PEN-200 Active Directory Attacks Practice Test 2 — 15 Questions

Question 1

You have compromised a domain user account and are looking to escalate privileges. You discover that the domain has a Group Policy Object (GPO) that grants the 'SeEnableDelegationPrivilege' to a non-privileged group called 'Helpdesk'. What is the most direct way to abuse this misconfiguration to gain domain admin equivalent access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable unconstrained delegation on a computer object you control, then coerce a Domain Admin to authenticate to it and capture their TGT.. The SeEnableDelegationPrivilege grants the ability to configure delegation settings, including enabling unconstrained delegation on objects. By enabling unconstrained delegation on a computer you control, you can then coerce a privileged user to authenticate to it, capturing their Kerberos TGT. This TGT can be used to impersonate the Domain Admin, leading to full domain compromise. Other options either require different privileges or misinterpret the abuse of this specific right.

Answer

Configure constrained delegation on a computer you control to impersonate a Domain Admin to a service.

Answer

Add your user to the Domain Admins group using the GPO.

Answer

Modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on a target computer to allow your account to impersonate any user.

Question 2

You are performing an Active Directory assessment and have gained access to a domain-joined Windows workstation as a low-privileged user. You want to quickly identify all Kerberoastable accounts in the domain. Which command-line tool is specifically designed for this purpose and is commonly used in OSCP-like environments?

Accepted Answer

Invoke-Kerberoast. Invoke-Kerberoast is a purpose-built PowerShell function that automates the process of requesting Kerberos service tickets for accounts with SPNs and extracting the encrypted portions for offline cracking. It is part of the PowerView toolkit and is widely used in OSCP exams. While other tools like Rubeus can also perform Kerberoasting, Invoke-Kerberoast is the most recognized in PowerShell-centric environments and is specifically designed for this task.

Answer

Rubeus kerberoast

Answer

setspn -T domain -Q */*

Answer

Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

Question 3

You have obtained a low-privileged domain user account and are performing internal enumeration. You identify a computer object in the domain where the 'ms-MCS-AdmPwd' attribute is readable by your user account. Which attack path does this vulnerability facilitate?

Accepted Answer

Extracting the cleartext local administrator password. The ms-MCS-AdmPwd attribute stores the cleartext Local Administrator Password for a computer managed by LAPS. By reading this attribute, an attacker can extract the password for the local administrator account of the target machine. This is a critical discovery because it allows immediate lateral movement from a low-privileged domain context to local administrative privileges on that specific host, potentially leading to further credential harvesting or domain escalation.

Answer

Kerberoasting the computer account password hash

Answer

Exploiting the GPO to modify the Domain Admins group

Answer

Performing an AS-REP Roasting attack on the machine

Question 4

Which tool is primarily used to perform BloodHound data collection to map out attack paths within an Active Directory environment?

Accepted Answer

SharpHound. BloodHound uses SharpHound as its data collector. SharpHound queries the Active Directory environment to identify relationships between users, groups, computers, and permissions. This data is then imported into the BloodHound graph database, allowing testers to visualize complex attack paths, such as shortest paths to Domain Admin, which would be difficult to identify through manual enumeration alone.

Answer

Mimikatz

Answer

Responder

Answer

PowerSploit

Question 5

Which THREE of the following are valid techniques for achieving persistence within an Active Directory environment?

Accepted Answer

Skeleton Key. Persistence techniques involve creating backdoors that survive account password changes or system reboots. Skeleton Key modifies the LSASS process to accept a master password. Golden Tickets use the KRBTGT hash to forge TGTs indefinitely. Security Descriptor changes on the 'AdminSDHolder' object ensure that specific permissions are consistently applied to privileged groups, even if an administrator removes them manually, maintaining long-term access.

Answer

Kerberoasting

Answer

LLMNR Poisoning

Question 6

You have captured an NTLM hash of a domain user. Why is performing a Pass-the-Hash (PtH) attack often more effective than attempting to crack the hash for the cleartext password?

Accepted Answer

The hash is accepted directly by the authentication service. Pass-the-Hash relies on the fact that Windows authentication protocols (NTLM) use the hash itself as a form of credential. By injecting the hash into the authentication process, the attacker can authenticate as the user without ever knowing the cleartext password. This bypasses complexity requirements and is immune to password cracking speeds, making it an extremely efficient method for lateral movement within a domain.

Answer

It requires less network traffic than a standard login

Answer

Cracking the hash is prohibited by corporate policy

Answer

The hash provides access to all domain controllers

Question 7

Which of the following describes the 'GPP Password' vulnerability?

Accepted Answer

The storage of cleartext credentials in GPO XML files. Group Policy Preferences (GPP) allows administrators to manage local accounts on domain computers. In older versions of Windows, these passwords were encrypted with a static, publicly known AES key. If an attacker gains read access to the 'Groups.xml' file in the SYSVOL share, they can decrypt the 'cpassword' attribute, revealing the cleartext password of the local administrator account for the affected machine.

Answer

A flaw in the Kerberos preauthentication mechanism

Answer

The inability to enforce password complexity on GPOs

Answer

A failure in the Domain Controller's LDAP signing

Question 8

What is the primary objective of an 'AS-REP Roasting' attack?

Accepted Answer

To crack the password of an account without preauth. AS-REP Roasting targets user accounts where Kerberos preauthentication is disabled. By sending an AS-REQ without preauthentication, the domain controller returns an AS-REP containing a TGT encrypted with the user's password hash. The attacker can then extract this hash and perform offline brute-force cracking to recover the user's cleartext password. This is highly effective against service accounts that have been misconfigured to skip preauthentication.

Answer

To capture the KRBTGT hash from the domain controller

Answer

To bypass the need for an NTLM hash during relay

Answer

To escalate privileges via a forged Kerberos ticket

Question 9

When performing a DCSync attack, what is the core mechanism being exploited?

Accepted Answer

The Active Directory Replication Service (DRS) protocol. DCSync exploits the Active Directory replication protocol. By mimicking the behavior of a domain controller, an attacker can request that another domain controller replicate user credentials, including password hashes, to them. This requires the attacker to hold 'Replication-Get-Changes' and 'Replication-Get-Changes-All' permissions, which are typically only held by domain controllers or highly privileged administrators, making it a powerful tool for dumping the entire domain's secrets.

Answer

The Kerberos ticket granting service process

Answer

The LDAP signing enforcement on the Domain Controller

Answer

The storage of passwords in the SYSVOL share

Question 10

Which attack involves an attacker capturing NTLM authentication traffic from a user and relaying it to another machine to gain unauthorized access?

Accepted Answer

NTLM Relay. NTLM Relay involves capturing authentication requests from a client and forwarding them to a target server. If the target server allows NTLM authentication and does not have protections like SMB signing enabled, the server will accept the relayed authentication as if it came from the original user. This allows the attacker to impersonate the user and execute commands or access files on the target server.

Answer

Kerberoasting

Answer

DCSync

Answer

Golden Ticket

Question 11

Why does enabling 'SMB Signing' prevent NTLM relay attacks?

Accepted Answer

It validates the integrity of the authentication packets. SMB Signing adds a cryptographic signature to each packet in an SMB communication. When a relay attack occurs, the attacker does not possess the session key required to generate these signatures for the relayed packets. Consequently, the target server detects the missing or invalid signature and rejects the authentication attempt, effectively neutering the relay attack at the protocol level.

Answer

It encrypts the entire SMB session using TLS

Answer

It requires the client to prove they have the password

Answer

It disables NTLM authentication globally

Question 12

Which of the following describes the primary difference between a Golden Ticket and a Silver Ticket attack in an Active Directory environment?

Accepted Answer

Golden tickets require the KRBTGT hash, while Silver tickets require a service account hash.. The distinction between Golden and Silver tickets is fundamental to understanding post-exploitation persistence. Golden tickets involve the KRBTGT account, granting access to the entire domain, while Silver tickets target specific service accounts. Mastering this difference is essential for determining the scope of an attack and the level of stealth required, as Silver tickets are often safer to deploy as they avoid triggering certain domain controller alerts related to TGT requests.

Answer

Golden tickets are for NTLM, whereas Silver tickets are for Kerberos.

Answer

Silver tickets grant domain admin access, while Golden tickets are restricted to workstations.

Answer

Only Silver tickets require active communication with the Domain Controller.

Question 13

Which of the following conditions is required to execute a successful Pass-the-Hash (PtH) attack against a target workstation?

Accepted Answer

The NTLM hash must correspond to an account with local administrative rights.. Pass-the-Hash relies on the fact that NTLM authentication uses the hash of a password rather than the password itself. If an attacker gains the NTLM hash of a user who has local administrative rights on a target, they can authenticate as that user. This is a primary method for lateral movement within an AD environment, allowing attackers to escalate privileges across hosts without ever needing to know the user's actual cleartext password.

Answer

The target machine must have Kerberos disabled.

Answer

The attacker must possess the cleartext password of the target user.

Answer

The target machine must be a Domain Controller.

Question 14

During an internal assessment, you compromise a workstation and recover a cached domain credential hash for a user who previously logged on. You want to use this hash to authenticate to a file server on the same network, but you do not know the plaintext password. Which of the following tools is specifically designed to perform Pass-the-Hash authentication from a Linux-based attack platform?

Accepted Answer

Impacket's psexec.py. Pass-the-Hash requires a tool that can supply an NTLM hash directly during authentication. Impacket's psexec.py is a Python implementation of PsExec that accepts -hashes, enabling authentication to SMB shares with a hash. The other tools either crack hashes offline, harvest credentials, or extract credentials locally, none of which achieve remote authentication with a hash.

Answer

Hashcat with mode 1000

Answer

Responder with the -w flag

Answer

Mimikatz with the sekurlsa::logonpasswords module

Question 15

During an internal assessment you compromise a workstation and recover a Kerberos TGS ticket from memory that belongs to a service account. Analysis shows the ticket was encrypted with the RC4-HMAC cipher using a key derived from the service account's password hash. You want to recover the plaintext password of that service account offline. Which action should you take?

Accepted Answer

Crack the ticket offline with Hashcat in mode 13100, since the ticket is encrypted with RC4-HMAC and its checksum can be attacked with a wordlist.. A service ticket encrypted with RC4-HMAC (etype 23) is protected by a key derived from the target service account's NT hash, so the ciphertext can be attacked entirely offline. Extracting the TGS-REP hash and running Hashcat mode 13100 against a wordlist recovers the plaintext password when it is weak, without generating additional authentication traffic against the domain.

Answer

Submit the ticket to the domain controller with GetUserSPNs.py and let the KDC decrypt it to disclose the service account's NT hash.

Answer

Convert the ticket to a .kirbi file and import it with Rubeus to request a service ticket that reveals the account password in the response.

Answer

Use Kerbrute to spray the recovered ticket against the domain controller and read the resulting authentication error codes.