Active Directory Attacks

When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?

Which native Windows command-line tool can be used by a penetration tester to view cached Kerberos tickets currently loaded in the user session?

An advanced adversary has gained Domain Administrator privileges and wants to establish stealthy, long-term persistence in Active Directory without relying solely on traditional user accounts or standard scheduled tasks. Which THREE advanced persistence mechanisms can be deployed in an Active Directory environment? (Choose THREE)

Which TWO configuration checks should a penetration tester perform when auditing an Active Directory domain for potential NTLM Relay vulnerabilities?

When generating a Silver Ticket using Impacket's ticketer.py, what specific piece of cryptographic material is required instead of the KRBTGT hash?

During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?

A penetration tester is evaluating an Active Directory environment and discovers that LDAP signing is not enforced. Which attack technique does this misconfiguration directly facilitate?

A tester has located a domain user account configured with Constrained Delegation (S4U2Self / S4U2Proxy) pointing to a target service. What tool and module in Impacket can be used to leverage this delegation to obtain a TGS for a privileged user (e.g., Administrator)?

When executing a DCSync attack programmatically via Impacket's secretsdump.py, how does the tool interact with Active Directory to request password data without running code on the domain controller?

A penetration tester is performing an attack utilizing the PetitPotam (MS-EFSR) vulnerability against a domain controller. What is the primary objective of forcing the domain controller to authenticate via PetitPotam?

An operator is conducting an Active Directory penetration test and has obtained domain admin credentials. To maintain persistence, they want to create a backdoor that allows them to authenticate as any user without knowing their password, even if the domain admin password is changed. Which of the following techniques would BEST achieve this?

An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?

During an Active Directory penetration test, an operator has compromised a user account and discovered that the account has GenericAll permissions on a computer object. The operator wants to abuse this permission to gain administrative access to the computer. Which technique should the operator use?

An operator has compromised a domain user account and wants to perform a Kerberoasting attack to extract service account hashes. The operator uses Rubeus with the kerberoast command. Which encryption type should the operator request to maximize the chance of cracking the extracted tickets?

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

During an internal penetration test, an operator gains access to a domain-joined Windows workstation and discovers that the current user has local administrator rights on that machine. The operator wants to extract the NTLM hash of the domain administrator who previously logged into this workstation. Which of the following locations is MOST likely to contain this credential material?

An operator has obtained a valid Kerberos Ticket Granting Ticket (TGT) in the form of a .kirbi file from a compromised domain-joined Linux host. They want to convert this .kirbi file into a .ccache file so that it can be used with Impacket tools on their attack VM. Which of the following tools is specifically designed for this conversion?

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

During a Red Team assessment against an enterprise network, an operator wants to execute a Silver Ticket attack against a specific service (e.g., CIFS) on a target server. What is a key operational advantage of a Silver Ticket compared to a Golden Ticket?

An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?

A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?

Which TWO Active Directory mechanisms or configurations are commonly targeted during lateral movement to bypass traditional perimeter security and leverage built-in domain trust relationships?

Which THREE methods or attack primitives can be used to achieve domain escalation when an attacker has compromised an account with 'GenericAll' permissions over a Group Policy Object (GPO)?

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Which THREE tactics or actions are effective in defending against or detecting Golden Ticket attacks in an enterprise Active Directory environment?

An operator has gained administrative access to a subordinate domain in a multi-domain Active Directory forest and wishes to escalate privileges to Enterprise Admin across the entire forest. What object or group must be compromised to achieve forest-wide control?

When analyzing a compromised Active Directory environment using BloodHound, which THREE common node properties or paths typically signify a high-value target or an immediate path to Domain Admin?

An auditor is reviewing Active Directory Certificate Services and identifies ESC8. What exact AD CS endpoint is exploited during an ESC8 attack vector?

An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

You have compromised a domain user account and discovered that the user has 'WriteDACL' permission on a sensitive Organizational Unit (OU). You want to escalate privileges by modifying the OU's ACL to grant yourself full control. Which built-in Windows command-line utility can you use to modify the ACL of the OU?

During an internal penetration test, you compromise a domain-joined Windows 10 workstation and obtain a SYSTEM-level shell. You extract the NTLM hash of a domain user from LSASS but cannot crack it. Which technique allows you to authenticate to a remote server as that domain user without knowing the plaintext password?

Which Active Directory right or permission allows a security principal to perform a DCSync attack, thereby replicating domain secrets?

During a penetration test, you have compromised a workstation and obtained the NTLM hash of a domain user who is logged in. You want to move laterally to a server where this user has administrative rights. Which technique would allow you to authenticate to the server without knowing the plaintext password?

A penetration tester has gained access to a workstation and wants to move laterally to a server using a Golden Ticket. The tester has the KRBTGT hash and the domain SID. Which tool from the Impacket suite should be used to forge and inject the Golden Ticket?

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

Which TWO native Windows tools or Sysinternals utilities can be used by an operator during post-exploitation to dump credentials from the LSASS process memory?

An operator has discovered a computer object with Unconstrained Delegation enabled in Active Directory. How can this configuration be abused if a Domain Administrator account can be coerced to authenticate to it?