PEN-200 Password Attacks — Timed 10 Questions

Question 1

When performing a password spraying attack against an O365 or Azure AD environment, which TWO factors are most likely to increase the risk of detection or account lockout?

Accepted Answer

Targeting accounts that are managed by Conditional Access policies with geo-blocking enabled.. Password spraying involves testing a single password against many accounts to avoid triggering lockout thresholds. However, excessive volume and specific security controls can lead to immediate detection. Identifying these risks is crucial for an OSCP practitioner to balance the need for discovery with the requirement to remain undetected. Monitoring for anomalous login patterns or failing to account for intelligent lockout policies will often result in the engagement being compromised.

Answer

Using a low-and-slow approach with long intervals between authentication attempts.

Answer

Running the attack during peak business hours when user activity is highest.

Answer

Using a common password that is included in the organization's banned password list.

Question 2

Which THREE of the following are common indicators that an organization is vulnerable to Kerberoasting?

Accepted Answer

The presence of service accounts with highly privileged roles in the domain.. Kerberoasting exploits the way Windows handles service accounts by requesting service tickets for accounts with Service Principal Names (SPNs). Identifying these indicators is essential for lateral movement. A successful attack allows an attacker to crack service account passwords offline. Recognizing these signs helps in assessing the risk of privilege escalation within a Windows domain, as most environments have at least one misconfigured or over-privileged service account susceptible to this technique.

Answer

The organization requires all users to change their passwords every 30 days.

Answer

The use of legacy NTLM authentication for all domain communication.

Question 3

You have gained access to a Linux machine and extracted the shadow file. Which THREE of the following are valid strategies for recovering the plaintext passwords from the hashes provided?

Accepted Answer

Utilizing Hashcat with the correct mode for the identified hashing algorithm.. Recovering passwords from the `/etc/shadow` file requires understanding the hash format and appropriate tools for the job. In a professional engagement, choosing the right strategy—whether it is automated cracking or targeted analysis—is vital. These methods represent the core techniques for offline password recovery on Linux, and mastery of them is essential for successfully transitioning from initial access to full credential compromise on target systems.

Answer

Using a simple shell script to decrypt the hashes using a symmetric key.

Answer

Executing an AS-REP roasting attack against the local system.

Question 4

What is the primary risk of performing a password spray against an organization that has implemented a third-party Single Sign-On (SSO) solution?

Accepted Answer

The centralized nature of SSO allows for more effective detection and blocking of malicious attempts.. SSO solutions centralize authentication, which means a single point of failure can lead to widespread compromise. However, from an attacker's perspective, spraying an SSO provider often triggers centralized logging and protection mechanisms that are much more robust than those on individual applications. This makes detection significantly more likely. Understanding the architecture of SSO is important for assessing the risk of account lockout and account compromise.

Answer

SSO solutions inherently disable account lockout policies to improve user experience.

Answer

SSO solutions only support multi-factor authentication, making password spraying impossible.

Answer

Passwords in an SSO environment are always stored in plaintext, making them easy to recover.

Question 5

Which TWO actions are considered best practices for securing service accounts against password-based attacks?

Accepted Answer

Using Group Managed Service Accounts (gMSAs) to handle automatic password management.. Securing service accounts is a fundamental component of defending an AD environment. These accounts are often over-privileged and rarely monitored, making them high-value targets. By following these best practices, an organization can significantly reduce the risk of an attacker gaining a foothold via a service account. Recognizing these defenses is important for an OSCP practitioner to provide actionable recommendations after identifying potential vulnerabilities during an assessment.

Answer

Assigning the service account to the Domain Admins group for full access.

Answer

Configuring the account to never require a password change for stability.

Answer

Storing service account passwords in a shared, plaintext network folder.

Question 6

You are performing a password cracking attack on an encrypted archive that uses a custom KDF (Key Derivation Function). How should you proceed if Hashcat does not support the format natively?

Accepted Answer

Switch to a brute-force attack using a custom Python script to perform the KDF.. When a target uses a non-standard or custom cryptographic implementation, standard tools like Hashcat or John may fail. In such cases, you must analyze the implementation to reverse engineer how the key is derived. Once the logic is understood, you can create a custom script or a plugin to bridge the gap. This demonstrates an advanced understanding of cryptography and the ability to adapt when common tools are insufficient for the task at hand.

Answer

Use an online password cracking service to decrypt the archive.

Answer

Assume the archive is unbreakable and move to a different lateral movement vector.

Answer

Run a dictionary attack against the binary file without a KDF transformation.

Question 7

You are performing a password spraying attack against a web application. You notice that the application returns a specific 403 Forbidden error when a username exists but the password is incorrect, and a 401 Unauthorized error when the username does not exist. How should you adjust your attack strategy?

Accepted Answer

Perform user enumeration to validate usernames before spraying passwords.. This scenario represents an information leak via side-channel timing or status codes. By leveraging the difference in error codes, you can perform user enumeration to identify valid accounts before executing a targeted password spray. This minimizes the risk of triggering account lockout policies on non-existent accounts and increases the success rate by focusing only on valid usernames, which is a fundamental technique for stealthy authentication bypass during penetration tests.

Answer

Increase the delay between requests to bypass rate limiting.

Answer

Use a password list containing common patterns like Winter2023!.

Answer

Rotate the source IP addresses for every single password attempt.

Question 8

You are assessing a Linux machine and have read access to /etc/shadow. Which TWO of the following statements regarding the file structure or cracking process are correct?

Accepted Answer

The salt is stored between the first and second dollar signs in the hash string.. Understanding /etc/shadow is critical for offline password auditing. The file structure dictates how tools like John the Ripper parse salts and hash identifiers. Identifying the correct hash algorithm (e.g., SHA-512 vs MD5) is mandatory, as improper identification leads to failed cracking attempts. This knowledge allows penetration testers to effectively audit local user security and perform password complexity analysis in a controlled, offline environment.

Answer

The $6$ identifier indicates the usage of the MD5 hashing algorithm.

Answer

Cracking SHA-512 hashes is computationally easier than cracking legacy DES-based hashes.

Answer

If the second field is an asterisk (*), the user is required to change their password.

Question 9

You are performing a password audit and want to generate targeted candidate passwords based on company-specific terms, years, and common suffixes using Hashcat's rule-based engine. Which built-in Hashcat rule file applies standard capitalization toggles and appends common digit suffixes?

Accepted Answer

hashcat -a 0 -r rules/best64.rule wordlist.txt hashes.txt. Rule-based attacks allow penetration testers to drastically increase password cracking success rates by mutating wordlist entries with predictable human patterns. The best64.rule file contains a highly optimized set of transformation rules that cover capitalization, reversal, and common numeric appends without introducing excessive computational overhead.

Answer

hashcat -a 1 -r rules/combinator.rule wordlist1.txt wordlist2.txt hashes.txt

Answer

hashcat -a 3 -r rules/T1048.rule mask.hcmask hashes.txt

Answer

hashcat -a 6 -r rules/leetspeak.rule wordlist.txt mask.hcmask hashes.txt

Question 10

During an internal penetration test, you capture a Kerberos AS-REP response for a user account that does not require pre-authentication. You save the hash to a file. Which tool and mode should you use to attempt to crack this hash offline?

Accepted Answer

John the Ripper with the krb5asrep format. When you capture a Kerberos AS-REP hash, the encryption type may be RC4 or AES. John the Ripper's krb5asrep format automatically detects and handles both, making it the most versatile tool for this task. Hashcat requires selecting the correct mode, which depends on the etype. Therefore, John the Ripper is the best choice when the etype is unknown.

Answer

Hashcat with mode 18200

Answer

Aircrack-ng with the -K option

Answer

Hashcat with mode 7500