GPEN Kerberos Attacks — 10 Questions

Question 1

During a Golden Ticket attack, the attacker gains persistence by creating a forged TGT. What is required to successfully forge this ticket?

Accepted Answer

The password and NTLM hash of the KRBTGT domain account.. A Golden Ticket is a forged TGT created using the NTLM hash of the KRBTGT account. This account is the KDC service account for the entire domain. Possessing this hash allows an attacker to bypass all authentication checks for any resource. The creation of this ticket allows the attacker to specify any arbitrary user identity and group memberships, essentially granting them total control over the domain environment.

Answer

The NTLM hash of the target service account and a valid TGS.

Answer

The domain administrator's plaintext password and a captured TGS.

Answer

A valid TGT obtained from an authenticated user on the network.

Question 2

Which THREE of the following are critical steps in executing a Silver Ticket attack?

Accepted Answer

Obtaining the NTLM hash of the target service account.. A Silver Ticket is a forged service ticket for a specific resource. It relies on the NTLM hash of the service account associated with the target SPN. Because the attacker creates this ticket without communicating with the KDC, it is highly stealthy. Understanding these steps helps security professionals identify the specific indicators, such as the absence of KDC TGS-REQ events for the forged ticket access.

Answer

Requesting a TGT from the Domain Controller.

Answer

Forging the service ticket using the KRBTGT hash.

Question 3

Which THREE of the following are viable defenses against Kerberoasting attacks?

Accepted Answer

Enforce the use of Group Managed Service Accounts (gMSAs).. Defending against Kerberoasting requires a layered approach. Hardening service accounts, improving logging, and moving away from legacy protocols are essential. By focusing on these areas, organizations can reduce the attack surface and increase the difficulty for an attacker attempting to exploit service accounts for privilege escalation.

Answer

Disable Kerberos pre-authentication for all user accounts.

Answer

Restrict access to the NTDS.dit file via strict file system permissions.

Question 4

During an internal penetration test, an operator compromises a low-privileged Active Directory user account. The operator wants to extract password hashes for offline cracking without triggering account lockout policies or interacting with the Active Directory Domain Controller for every target account. Which attack technique should the operator execute against the domain?

Accepted Answer

Request service tickets for service principal names and extract the returned tickets for offline cracking.. Kerberoasting allows domain users to request Service Ticket Granting Service tickets for any service principal name registered in Active Directory. Because these tickets are encrypted with the target service account's password hash, attackers can export and offline-crack them. This method avoids generating standard authentication logs on the Domain Controller, making it a stealthy mechanism for privilege escalation during assessments.

Answer

Perform an AS-REP roasting attack against users configured without pre-authentication requirements enabled.

Answer

Execute a DCSync attack using replication privileges assigned to the compromised standard user account.

Answer

Launch an SMB relay attack targeting signing-disabled endpoints to capture Net-NTLMv2 hashes.

Question 5

During an internal penetration test, an operator captures a single Kerberos AS-REQ for a domain user and notices the pre-authentication timestamp is encrypted with the user's long-term key. The operator wants to crack the user's password offline from this single capture. Which tool and technique should the operator use?

Accepted Answer

Extract the AS-REP encrypted timestamp and crack it offline with Hashcat mode 7500.. The captured AS-REQ contains a timestamp encrypted with the user's long-term key. To recover the password offline, the operator must extract the AS-REP response and crack it with a tool that supports Kerberos 5 AS-REP etype 23, such as Hashcat mode 7500. This avoids online authentication attempts and lockout risks.

Answer

Perform a pass-the-hash attack using the encrypted timestamp as the NTLM hash.

Answer

Use Kerbrute with the 'userenum' mode to brute-force the password against the KDC.

Answer

Replay the captured AS-REQ to the KDC to obtain a TGT, then use that TGT to request service tickets for cracking.

Question 6

A tester has obtained the NTLM hash of a service account that is configured for constrained delegation to a backend SQL server. The tester wants to forge a service ticket that impersonates a domain administrator to access the SQL service, without contacting the KDC. Which approach should the tester use?

Accepted Answer

Forge a silver ticket using the service account's NTLM hash, setting the PAC to include the domain administrator's SID and group memberships.. Forging a silver ticket with the service account's NTLM hash lets the tester encrypt a service ticket for the SQL service and embed arbitrary PAC data, including a domain administrator's SID. Because the service trusts tickets encrypted with its own key, the forged ticket is accepted without KDC validation, bypassing delegation restrictions.

Answer

Request a TGS for the SQL service using the service account's credentials and rely on S4U2Self to obtain an administrator ticket.

Answer

Use the service account's hash to request an AS-REP and crack the domain administrator's password for lateral movement.

Answer

Perform a DCSync attack to replicate the krbtgt hash, then forge a golden ticket for the domain administrator.

Question 7

An operator has compromised a workstation and obtained a Kerberos TGT for a domain user. The operator wants to move laterally to a file server by abusing the user's group membership in a privileged group that has administrative rights on the server. Which artifact should the operator request and inject to achieve this without knowing the user's password?

Accepted Answer

A service ticket for the file server's SPN, extracted from memory and injected into a new logon session.. To move laterally using a compromised TGT, the operator should request a service ticket for the target service's SPN. This ticket embeds the user's group memberships and is encrypted with the service account's key. Injecting it into a logon session allows authentication to the service without needing the user's password.

Answer

An AS-REP for the user, decrypted with the user's NT hash, and injected into a new logon session.

Answer

A forged TGT with the user's SID and privileged group SIDs, signed with the KRBTGT hash.

Answer

A TGS-REP for the KRBTGT service, extracted from memory and injected into a new logon session.

Question 8

You have compromised a domain controller and extracted the krbtgt account's NTLM hash. You want to create a Golden Ticket that grants you domain admin access for the next 10 years. Which tool and parameter would you use to forge this ticket with a 10-year lifetime?

Accepted Answer

ticketer.py -nthash <krbtgt_hash> -domain domain.local -domain-sid S-1-5-21-... -duration 3650 Administrator. To forge a Golden Ticket with a 10-year lifetime, you need a tool that allows specifying the ticket duration. Impacket's ticketer.py uses the -duration parameter in days, so -duration 3650 yields 10 years. Mimikatz uses /endin in days, Rubeus uses /endin, and kekeo's tgt::ask is not for forging. Thus, ticketer.py with the correct parameters is the right choice.

Answer

Rubeus.exe golden /rc4:<krbtgt_hash> /user:Administrator /domain:domain.local /sid:S-1-5-21-... /outfile:golden.kirbi /lifetime:10y

Answer

mimikatz "kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:<hash> /ticket:golden.kirbi /endin:3650"

Answer

kekeo "tgt::ask /user:Administrator /domain:domain.local /krbtgt:<hash> /life:10"

Question 9

An operator is performing a Kerberoasting attack against a domain and wants to maximize the chance of cracking service account passwords. Which two of the following actions should the operator take? (Choose two.)

Accepted Answer

Request service tickets for accounts with SPNs and save them in a format compatible with Hashcat mode 13100.. To maximize Kerberoasting success, the operator should request service tickets for accounts with SPNs and save them in a crackable format (e.g., Hashcat mode 13100). Additionally, using a robust wordlist with common passwords and rules increases the likelihood of cracking weak service account passwords.

Answer

Perform the attack during business hours to avoid detection by security monitoring tools.

Answer

Target service accounts that use AES encryption to ensure faster cracking.

Answer

Request tickets for accounts with constrained delegation to obtain higher privileges.

Question 10

During a penetration test, an operator gains access to a domain controller and extracts the KRBTGT account's NTLM hash. The operator wants to create a Golden Ticket to maintain persistent access. Which tool and command should the operator use to forge a TGT with a 10-year lifetime?

Accepted Answer

Use Mimikatz with 'kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt: <hash> /ticket:golden.kirbi'.. To forge a Golden Ticket, the operator must use a tool that creates a TGT signed with the KRBTGT hash. Mimikatz's kerberos::golden command is the standard tool for this, requiring the domain SID, KRBTGT hash, and username. The resulting ticket can be injected for persistent access.

Answer

Use Kekeo with 'tgt::ask /user:Administrator /domain:corp.local /krbtgt:<hash>'.

Answer

Use Rubeus with 'asktgt /user:Administrator /rc4:<hash> /ptt'.

Answer

Use Impacket's ticketer.py with '-nthash -domain-sid -domain corp.local Administrator'.