GPEN Kerberos Attacks — 15 Questions

Question 1

During a Golden Ticket attack, the attacker gains persistence by creating a forged TGT. What is required to successfully forge this ticket?

Accepted Answer

The password and NTLM hash of the KRBTGT domain account.. A Golden Ticket is a forged TGT created using the NTLM hash of the KRBTGT account. This account is the KDC service account for the entire domain. Possessing this hash allows an attacker to bypass all authentication checks for any resource. The creation of this ticket allows the attacker to specify any arbitrary user identity and group memberships, essentially granting them total control over the domain environment.

Answer

The NTLM hash of the target service account and a valid TGS.

Answer

The domain administrator's plaintext password and a captured TGS.

Answer

A valid TGT obtained from an authenticated user on the network.

Question 2

Which THREE of the following are critical steps in executing a Silver Ticket attack?

Accepted Answer

Obtaining the NTLM hash of the target service account.. A Silver Ticket is a forged service ticket for a specific resource. It relies on the NTLM hash of the service account associated with the target SPN. Because the attacker creates this ticket without communicating with the KDC, it is highly stealthy. Understanding these steps helps security professionals identify the specific indicators, such as the absence of KDC TGS-REQ events for the forged ticket access.

Answer

Requesting a TGT from the Domain Controller.

Answer

Forging the service ticket using the KRBTGT hash.

Question 3

Which THREE of the following are viable defenses against Kerberoasting attacks?

Accepted Answer

Enforce the use of Group Managed Service Accounts (gMSAs).. Defending against Kerberoasting requires a layered approach. Hardening service accounts, improving logging, and moving away from legacy protocols are essential. By focusing on these areas, organizations can reduce the attack surface and increase the difficulty for an attacker attempting to exploit service accounts for privilege escalation.

Answer

Disable Kerberos pre-authentication for all user accounts.

Answer

Restrict access to the NTDS.dit file via strict file system permissions.

Question 4

During an internal penetration test, an operator compromises a low-privileged Active Directory user account. The operator wants to extract password hashes for offline cracking without triggering account lockout policies or interacting with the Active Directory Domain Controller for every target account. Which attack technique should the operator execute against the domain?

Accepted Answer

Request service tickets for service principal names and extract the returned tickets for offline cracking.. Kerberoasting allows domain users to request Service Ticket Granting Service tickets for any service principal name registered in Active Directory. Because these tickets are encrypted with the target service account's password hash, attackers can export and offline-crack them. This method avoids generating standard authentication logs on the Domain Controller, making it a stealthy mechanism for privilege escalation during assessments.

Answer

Perform an AS-REP roasting attack against users configured without pre-authentication requirements enabled.

Answer

Execute a DCSync attack using replication privileges assigned to the compromised standard user account.

Answer

Launch an SMB relay attack targeting signing-disabled endpoints to capture Net-NTLMv2 hashes.

Question 5

During an internal penetration test, an operator captures a single Kerberos AS-REQ for a domain user and notices the pre-authentication timestamp is encrypted with the user's long-term key. The operator wants to crack the user's password offline from this single capture. Which tool and technique should the operator use?

Accepted Answer

Extract the AS-REP encrypted timestamp and crack it offline with Hashcat mode 7500.. The captured AS-REQ contains a timestamp encrypted with the user's long-term key. To recover the password offline, the operator must extract the AS-REP response and crack it with a tool that supports Kerberos 5 AS-REP etype 23, such as Hashcat mode 7500. This avoids online authentication attempts and lockout risks.

Answer

Perform a pass-the-hash attack using the encrypted timestamp as the NTLM hash.

Answer

Use Kerbrute with the 'userenum' mode to brute-force the password against the KDC.

Answer

Replay the captured AS-REQ to the KDC to obtain a TGT, then use that TGT to request service tickets for cracking.

Question 6

A tester has obtained the NTLM hash of a service account that is configured for constrained delegation to a backend SQL server. The tester wants to forge a service ticket that impersonates a domain administrator to access the SQL service, without contacting the KDC. Which approach should the tester use?

Accepted Answer

Forge a silver ticket using the service account's NTLM hash, setting the PAC to include the domain administrator's SID and group memberships.. Forging a silver ticket with the service account's NTLM hash lets the tester encrypt a service ticket for the SQL service and embed arbitrary PAC data, including a domain administrator's SID. Because the service trusts tickets encrypted with its own key, the forged ticket is accepted without KDC validation, bypassing delegation restrictions.

Answer

Request a TGS for the SQL service using the service account's credentials and rely on S4U2Self to obtain an administrator ticket.

Answer

Use the service account's hash to request an AS-REP and crack the domain administrator's password for lateral movement.

Answer

Perform a DCSync attack to replicate the krbtgt hash, then forge a golden ticket for the domain administrator.

Question 7

An operator has compromised a workstation and obtained a Kerberos TGT for a domain user. The operator wants to move laterally to a file server by abusing the user's group membership in a privileged group that has administrative rights on the server. Which artifact should the operator request and inject to achieve this without knowing the user's password?

Accepted Answer

A service ticket for the file server's SPN, extracted from memory and injected into a new logon session.. To move laterally using a compromised TGT, the operator should request a service ticket for the target service's SPN. This ticket embeds the user's group memberships and is encrypted with the service account's key. Injecting it into a logon session allows authentication to the service without needing the user's password.

Answer

An AS-REP for the user, decrypted with the user's NT hash, and injected into a new logon session.

Answer

A forged TGT with the user's SID and privileged group SIDs, signed with the KRBTGT hash.

Answer

A TGS-REP for the KRBTGT service, extracted from memory and injected into a new logon session.

Question 8

You have compromised a domain controller and extracted the krbtgt account's NTLM hash. You want to create a Golden Ticket that grants you domain admin access for the next 10 years. Which tool and parameter would you use to forge this ticket with a 10-year lifetime?

Accepted Answer

ticketer.py -nthash <krbtgt_hash> -domain domain.local -domain-sid S-1-5-21-... -duration 3650 Administrator. To forge a Golden Ticket with a 10-year lifetime, you need a tool that allows specifying the ticket duration. Impacket's ticketer.py uses the -duration parameter in days, so -duration 3650 yields 10 years. Mimikatz uses /endin in days, Rubeus uses /endin, and kekeo's tgt::ask is not for forging. Thus, ticketer.py with the correct parameters is the right choice.

Answer

Rubeus.exe golden /rc4:<krbtgt_hash> /user:Administrator /domain:domain.local /sid:S-1-5-21-... /outfile:golden.kirbi /lifetime:10y

Answer

mimikatz "kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:<hash> /ticket:golden.kirbi /endin:3650"

Answer

kekeo "tgt::ask /user:Administrator /domain:domain.local /krbtgt:<hash> /life:10"

Question 9

An operator is performing a Kerberoasting attack against a domain and wants to maximize the chance of cracking service account passwords. Which two of the following actions should the operator take? (Choose two.)

Accepted Answer

Request service tickets for accounts with SPNs and save them in a format compatible with Hashcat mode 13100.. To maximize Kerberoasting success, the operator should request service tickets for accounts with SPNs and save them in a crackable format (e.g., Hashcat mode 13100). Additionally, using a robust wordlist with common passwords and rules increases the likelihood of cracking weak service account passwords.

Answer

Perform the attack during business hours to avoid detection by security monitoring tools.

Answer

Target service accounts that use AES encryption to ensure faster cracking.

Answer

Request tickets for accounts with constrained delegation to obtain higher privileges.

Question 10

During a penetration test, an operator gains access to a domain controller and extracts the KRBTGT account's NTLM hash. The operator wants to create a Golden Ticket to maintain persistent access. Which tool and command should the operator use to forge a TGT with a 10-year lifetime?

Accepted Answer

Use Mimikatz with 'kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt: <hash> /ticket:golden.kirbi'.. To forge a Golden Ticket, the operator must use a tool that creates a TGT signed with the KRBTGT hash. Mimikatz's kerberos::golden command is the standard tool for this, requiring the domain SID, KRBTGT hash, and username. The resulting ticket can be injected for persistent access.

Answer

Use Kekeo with 'tgt::ask /user:Administrator /domain:corp.local /krbtgt:<hash>'.

Answer

Use Rubeus with 'asktgt /user:Administrator /rc4:<hash> /ptt'.

Answer

Use Impacket's ticketer.py with '-nthash -domain-sid -domain corp.local Administrator'.

Question 11

An operator is attempting to Kerberoast a service account but finds that the extracted ticket is encrypted with AES256. The operator wants to crack the password offline. Which Hashcat mode should the operator use?

Accepted Answer

Hashcat mode 19700. AES256-encrypted Kerberos service tickets correspond to etype 18, which is cracked using Hashcat mode 19700. Using the correct mode ensures that the cracking tool can properly parse the ticket and attempt to recover the service account password.

Answer

Hashcat mode 13100

Answer

Hashcat mode 19600

Answer

Hashcat mode 7500

Question 12

An attacker has obtained the NTLM hash of a service account. They want to perform a Kerberoasting attack to escalate privileges. Why is this specific hash insufficient for standard Kerberoasting?

Accepted Answer

Kerberoasting targets the service account's password hash by requesting a TGS, not by leveraging existing NTLM hashes.. Kerberoasting requires requesting a Service Ticket (TGS) from the Key Distribution Center (KDC) for a specific Service Principal Name (SPN). The attacker then extracts the encrypted TGS blob from memory or network traffic to crack the service account's password offline. The NTLM hash is a separate credential format; having it allows for Pass-the-Hash or silver ticket creation, but does not involve the KDC-based SPN request process required for Kerberoasting.

Answer

The NTLM hash is insufficient because it cannot be used to request a Ticket Granting Ticket (TGT).

Answer

The NTLM hash is only useful for Pass-the-Hash attacks and cannot facilitate any Kerberos interactions.

Answer

The NTLM hash must first be converted to a Kerberos AES-256 key before a TGS request can be initiated.

Question 13

Which TWO of the following scenarios are most indicative of a successful Kerberoasting attack occurring within a network?

Accepted Answer

Multiple TGS-REQ packets from a single workstation targeting various SPNs within a short timeframe.. Kerberoasting is characterized by the bulk request of service tickets and the subsequent offline cracking of the service account's password. Detectors look for anomalous TGS-REQ volume and specific encryption types (like RC4-HMAC) in the requests. Identifying these patterns allows security analysts to pinpoint service accounts that are currently under attack, enabling timely password resets or the implementation of Group Managed Service Accounts (gMSAs) to mitigate future risk.

Answer

A sudden spike in AS-REQ events using expired Kerberos TGTs.

Answer

Frequent failed logins followed by a successful Kerberos authentication.

Answer

An influx of TGT-REQ packets originating from non-domain controllers.

Question 14

What is the primary security benefit of implementing Group Managed Service Accounts (gMSAs) in an environment vulnerable to Kerberoasting?

Accepted Answer

gMSAs use long, complex passwords that are automatically rotated by the domain controller.. gMSAs are designed to mitigate the risks associated with long-term static service account passwords. They feature automatically managed, complex passwords that are rotated frequently by the Active Directory domain controller. Because the passwords are long and changed regularly, they are effectively impossible to crack offline even if an attacker successfully captures the encrypted TGS ticket during a Kerberoasting attempt, rendering the attack functionally useless.

Answer

gMSAs prevent the KDC from issuing service tickets for the account.

Answer

gMSAs require multi-factor authentication for every TGS-REQ performed.

Answer

gMSAs force all Kerberos traffic to be encrypted using AES-256 only.

Question 15

What is the fundamental difference between Golden Ticket and Silver Ticket attacks?

Accepted Answer

Golden Tickets grant access to any service in the domain, while Silver Tickets only grant access to one service.. The primary difference lies in the level of access and the secret used to forge the ticket. Golden Tickets use the KRBTGT hash to forge a TGT, granting access to any service in the domain. Silver Tickets use the service account hash to forge a TGS, granting access only to the specific service associated with that account. Golden Tickets require a higher level of initial privilege to obtain the KRBTGT hash.

Answer

Golden Tickets require communicating with the KDC, whereas Silver Tickets do not.

Answer

Golden Tickets target the domain controller, while Silver Tickets target user workstations.

Answer

Silver Tickets are more powerful because they are harder to detect than Golden Tickets.