PT0-002 Practice Question: A penetration tester has obtained a TGT from a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pass-the-Hash

  Why it's wrong here

  Pass-the-Hash is an NTLM authentication attack that reuses a stolen NT hash to authenticate over SMB or other protocols, but it does not involve Kerberos TGTs. Because the tester already has a TGT from the domain controller, the more appropriate attack is a Kerberos-based forgery rather than an NTLM hash relay. Moreover, Pass-the-Hash is a lateral movement technique, not a persistence mechanism that allows arbitrary impersonation across the entire domain.

• ✗

  Silver Ticket

  Why it's wrong here

  A Silver Ticket is a forged Ticket Granting Service (TGS) encrypted with the password hash of a specific service account, such as a computer or service account, not the krbtgt hash. It only grants access to that one service, despite allowing the attacker to alter PAC fields for any user. Since the tester obtained a TGT from a domain controller, they have a ticket-granting ticket but not necessarily the target service account's hash, and even if they did, a Silver Ticket lacks the domain-wide access of a Golden Ticket.

• ✓

  Golden Ticket

  Why this is correct

  The Golden Ticket attack is the correct answer because it uses the krbtgt hash to forge a TGT, granting the attacker the ability to impersonate any user, including domain admins, for any service in the domain. With a forged TGT signed by the krbtgt account, the attacker can request access to any resource without requiring credentials for each target service. This attack provides the strongest persistence and domain-wide compromise, which aligns with the scenario of having obtained a TGT from a domain controller.

• ✗

  DCSync

  Why it's wrong here

  DCSync is a directory replication attack that uses the DRSUAPI protocol to impersonate a domain controller and pull password hashes, including the krbtgt hash, without running code on the target DC. While DCSync requires domain admin privileges and can indirectly support a Golden Ticket by obtaining the krbtgt hash, it is not the attack that directly forges a ticket. Since the tester already has a TGT, they would not need to perform DCSync to execute the question's described attack, which is about ticket forgery rather than credential extraction.

Go deeper

Related to this question