PEN-200 Password Attacks — 20 Questions

Question 1

When performing a password spraying attack against an O365 or Azure AD environment, which TWO factors are most likely to increase the risk of detection or account lockout?

Accepted Answer

Targeting accounts that are managed by Conditional Access policies with geo-blocking enabled.. Password spraying involves testing a single password against many accounts to avoid triggering lockout thresholds. However, excessive volume and specific security controls can lead to immediate detection. Identifying these risks is crucial for an OSCP practitioner to balance the need for discovery with the requirement to remain undetected. Monitoring for anomalous login patterns or failing to account for intelligent lockout policies will often result in the engagement being compromised.

Answer

Using a low-and-slow approach with long intervals between authentication attempts.

Answer

Running the attack during peak business hours when user activity is highest.

Answer

Using a common password that is included in the organization's banned password list.

Question 2

Which THREE of the following are common indicators that an organization is vulnerable to Kerberoasting?

Accepted Answer

The presence of service accounts with highly privileged roles in the domain.. Kerberoasting exploits the way Windows handles service accounts by requesting service tickets for accounts with Service Principal Names (SPNs). Identifying these indicators is essential for lateral movement. A successful attack allows an attacker to crack service account passwords offline. Recognizing these signs helps in assessing the risk of privilege escalation within a Windows domain, as most environments have at least one misconfigured or over-privileged service account susceptible to this technique.

Answer

The organization requires all users to change their passwords every 30 days.

Answer

The use of legacy NTLM authentication for all domain communication.

Question 3

You have gained access to a Linux machine and extracted the shadow file. Which THREE of the following are valid strategies for recovering the plaintext passwords from the hashes provided?

Accepted Answer

Utilizing Hashcat with the correct mode for the identified hashing algorithm.. Recovering passwords from the `/etc/shadow` file requires understanding the hash format and appropriate tools for the job. In a professional engagement, choosing the right strategy—whether it is automated cracking or targeted analysis—is vital. These methods represent the core techniques for offline password recovery on Linux, and mastery of them is essential for successfully transitioning from initial access to full credential compromise on target systems.

Answer

Using a simple shell script to decrypt the hashes using a symmetric key.

Answer

Executing an AS-REP roasting attack against the local system.

Question 4

What is the primary risk of performing a password spray against an organization that has implemented a third-party Single Sign-On (SSO) solution?

Accepted Answer

The centralized nature of SSO allows for more effective detection and blocking of malicious attempts.. SSO solutions centralize authentication, which means a single point of failure can lead to widespread compromise. However, from an attacker's perspective, spraying an SSO provider often triggers centralized logging and protection mechanisms that are much more robust than those on individual applications. This makes detection significantly more likely. Understanding the architecture of SSO is important for assessing the risk of account lockout and account compromise.

Answer

SSO solutions inherently disable account lockout policies to improve user experience.

Answer

SSO solutions only support multi-factor authentication, making password spraying impossible.

Answer

Passwords in an SSO environment are always stored in plaintext, making them easy to recover.

Question 5

Which TWO actions are considered best practices for securing service accounts against password-based attacks?

Accepted Answer

Using Group Managed Service Accounts (gMSAs) to handle automatic password management.. Securing service accounts is a fundamental component of defending an AD environment. These accounts are often over-privileged and rarely monitored, making them high-value targets. By following these best practices, an organization can significantly reduce the risk of an attacker gaining a foothold via a service account. Recognizing these defenses is important for an OSCP practitioner to provide actionable recommendations after identifying potential vulnerabilities during an assessment.

Answer

Assigning the service account to the Domain Admins group for full access.

Answer

Configuring the account to never require a password change for stability.

Answer

Storing service account passwords in a shared, plaintext network folder.

Question 6

You are performing a password cracking attack on an encrypted archive that uses a custom KDF (Key Derivation Function). How should you proceed if Hashcat does not support the format natively?

Accepted Answer

Switch to a brute-force attack using a custom Python script to perform the KDF.. When a target uses a non-standard or custom cryptographic implementation, standard tools like Hashcat or John may fail. In such cases, you must analyze the implementation to reverse engineer how the key is derived. Once the logic is understood, you can create a custom script or a plugin to bridge the gap. This demonstrates an advanced understanding of cryptography and the ability to adapt when common tools are insufficient for the task at hand.

Answer

Use an online password cracking service to decrypt the archive.

Answer

Assume the archive is unbreakable and move to a different lateral movement vector.

Answer

Run a dictionary attack against the binary file without a KDF transformation.

Question 7

You are performing a password spraying attack against a web application. You notice that the application returns a specific 403 Forbidden error when a username exists but the password is incorrect, and a 401 Unauthorized error when the username does not exist. How should you adjust your attack strategy?

Accepted Answer

Perform user enumeration to validate usernames before spraying passwords.. This scenario represents an information leak via side-channel timing or status codes. By leveraging the difference in error codes, you can perform user enumeration to identify valid accounts before executing a targeted password spray. This minimizes the risk of triggering account lockout policies on non-existent accounts and increases the success rate by focusing only on valid usernames, which is a fundamental technique for stealthy authentication bypass during penetration tests.

Answer

Increase the delay between requests to bypass rate limiting.

Answer

Use a password list containing common patterns like Winter2023!.

Answer

Rotate the source IP addresses for every single password attempt.

Question 8

You are assessing a Linux machine and have read access to /etc/shadow. Which TWO of the following statements regarding the file structure or cracking process are correct?

Accepted Answer

The salt is stored between the first and second dollar signs in the hash string.. Understanding /etc/shadow is critical for offline password auditing. The file structure dictates how tools like John the Ripper parse salts and hash identifiers. Identifying the correct hash algorithm (e.g., SHA-512 vs MD5) is mandatory, as improper identification leads to failed cracking attempts. This knowledge allows penetration testers to effectively audit local user security and perform password complexity analysis in a controlled, offline environment.

Answer

The $6$ identifier indicates the usage of the MD5 hashing algorithm.

Answer

Cracking SHA-512 hashes is computationally easier than cracking legacy DES-based hashes.

Answer

If the second field is an asterisk (*), the user is required to change their password.

Question 9

You are performing a password audit and want to generate targeted candidate passwords based on company-specific terms, years, and common suffixes using Hashcat's rule-based engine. Which built-in Hashcat rule file applies standard capitalization toggles and appends common digit suffixes?

Accepted Answer

hashcat -a 0 -r rules/best64.rule wordlist.txt hashes.txt. Rule-based attacks allow penetration testers to drastically increase password cracking success rates by mutating wordlist entries with predictable human patterns. The best64.rule file contains a highly optimized set of transformation rules that cover capitalization, reversal, and common numeric appends without introducing excessive computational overhead.

Answer

hashcat -a 1 -r rules/combinator.rule wordlist1.txt wordlist2.txt hashes.txt

Answer

hashcat -a 3 -r rules/T1048.rule mask.hcmask hashes.txt

Answer

hashcat -a 6 -r rules/leetspeak.rule wordlist.txt mask.hcmask hashes.txt

Question 10

During an internal penetration test, you capture a Kerberos AS-REP response for a user account that does not require pre-authentication. You save the hash to a file. Which tool and mode should you use to attempt to crack this hash offline?

Accepted Answer

John the Ripper with the krb5asrep format. When you capture a Kerberos AS-REP hash, the encryption type may be RC4 or AES. John the Ripper's krb5asrep format automatically detects and handles both, making it the most versatile tool for this task. Hashcat requires selecting the correct mode, which depends on the etype. Therefore, John the Ripper is the best choice when the etype is unknown.

Answer

Hashcat with mode 18200

Answer

Aircrack-ng with the -K option

Answer

Hashcat with mode 7500

Question 11

During an internal assessment, you capture SMB challenge-response authentications by running Responder on the local subnet. One captured value is a NetNTLMv2 hash for a domain user. You need to determine the most effective next step to obtain the user's cleartext password, assuming no relay opportunities exist and the client has SMB signing enforced. What should you do?

Accepted Answer

Use hashcat with mode 5600 and a wordlist to crack the NetNTLMv2 hash offline.. The captured NetNTLMv2 hash cannot be used for pass-the-hash or relay due to SMB signing. The only way to recover the cleartext password is offline cracking. Hashcat mode 5600 is the correct mode for NetNTLMv2 and leverages GPU acceleration for efficiency. John the Ripper can also crack NetNTLMv2, but hashcat is the more effective tool in this context. Thus, using hashcat with mode 5600 is the recommended action.

Answer

Use John the Ripper with the --format=netntlmv2 option and a rule set.

Answer

Relay the captured NetNTLMv2 hash to another host using ntlmrelayx.

Answer

Use Mimikatz with the sekurlsa::pth module to perform a pass-the-hash attack.

Question 12

You have obtained a set of NTLM hashes from a Windows domain controller and want to perform a pass-the-hash attack to move laterally. Which TWO of the following tools can be used to authenticate to remote systems using only the NTLM hash? (Choose two.)

Accepted Answer

CrackMapExec with the -H option. Impacket's wmiexec.py and CrackMapExec both explicitly support pass-the-hash via command-line options (-hashes and -H respectively). They allow authentication using only the NTLM hash, enabling lateral movement without the plaintext password. The other tools either lack support for pass-the-hash or require additional steps.

Answer

Metasploit's psexec module with SMBPass set to the hash

Answer

Hydra with the -p option

Answer

Nmap with the smb-psexec script

Question 13

You have obtained a set of NTLM hashes from a Windows domain controller during a penetration test. You want to use these hashes to authenticate to other systems without knowing the plaintext passwords. Which TWO of the following techniques allow you to leverage these hashes for lateral movement? (Choose two.)

Accepted Answer

Pass-the-Hash using Impacket's psexec.py with the -hashes option.. Pass-the-Hash with Impacket's psexec.py and Overpass-the-Hash with Mimikatz's sekurlsa::pth are both valid techniques for using NTLM hashes to authenticate without plaintext passwords. The former uses SMB, while the latter converts the hash into a Kerberos ticket for broader access. The other options either require different hash types, are not supported, or misunderstand Kerberos encryption. Thus, these two techniques enable lateral movement.

Answer

Pass-the-Ticket using a forged Kerberos service ticket (silver ticket) created from the NTLM hash.

Answer

Use the NTLM hash to decrypt the domain's Kerberos TGTs and extract plaintext passwords.

Answer

Pass-the-Hash using RDP with the NTLM hash to authenticate to a remote desktop session.

Question 14

You have compromised a Windows host and extracted the local SAM database. You want to crack the NTLM hashes offline. Which of the following hashcat modes should you use for NTLM hashes?

Accepted Answer

1000. Hashcat mode 1000 is designated for NTLM hashes. NTLM hashes are the MD4 hash of the user's password and are stored in the SAM database. Modes 3000, 5500, and 5600 correspond to LM, NetNTLMv2, and NetNTLMv1 respectively, which are different hash types. Using the correct mode ensures efficient cracking.

Answer

5600

Answer

3000

Answer

5500

Question 15

During a penetration test, you gain access to a Windows workstation and extract a Kerberos TGS ticket for a service account from memory using Mimikatz. You suspect the service account's password is weak and want to crack it offline. Which tool and technique should you use?

Accepted Answer

Use hashcat with mode 13100 (Kerberos 5 TGS-REP etype 23) and a wordlist.. The extracted TGS ticket is a Kerberos 5 TGS-REP etype 23 hash, which can be cracked offline using hashcat mode 13100. This mode is specifically designed for this hash type and leverages GPU acceleration for efficiency. John the Ripper is a valid alternative but less optimal. Forging a golden ticket requires the krbtgt hash, and Responder captures different credentials. Thus, hashcat mode 13100 is the correct tool and technique.

Answer

Use John the Ripper with the krb5tgs format and a rule set.

Answer

Use Mimikatz with the kerberos::golden module to forge a golden ticket.

Answer

Use Responder to capture the service account's NetNTLMv2 hash and crack it with hashcat mode 5600.

Question 16

You have successfully obtained a NTLM hash dump from a domain controller. You intend to perform a pass-the-hash attack to move laterally. What is the most critical requirement for this technique to succeed in a modern Windows environment?

Accepted Answer

The authentication protocol must permit NTLM or legacy authentication methods to facilitate the hash usage.. Pass-the-hash (PtH) relies on the fact that authentication protocols like NTLM require the hash itself rather than the cleartext password. Understanding this mechanism is vital because it allows attackers to impersonate users without needing to crack complex passwords. The technique effectively bypasses the need for plaintext credentials, making it a staple for lateral movement in internal penetration tests when local administrator or service account access is achieved.

Answer

The target system must have the Kerberos pre-authentication disabled for the user account.

Answer

The victim machine must have the 'Restricted Admin' mode enabled in the RDP configuration.

Answer

The target machine must be running a version of Windows older than Windows Server 2012.

Question 17

Refer to the exhibit. What is the primary purpose of the command provided?

Accepted Answer

Cracking NTLM hashes using a dictionary-based approach.. This command initiates a dictionary attack against NTLM hashes. Mode 1000 is specifically designated for NTLM authentication hashes, while -a 0 denotes a straight dictionary attack using a wordlist. Knowing how to map hash formats to their corresponding Hashcat mode is a fundamental skill for password cracking. Incorrectly identifying the mode or the attack type will result in an inability to recover the plaintext credentials during a penetration test.

Answer

Performing a brute-force attack on a SHA-256 encrypted archive.

Answer

Attempting a mask attack to guess passwords based on a specific pattern.

Answer

Extracting domain user hashes from a SAM database file.

Question 18

You are auditing a web application and notice it uses base64 encoding to store user credentials in a cookie. What is the most accurate assessment of this security practice?

Accepted Answer

The implementation is insecure because base64 is an encoding, not a cryptographic protection.. Base64 is an encoding scheme, not an encryption or hashing algorithm. It is completely reversible and provides zero confidentiality for sensitive data. An attacker can easily decode these values to reveal plaintext credentials. This is a common finding in penetration tests that highlights a lack of understanding of the difference between obfuscation and actual security controls, requiring immediate remediation to protect session integrity.

Answer

The credentials are secure because base64 is difficult to reverse without the secret key.

Answer

The credentials are protected from casual inspection but vulnerable to automated tools.

Answer

The implementation is acceptable if the connection is encrypted with TLS.

Question 19

During an engagement, you capture an AS-REP response from the domain controller. What is the specific prerequisite for this account to be vulnerable to AS-REP Roasting?

Accepted Answer

The account must have the 'Do not require Kerberos pre-authentication' option enabled.. AS-REP Roasting is possible when a user account has the 'Do not require Kerberos pre-authentication' attribute enabled in Active Directory. This allows an attacker to request a ticket for the user without needing the correct password, which can then be cracked offline. Understanding this specific AD attribute is critical for identifying vulnerable accounts during internal reconnaissance, as it represents a significant misconfiguration that simplifies the path to credential recovery.

Answer

The account must have a Service Principal Name (SPN) set in the domain properties.

Answer

The user must be a member of the Domain Admins or Enterprise Admins group.

Answer

The account must be configured with a password that has never been rotated.

Question 20

Which of the following describes the risk associated with using a password manager that lacks a master password and relies solely on local file encryption?

Accepted Answer

The encryption keys are stored in a predictable location or memory, allowing for easy extraction.. Password managers are designed to consolidate credentials, but they are only as secure as their master secret. Without a master password, the vault relies on the security of the host filesystem. If an attacker gains local access or performs a memory dump, the keys are easily extractable. This concept is vital for understanding how credential storage mechanisms can be exploited when the primary authentication factor is absent or bypassed.

Answer

The vault is vulnerable to dictionary attacks due to the lack of a salt in the local file.

Answer

The lack of a master password prevents the use of multi-factor authentication for the vault.

Answer

The file format will be incompatible with standard password cracking software like John the Ripper.