PEN-200 Active Directory Attacks — 20 Questions

Question 1

When assessing Active Directory, which TWO of the following configurations are considered high-risk misconfigurations that commonly lead to full domain compromise?

Accepted Answer

Unconstrained delegation enabled on a server. Unconstrained delegation allows a server to impersonate any user who connects to it, potentially capturing a Domain Admin's TGT. Similarly, weak access control lists (ACLs) on privileged objects, such as 'GenericAll' over a Domain Admin account, allow a standard user to reset the admin password or modify group membership. Both provide direct pathways to domain escalation and are common targets in professional penetration testing engagements.

Answer

The existence of a local administrator group

Answer

Frequent password rotation for service accounts

Answer

Domain user account password complexity requirements

Question 2

In an Active Directory environment, what is the primary security risk associated with the 'Account is sensitive and cannot be delegated' attribute on a user account?

Accepted Answer

If disabled on admins, it allows credential theft via delegation. Actually, this attribute is a security control that prevents an account's credentials from being delegated to other services. The question asks for the risk associated with it, which is a conceptual trick; the risk is the *lack* of this setting on highly privileged accounts. When this attribute is NOT set on a Domain Admin, their credentials can be delegated to compromised servers, allowing attackers to hijack them.

Answer

It prevents the account from being used for Kerberoasting

Answer

It allows an attacker to perform an AS-REP Roasting attack

Answer

It prevents high-privilege credentials from being delegated

Question 3

You have compromised a low-privilege user account in an Active Directory forest. After enumerating the domain, you identify that the 'Pre-Windows 2000 Compatible Access' group contains the 'Authenticated Users' group. Which attack vector is most directly facilitated by this specific misconfiguration?

Accepted Answer

Performing a DCSync attack by reading the Replicating Changes property.. The 'Pre-Windows 2000 Compatible Access' group grants members read access to sensitive user attributes. By default, this group's inclusion of Authenticated Users allows any domain user to perform a DCSync attack or extract sensitive data like LAPS passwords or BitLocker recovery keys if permissions are inherited. This is a critical vector because it bypasses standard delegation controls, turning low-privilege access into a potential full domain compromise via credential harvesting or attribute manipulation.

Answer

Kerberoasting the domain controller's machine account.

Answer

Exploiting the AD Recycle Bin to recover deleted object secrets.

Answer

Executing an AS-REP Roasting attack against all users.

Question 4

You have gained local administrator access to a workstation where a Domain Admin recently logged in. You suspect the user's credentials may be cached in memory. Which TWO techniques would allow you to extract these credentials from the LSASS process?

Accepted Answer

Using Procdump to create an LSASS memory dump for offline analysis.. Extracting credentials from LSASS is a foundational post-exploitation task in AD environments. Memory dumping techniques allow for offline analysis using tools like Mimikatz or Pypykatz. Understanding these methods is vital for an OSCP candidate because it bridges the gap between local system exploitation and domain-wide movement, highlighting the necessity of protecting privileged sessions on endpoints and disabling WDigest or clearing cached credentials to prevent immediate escalation to full domain compromise.

Answer

Executing a DCSync attack via Mimikatz to pull credentials.

Answer

Modifying the SAM database registry hive directly.

Answer

Capturing NTLMv2 hashes via Responder on the local network.

Question 5

You are performing a domain enumeration and want to identify potential pathways to escalate privileges using GPO-based misconfigurations. Which THREE of the following conditions might indicate a GPO that can be abused for privilege escalation?

Accepted Answer

The GPO has a 'Groups.xml' file containing local administrator credentials.. GPOs are a common source of privilege escalation because they often contain cached credentials, scripts running with SYSTEM privileges, or insecure file permissions. Identifying these misconfigurations is a critical skill for an OSCP student to move from a standard user to a local admin on domain-joined machines. Understanding these specific vectors allows for the weaponization of Group Policy Objects that are improperly secured or assigned to sensitive groups.

Answer

The GPO is applied to the Domain Controllers container.

Answer

The GPO is currently disabled in the Group Policy Management Console.

Question 6

You have discovered a user account that has 'GenericWrite' access to a Domain Admin account. How can you leverage this permission to achieve domain compromise?

Accepted Answer

Modify the 'servicePrincipalName' attribute to perform a Kerberoasting attack.. GenericWrite permission allows an attacker to modify sensitive attributes on a target object. In the context of a Domain Admin, this includes attributes like 'scriptPath' or 'servicePrincipalName'. By modifying these attributes, an attacker can coerce the Domain Admin to execute malicious code or facilitate Kerberoasting. This is a critical discovery because it demonstrates how non-administrative permissions, if granted over sensitive objects, can lead to complete domain takeover through creative abuse of directory object attributes.

Answer

Reset the Domain Admin's password directly.

Answer

Add the Domain Admin to a group the attacker controls.

Answer

Modify the 'memberOf' attribute to remove them from Domain Admins.

Question 7

When performing a Kerberoasting attack, why is it preferable to target accounts with high privilege levels or service accounts with long, complex names?

Accepted Answer

Service accounts are often excluded from password rotation policies.. Kerberoasting exploits the fact that service tickets are encrypted with the target service account's NTLM hash. While any account with an SPN is a target, those with higher privileges or those that are service accounts are more valuable. This attack is essential for an OSCP practitioner because it allows for credential extraction without interacting with the domain controller directly, bypassing many traditional network-based detection systems by operating entirely within the standard Kerberos authentication flow.

Answer

Higher privileged accounts have weaker encryption algorithms.

Answer

Targeting high privilege accounts forces an immediate domain-wide logout.

Answer

The domain controller will only grant tickets to highly privileged users.

Question 8

You have obtained Domain Admin credentials in a Windows Active Directory environment. You want to establish long-term persistence that survives password changes of the compromised account. Which of the following techniques should you use?

Accepted Answer

Create a Golden Ticket using the KRBTGT account hash.. A Golden Ticket is forged using the KRBTGT account's NTLM hash, which is not automatically changed when a user's password is reset. This allows an attacker to generate TGTs for any user, including non-existent ones, with a default lifetime of 10 years. The other options either provide temporary access, are easily detected, or do not persist through password changes.

Answer

Dump the LSASS process memory on a domain controller.

Answer

Configure a scheduled task on a domain controller to run a reverse shell.

Answer

Add a new domain user account with Domain Admin privileges.

Question 9

You have obtained domain user credentials for 'jsmith' and are enumerating the Active Directory environment from a compromised Windows 10 workstation. You want to identify domain computers where unconstrained Kerberos delegation is enabled, because these systems can cache TGTs of any authenticating user. Which native Windows utility should you run to query this information?

Accepted Answer

Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation. The ActiveDirectory PowerShell module provides a direct way to query the TrustedForDelegation attribute on computer objects. Using Get-ADComputer with a filter on that attribute returns exactly the hosts configured for unconstrained delegation, which are high-value targets because they can be exploited to capture Kerberos TGTs. Other tools like PowerView can also perform this, but the native cmdlet is sufficient and reliable when the module is available.

Answer

net group "Domain Computers" /domain

Answer

dsquery computer -name * -delegation

Answer

nltest /dclist:domain

Question 10

During an internal assessment, you have obtained credentials for a standard domain user, jsmith, and have a foothold on a workstation. You want to identify domain-joined systems where jsmith has local administrator rights without triggering alerts from traditional port scanning. Which approach best accomplishes this while minimizing network noise?

Accepted Answer

Use BloodHound with the SharpHound collector to map outbound control relationships and identify where jsmith has administrative privileges.. BloodHound and SharpHound are designed to enumerate Active Directory relationships and identify privilege escalation paths, including local admin rights on computers. By collecting data such as group memberships, ACLs, and sessions, it can show where a user has administrative control without generating excessive network noise. This makes it the most effective tool for the scenario.

Answer

Run a full TCP port scan against all domain subnets to identify open SMB ports, then attempt authentication to each.

Answer

Query the domain for computer objects where jsmith has been granted administrative rights via Group Policy Preferences or restricted groups.

Answer

Use PowerView's Invoke-EnumerateLocalAdmin to query each computer object's local Administrators group via remote registry or SMB.

Question 11

You have administrative access to a workstation in a domain where you previously collected BloodHound data. The data shows an ACL edge indicating your current user has GenericAll over a target user object, but you have no idea what the target user's password is. You want to leverage this ACL to obtain access to resources the target user can reach. Which technique should you perform?

Accepted Answer

Abuse the GenericAll permission to reset the target user's password with a tool such as bloodyAD or PowerView, then authenticate as that user.. Full control over a user object includes the extended right to reset that account's password without supplying the existing credential. Resetting the password and authenticating as the target is the most direct way to convert the ACL edge into usable access, and it inherits all group memberships and permissions the target user holds.

Answer

Execute a resource-based constrained delegation attack by modifying the target user's msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

Answer

Use the GenericAll permission to perform a shadow credentials attack, generating a certificate for the target and authenticating with it via PKINIT.

Answer

Perform a targeted Kerberoasting request against the target user, crack the resulting ticket, then authenticate as that user.

Question 12

During an internal penetration test, you have compromised a workstation and extracted the NTLM hash of a service account. You attempt a Pass-the-Hash attack but receive an 'Access Denied' error. You confirm the hash is correct and the account has local admin rights on the target. What is the most likely reason for the failure?

Accepted Answer

The account is a member of the Protected Users group, which prevents NTLM authentication.. The Protected Users group, introduced in Windows Server 2012 R2, prevents NTLM authentication for its members. If a service account is added to this group, any attempt to authenticate using NTLM, including Pass-the-Hash, will be denied. Other options like SMB signing or logon restrictions do not directly block PtH. Therefore, the presence of the account in Protected Users is the most plausible reason for the failure.

Answer

The service account is restricted to specific logon hours or workstations.

Answer

The target system has SMB signing enabled, preventing NTLM relay.

Answer

The target system enforces NTLMv2 and the hash is from an NTLMv1 response.

Question 13

You are on an internal engagement and have obtained the NTLM hash of a service account that has local administrator rights on several member servers. SMB signing is not enforced on those servers. You want to gain interactive access to one server without cracking the hash. Which approach best fits this situation?

Accepted Answer

Use evil-winrm with the -H flag to authenticate to the WinRM service on the target and obtain a PowerShell session.. Pass-the-Hash authenticates using the NT hash directly, bypassing the need for the plaintext password. When the account is a local administrator on the target and WinRM is enabled, evil-winrm with the -H flag establishes an interactive PowerShell session. SMB signing being disabled is relevant for relay scenarios, not for this direct hash-based logon.

Answer

Use Responder to poison LLMNR on the target subnet and relay the service account's authentication to the member server.

Answer

Use Impacket's smbclient.py with the -hashes flag to authenticate over SMB and obtain a shell on the target server.

Answer

Use Mimikatz to perform a DCSync against the domain controller and retrieve the service account's cleartext password.

Question 14

You have obtained the NTLM hash of a service account that is used to run a scheduled task on multiple servers. You want to use this hash to authenticate to those servers and execute commands without knowing the plaintext password. Which tool and technique should you use to achieve this with the least effort?

Accepted Answer

Use Mimikatz with the sekurlsa::pth command to perform Pass-the-Hash and launch a new process with the injected hash.. Pass-the-Hash with Mimikatz's sekurlsa::pth injects the NTLM hash into a new process, allowing authentication to remote systems as the service account. This enables command execution on the target servers without cracking the password. It is a direct, efficient method for lateral movement using a captured hash, requiring minimal setup and no additional network poisoning.

Answer

Use CrackMapExec with the --hash option to spray the hash across the network and execute commands on successful logins.

Answer

Use Hashcat with the -m 1000 mode to crack the NTLM hash and recover the plaintext password.

Answer

Use Responder to capture additional authentication attempts and relay them to the target servers.

Question 15

During an Active Directory assessment you have domain user credentials and want to enumerate misconfigurations that could allow privilege escalation. You plan to use PowerView for this. Which TWO cmdlets would directly help you identify accounts configured with unconstrained delegation? (Choose two.)

Accepted Answer

Get-DomainObject -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=524288)". Unconstrained delegation is represented by the TRUSTED_FOR_DELEGATION flag, bit 524288, in userAccountControl. Get-DomainComputer -Unconstrained filters computers carrying that flag, while a raw LDAP filter using the bitwise matching rule returns every object, including users, that holds it. Together they give complete coverage of unconstrained delegation targets.

Answer

Get-DomainUser -TrustedToAuth

Answer

Get-DomainTrustMapping

Answer

Get-DomainGPO -ComputerIdentity dc01

Question 16

You have compromised a domain user account and are looking to escalate privileges. You discover that the domain has a Group Policy Object (GPO) that grants the 'SeEnableDelegationPrivilege' to a non-privileged group called 'Helpdesk'. What is the most direct way to abuse this misconfiguration to gain domain admin equivalent access?

Accepted Answer

Enable unconstrained delegation on a computer object you control, then coerce a Domain Admin to authenticate to it and capture their TGT.. The SeEnableDelegationPrivilege grants the ability to configure delegation settings, including enabling unconstrained delegation on objects. By enabling unconstrained delegation on a computer you control, you can then coerce a privileged user to authenticate to it, capturing their Kerberos TGT. This TGT can be used to impersonate the Domain Admin, leading to full domain compromise. Other options either require different privileges or misinterpret the abuse of this specific right.

Answer

Configure constrained delegation on a computer you control to impersonate a Domain Admin to a service.

Answer

Add your user to the Domain Admins group using the GPO.

Answer

Modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on a target computer to allow your account to impersonate any user.

Question 17

You are performing an Active Directory assessment and have gained access to a domain-joined Windows workstation as a low-privileged user. You want to quickly identify all Kerberoastable accounts in the domain. Which command-line tool is specifically designed for this purpose and is commonly used in OSCP-like environments?

Accepted Answer

Invoke-Kerberoast. Invoke-Kerberoast is a purpose-built PowerShell function that automates the process of requesting Kerberos service tickets for accounts with SPNs and extracting the encrypted portions for offline cracking. It is part of the PowerView toolkit and is widely used in OSCP exams. While other tools like Rubeus can also perform Kerberoasting, Invoke-Kerberoast is the most recognized in PowerShell-centric environments and is specifically designed for this task.

Answer

Rubeus kerberoast

Answer

setspn -T domain -Q */*

Answer

Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

Question 18

You have obtained a low-privileged domain user account and are performing internal enumeration. You identify a computer object in the domain where the 'ms-MCS-AdmPwd' attribute is readable by your user account. Which attack path does this vulnerability facilitate?

Accepted Answer

Extracting the cleartext local administrator password. The ms-MCS-AdmPwd attribute stores the cleartext Local Administrator Password for a computer managed by LAPS. By reading this attribute, an attacker can extract the password for the local administrator account of the target machine. This is a critical discovery because it allows immediate lateral movement from a low-privileged domain context to local administrative privileges on that specific host, potentially leading to further credential harvesting or domain escalation.

Answer

Kerberoasting the computer account password hash

Answer

Exploiting the GPO to modify the Domain Admins group

Answer

Performing an AS-REP Roasting attack on the machine

Question 19

Which tool is primarily used to perform BloodHound data collection to map out attack paths within an Active Directory environment?

Accepted Answer

SharpHound. BloodHound uses SharpHound as its data collector. SharpHound queries the Active Directory environment to identify relationships between users, groups, computers, and permissions. This data is then imported into the BloodHound graph database, allowing testers to visualize complex attack paths, such as shortest paths to Domain Admin, which would be difficult to identify through manual enumeration alone.

Answer

Mimikatz

Answer

Responder

Answer

PowerSploit

Question 20

Which THREE of the following are valid techniques for achieving persistence within an Active Directory environment?

Accepted Answer

Skeleton Key. Persistence techniques involve creating backdoors that survive account password changes or system reboots. Skeleton Key modifies the LSASS process to accept a master password. Golden Tickets use the KRBTGT hash to forge TGTs indefinitely. Security Descriptor changes on the 'AdminSDHolder' object ensure that specific permissions are consistently applied to privileged groups, even if an administrator removes them manually, maintaining long-term access.

Answer

Kerberoasting

Answer

LLMNR Poisoning