GPEN Kerberos Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The NTLM hash is insufficient because it cannot be used to request a Ticket Granting Ticket (TGT).

  Why it's wrong here

  Requesting a TGT requires an initial authentication exchange, such as AS-REQ, which typically uses the user's password or AES keys. While an NTLM hash can be used for NTLM authentication, it does not bypass the Kerberos protocol requirements for obtaining a TGS via an SPN request.

• ✗

  The NTLM hash is only useful for Pass-the-Hash attacks and cannot facilitate any Kerberos interactions.

  Why it's wrong here

  The NTLM hash is indeed central to Pass-the-Hash, but it is not entirely useless for Kerberos. In mixed environments, NTLM hashes can sometimes be used to facilitate downgrade attacks or service authentication, but they remain fundamentally incompatible with the specific TGS-REQ/TGS-REP flow used for Kerberoasting.

• ✓

  Kerberoasting targets the service account's password hash by requesting a TGS, not by leveraging existing NTLM hashes.

  Why this is correct

  Kerberoasting relies on the KDC encrypting a service ticket with the target service account's password. The attacker requests this ticket and then attempts to brute-force the password offline. Possessing the NTLM hash of the account does not provide the encrypted TGS blob needed for this specific offline cracking methodology.

• ✗

  The NTLM hash must first be converted to a Kerberos AES-256 key before a TGS request can be initiated.

  Why it's wrong here

  There is no direct mathematical conversion from an NTLM hash to a Kerberos AES-256 key because they utilize different cryptographic primitives. NTLM uses MD4, while Kerberos uses HMAC-SHA1 or HMAC-SHA256. Attempting to convert them will not enable the Kerberoasting process as described in standard penetration testing workflows.