have Kerberos pre-authentication enabled. What is the most effective post-exploitation technique for the operator to perform offline credential cracking against this captured artifact?

Accepted Answer

Conduct an AS-REP roasting attack to extract the encrypted ticket portion and crack the underlying user password offline.. Disabling Kerberos pre-authentication allows an attacker to request an AS-REP for any targeted user account without knowing their password. The returned ticket contains a portion encrypted with the user's NTLM hash, which can then be attacked offline using hashcat or John the Ripper to recover the plaintext password. This attack vector bypasses standard lockout policies completely since no actual authentication attempts are made against the Domain Controller during the cracking phase.

Answer

Execute a DCSync attack using volume shadow copies to extract the NTDS.dit database directly from the primary domain controller.

Answer

Perform a Kerberoasting attack to harvest service ticket hashes for accounts with registered Service Principal Names.

Answer

Inject a malicious golden ticket into memory after dumping the krbtgt account credentials from the lsass process.

Question 18

During a red team engagement, an operator successfully dumps the LSA secrets and NTDS.dit database from a Windows domain controller. Which TWO advanced password extraction and analysis techniques should the operator prioritize to uncover administrative access vectors? (Choose two)

Accepted Answer

Performing offline dictionary and rule-based cracking against extracted NTLM hashes using high-performance GPU clusters.. Extracting credentials from NTDS.dit allows the recovery of NTLM hashes and potentially cleartext passwords stored via reversible encryption. Pass-the-hash utilizes captured NTLM hashes for lateral movement without cracking, while offline dictionary cracking recovers original plaintext passwords for reuse against external portals or multi-factor authentication boundaries where hash reuse fails.

Answer

Injecting malicious DLL payloads into the Local Security Authority Subsystem Service to capture plaintext credentials in real-time.

Answer

Executing Kerberoasting against all user accounts to extract service tickets encrypted with legacy RC4 encryption keys.

Answer

Running a responder-based LLMNR/NBT-NS poisoning campaign to capture incoming network authentication challenge-response pairs.

Question 19

During an internal penetration test, an operator intercepts an AS-REP response for a user account that does not have Kerberos pre-authentication enabled. What is the most efficient next step to recover the account password offline?

Accepted Answer

Use GetNPUsers.py to request the AS-REP ticket and crack the derived hash offline using Hashcat mode 18200.. Disabling Kerberos pre-authentication allows any unauthenticated user to request an AS-REP for that account, containing a ticket encrypted with the user's secret key. Tools like Rubeus or GetNPUsers.py can harvest these tickets, which are formatted specifically for offline cracking using hashcat mode 18200 without requiring valid domain credentials initially.

Answer

Run GetUserSPNs.py to request service ticket hashes for Kerberoasting against the domain controller.

Answer

Capture an NTLMv1 challenge-response handshake by forcing authentication over SMB using Responder.

Answer

Execute Hashcat with mode 13100 against the captured NTLM hash dumped from the local security authority subsystem service.

Question 20

During an internal penetration test, you capture an NTLMv2 net-NTLM hash using LLMNR/NBT-NS poisoning. You attempt to crack the hash offline using Hashcat with a standard rockyou.txt wordlist, but the operation yields no plaintext. What is the most effective next step to recover the credentials given that the password complexity requirements were met?

Accepted Answer

Apply rule-based attack modes or hybrid mask attacks in Hashcat to mutate base wordlist entries with common character substitutions, appending numbers, and special symbols.. NTLMv2 hashes utilize a challenge-response mechanism that cannot be reversed directly, requiring offline brute-forcing or rule-based attacks against the captured challenge and response. Because standard wordlists often fail against complex alphanumeric passwords, applying dynamic rule sets or combining masks significantly expands the search space to cover permutations users typically create to satisfy strict corporate password policies during assessments.

Answer

Re-capture the hash using Kerberoasting to obtain a valid Ticket Granting Service ticket for a service principal name instead of relying on the LLMNR response.

Answer

Convert the net-NTLMv2 hash format directly into an MD5 hash format using a custom script so that standard rainbow tables can instantly identify the plaintext password string.

Answer

Downgrade the captured authentication traffic by forcing the domain controller to negotiate LM hashing during the next SMB session establishment phase to simplify cracking.