GPEN Kerberos Attacks Practice Test 2 — 15 Questions

Question 1

Why does the Kerberos 'PAC' (Privilege Attribute Certificate) pose a security risk in the context of ticket forgery attacks?

Accepted Answer

The PAC allows attackers to inject arbitrary group memberships into a forged ticket.. The PAC is a data structure embedded within Kerberos tickets that contains user identity and group membership information. Because the PAC is signed by the KDC, it is normally trusted. However, if an attacker can forge a ticket, they can also manipulate the PAC within that ticket to elevate their privileges, such as adding themselves to the 'Domain Admins' group, bypassing normal authorization checks completely.

Answer

The PAC is always encrypted with the user's password, making it easy to crack.

Answer

The PAC prevents the KDC from verifying the ticket's signature.

Answer

The PAC is required for TGT requests, making it a primary target for sniffers.

Question 2

Which Kerberos feature is specifically exploited when an attacker uses 'constrained delegation' to escalate privileges?

Accepted Answer

The S4U2Self and S4U2Proxy extensions.. Constrained delegation allows a service to impersonate a user to a specific set of other services, defined in the 'msDS-AllowedToDelegateTo' attribute. If an attacker compromises a service account configured for constrained delegation, they can request a service ticket for any user to the allowed target services. This allows the attacker to pivot throughout the network while impersonating high-privilege users without needing their credentials.

Answer

The TGT's ability to be renewed indefinitely.

Answer

The PAC validation performed by the Domain Controller.

Answer

The ability to use RC4 encryption for TGS requests.

Question 3

What is the primary risk associated with 'Unconstrained Delegation' in Active Directory?

Accepted Answer

It allows the service to cache user TGTs, which can be extracted by an attacker.. In unconstrained delegation, a service account can take a user's TGT (which is sent to the service during authentication) and store it in its own memory. An attacker who compromises such a service can extract these stored TGTs. Because the TGT is valid for the whole domain, the attacker can then impersonate those users to any service in the domain, leading to total environment compromise.

Answer

It forces the use of NTLM for all authentication requests.

Answer

It requires the domain controller to store plaintext passwords for all users.

Answer

It prevents the KDC from enforcing password expiration policies.

Question 4

What is the primary objective of a 'Kerberos Armoring' (FAST) implementation?

Accepted Answer

To protect the initial authentication exchange from interception and modification.. Kerberos Armoring, or Flexible Authentication Secure Tunneling (FAST), protects the exchange between the client and the KDC by creating a secure, encrypted tunnel using a separate key. This protects the AS-REQ and AS-REP packets from interception and tampering, effectively neutralizing attacks that rely on sniffing or modifying the initial authentication traffic.

Answer

To prevent the domain controller from logging failed authentication attempts.

Answer

To force all service accounts to use AES-256 encryption for tickets.

Answer

To bypass the need for a TGT during service authentication.

Question 5

Which of the following describes the 'AS-REP Roasting' attack?

Accepted Answer

It allows an attacker to crack user account passwords for accounts without pre-authentication.. AS-REP Roasting targets user accounts that have 'Do not require Kerberos preauthentication' enabled. An attacker can request a TGT for such an account without providing a password. The KDC responds with an encrypted ticket (the AS-REP) that the attacker can then extract and crack offline, similar to how Kerberoasting works, to obtain the user's plaintext password.

Answer

It targets service accounts that are configured with SPNs.

Answer

It relies on the interception of a TGS request to obtain encrypted credentials.

Answer

It is a technique for escalating privileges using the KRBTGT account.

Question 6

A penetration tester has obtained a low-privileged domain user's cleartext credentials. During reconnaissance, the tester wants to enumerate which accounts in the domain are configured with Service Principal Names (SPNs) and are therefore candidates for Kerberoasting, without triggering a lockout or modifying the directory. Which of the following approaches best accomplishes this?

Accepted Answer

Run a targeted LDAP query for objects where servicePrincipalName is present and not null, using tools such as GetUserSPNs.py or PowerView's Get-DomainUser -SPN.. Kerberoasting requires identifying domain accounts that have a servicePrincipalName set, because those accounts can have a service ticket requested and cracked offline. The cleanest way to find them is a read-only LDAP search filtering on servicePrincipalName. This technique uses only legitimate authenticated access, avoids lockout risk, and does not alter the directory, making it the appropriate reconnaissance step.

Answer

Perform an SMB null session against each domain controller and parse the SAM database for accounts ending in the $ suffix.

Answer

Send an AS-REQ for every account in the domain and inspect which accounts return a pre-authentication error versus a valid AS-REP.

Answer

Request a TGS for the krbtgt service and inspect the returned ticket's encryption type to infer which accounts have SPNs.

Question 7

During a penetration test, an operator compromises a workstation where a domain administrator has an active logon session. The operator wants to extract the domain administrator's Kerberos TGT from LSASS and reuse it to access other systems without knowing the administrator's password. Which of the following techniques is specifically designed for this purpose?

Accepted Answer

Pass-the-Ticket using tools such as Mimikatz's sekurlsa::tickets /export and kerberos::ptt.. Pass-the-Ticket is the technique that extracts and reuses a Kerberos ticket from a compromised host. When a domain administrator has an active session, their TGT resides in LSASS and can be exported and injected into another session. This grants the operator the administrator's access without needing the password or hash, perfectly matching the scenario's constraints.

Answer

Kerberoasting by requesting service tickets for SPNs associated with the domain administrator account.

Answer

Silver Ticket creation by forging a service ticket with the domain administrator's NTLM hash.

Answer

Overpass-the-Hash using Mimikatz's sekurlsa::pth with the administrator's NTLM hash.

Question 8

A penetration tester is reviewing Active Directory for Kerberos delegation misconfigurations that could allow privilege escalation. Which of the following TWO configurations should the tester flag as directly enabling an attacker to impersonate a domain administrator to a target service? (Choose two.)

Accepted Answer

A user account configured for constrained delegation with the 'Use any authentication protocol' option and msDS-AllowedToDelegateTo set to a sensitive service.. Unconstrained delegation caches TGTs of authenticating users, so a domain administrator's logon on such a host exposes their TGT for impersonation. Constrained delegation with protocol transition and a sensitive target allows an attacker controlling the delegating account to impersonate any user, including administrators, to that service. Both configurations directly enable the described escalation and should be flagged.

Answer

A standard user account with the 'Account is sensitive and cannot be delegated' flag set.

Answer

A group Managed Service Account (gMSA) with a 120-character automatically rotated password.

Answer

A domain controller configured with the 'Trusted for Delegation' flag but no users currently logged on.

Question 9

During an internal assessment, a tester has valid domain credentials for a standard user and captures Kerberos traffic with Wireshark. The tester notices several TGS-REQ packets for service principal names ending in "/MSSQLSvc" across multiple hosts. The tester wants to identify which accounts are vulnerable to offline password cracking without triggering account lockouts. Which action should the tester take next?

Accepted Answer

Use Rubeus with the kerberoast action to request TGS tickets for the MSSQLSvc SPNs and save the extracted hashes for offline cracking.. Requesting service tickets for accounts with registered SPNs yields TGS material encrypted with the service account's key, enabling offline cracking without lockout risk. The captured TGS-REQ traffic for MSSQLSvc SPNs confirms kerberoastable targets. Tools like Rubeus automate extraction and output hashcat-compatible hashes, letting the tester verify weak service account passwords safely.

Answer

Run BloodHound with the collection method All to map SPN relationships and infer which accounts use weak passwords.

Answer

Perform an AS-REP Roasting scan against all domain users to collect encrypted pre-authentication responses.

Answer

Attempt to authenticate to each MSSQLSvc SPN using the compromised user's credentials to confirm access.

Question 10

A penetration tester has compromised a workstation and obtained a Kerberos TGT for a low-privileged domain user. The tester wants to abuse unconstrained delegation configured on a member server named APP01 to escalate privileges. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Extract the cached TGT from APP01 and inject it into the tester's session for reuse.. Abusing unconstrained delegation requires forcing a high-value account, such as a domain controller, to authenticate to the delegation-enabled host so its TGT is cached, then extracting and reusing that TGT. Coercion techniques place the DC's TGT on APP01, and extraction tools enable impersonation, leading to domain compromise.

Answer

Request a service ticket for the krbtgt account using the compromised user's TGT.

Answer

Disable Kerberos pre-authentication on the compromised user account to facilitate ticket capture.

Answer

Modify the msDS-AllowedToDelegateTo attribute on APP01 to include the domain controller.

Question 11

During an internal penetration test, you have obtained cleartext credentials for a low-privileged Active Directory user. You want to enumerate which user accounts do not require Kerberos preauthentication so you can request AS-REP messages and crack them offline. Which Impacket tool and command should you use?

Accepted Answer

GetNPUsers.py -request -dc-ip 10.0.0.1 domain/user:password. AS-REP Roasting targets accounts that have Kerberos preauthentication disabled. The Impacket script GetNPUsers.py with the -request flag queries the domain for such accounts and requests an AS-REP for each, which can then be cracked offline. The other tools serve different purposes: GetUserSPNs.py is for Kerberoasting, secretsdump.py extracts secrets from hosts, and ticketer.py forges tickets.

Answer

ticketer.py -nthash <hash> -domain domain.local -dc-ip 10.0.0.1 user

Answer

GetUserSPNs.py -request -dc-ip 10.0.0.1 domain/user:password

Answer

secretsdump.py domain/user:password@10.0.0.1

Question 12

You have compromised a workstation and extracted the NTLM hash of a service account that is configured for unconstrained delegation. You want to craft a Silver Ticket to impersonate a domain administrator when accessing a specific file server. Which piece of information is absolutely required to forge this ticket?

Accepted Answer

The service account's NTLM hash or Kerberos key. To forge a Silver Ticket, the attacker must have the target service account's NTLM hash or Kerberos key to encrypt the service ticket. The domain SID and user RID are needed for the PAC but are not the encryption key. A TGT is not required because the ticket is presented directly to the service. The krbtgt hash is for Golden Tickets.

Answer

The domain SID and the target user's RID

Answer

A valid TGT for the service account

Answer

The krbtgt account's NTLM hash

Question 13

A penetration tester is reviewing Kerberos traffic and notices that a user account has the DONT_REQ_PREAUTH flag set in its userAccountControl attribute. The tester wants to obtain crackable material for this account without any domain credentials. Which technique should the tester use?

Accepted Answer

AS-REP Roasting by sending an AS-REQ without pre-authentication and capturing the encrypted AS-REP.. The DONT_REQ_PREAUTH flag allows an unauthenticated attacker to request an AS-REP for the account and receive data encrypted with the user's key. Capturing that response enables offline password cracking without any domain credentials, directly exploiting the disabled pre-authentication setting.

Answer

Golden ticket creation by forging a TGT using the krbtgt hash obtained from the domain controller.

Answer

Kerberoasting by requesting a TGS for an SPN associated with the account and cracking the service ticket.

Answer

Silver ticket creation by forging a service ticket using the target account's NTLM hash.

Question 14

You are performing a Kerberoasting attack against a domain. After requesting service tickets for accounts with SPNs, you extract the tickets and attempt to crack them offline. Which two factors most directly determine the success of cracking these tickets? (Choose two.)

Accepted Answer

The encryption type used for the service ticket. The success of cracking Kerberoasted tickets hinges on the encryption type and the service account's password strength. RC4 tickets are faster to crack than AES, and weak passwords are vulnerable to dictionary attacks. Other factors like number of tickets, domain functional level, or DC location do not affect the cryptographic difficulty of cracking.

Answer

The number of service tickets requested

Answer

The domain functional level

Answer

The physical location of the domain controller

Question 15

During a penetration test, a tester compromises a workstation and extracts a Kerberos TGT for a domain user from memory. The tester wants to use this TGT to access a file share on a remote server without knowing the user's password. Which action should the tester take?

Accepted Answer

Inject the TGT into the current session using Rubeus ptt and request a service ticket for the file share's SPN.. Injecting a stolen TGT into the current session allows the system to request service tickets as the compromised user, enabling access to resources like file shares without the password. Pass-the-ticket leverages the TGT's validity until expiration, making it a powerful lateral movement technique.

Answer

Perform an S4U2Self request to obtain a service ticket for the file share using the extracted TGT.

Answer

Forge a new TGT using the user's NTLM hash, which can be derived from the extracted TGT.

Answer

Crack the TGT offline to recover the user's password, then authenticate normally to the file share.