CCNA Active Directory Attacks Questions

NTLM Relay involves capturing authentication requests from a client and forwarding them to a target server. If the target server allows NTLM authentication and does not have protections like SMB signing enabled, the server will accept the relayed authentication as if it came from the original user. This allows the attacker to impersonate the user and execute commands or access files on the target server.

The distinction between Golden and Silver tickets is fundamental to understanding post-exploitation persistence. Golden tickets involve the KRBTGT account, granting access to the entire domain, while Silver tickets target specific service accounts. Mastering this difference is essential for determining the scope of an attack and the level of stealth required, as Silver tickets are often safer to deploy as they avoid triggering certain domain controller alerts related to TGT requests.

To perform DCSync, the compromised account must possess both the Replicating Directory Changes and Replicating Directory Changes All permissions on the domain object. These permissions allow the account to impersonate a domain controller and request replication of directory data, including password hashes. While Domain Admins have these by default, any account with these delegated rights can execute the attack.

Pass-the-Hash relies on the fact that Windows authentication protocols (NTLM) use the hash itself as a form of credential. By injecting the hash into the authentication process, the attacker can authenticate as the user without ever knowing the cleartext password. This bypasses complexity requirements and is immune to password cracking speeds, making it an extremely efficient method for lateral movement within a domain.

BloodHound with SharpHound is purpose-built for Active Directory attack path analysis. The -c All collection method gathers the full set of relationships, including ACLs and sessions, that BloodHound needs to compute shortest paths. Alternative enumeration tools may gather partial data but lack the graph-based analysis and visualization that makes escalation paths immediately actionable.

The captured artifact is an NTLMv2 challenge/response, which is only useful for offline cracking. SMB signing prevents relay, and the client's outbound SMB restriction blocks additional capture avenues. Hashcat mode 5600 is the correct cracking mode for netntlmv2, and a targeted wordlist improves efficiency against a real user's password.

Group Policy Preferences (GPP) allows administrators to manage local accounts on domain computers. In older versions of Windows, these passwords were encrypted with a static, publicly known AES key. If an attacker gains read access to the 'Groups.xml' file in the SYSVOL share, they can decrypt the 'cpassword' attribute, revealing the cleartext password of the local administrator account for the affected machine.

BloodHound uses SharpHound as its data collector. SharpHound queries the Active Directory environment to identify relationships between users, groups, computers, and permissions. This data is then imported into the BloodHound graph database, allowing testers to visualize complex attack paths, such as shortest paths to Domain Admin, which would be difficult to identify through manual enumeration alone.

GenericAll over a computer object allows full control, including modifying the msDS-KeyCredentialLink attribute. By adding a Key Credential, an attacker can authenticate as the computer account via PKINIT and obtain a TGT, effectively taking over the machine. This shadow credentials technique is direct and does not require cracking or additional accounts, making it the most efficient path to compromise WEB01.

Pass-the-Hash relies on the fact that NTLM authentication uses the hash of a password rather than the password itself. If an attacker gains the NTLM hash of a user who has local administrative rights on a target, they can authenticate as that user. This is a primary method for lateral movement within an AD environment, allowing attackers to escalate privileges across hosts without ever needing to know the user's actual cleartext password.

Pass-the-Ticket with Mimikatz's kerberos::ptt injects the stolen TGT into the current session, allowing Kerberos authentication as the user. This grants access to network resources such as file shares without needing the password. It is the appropriate technique when a TGT is already available and the goal is to use it for lateral movement.

With write permissions on a GPO linked to an OU containing privileged servers, modifying the GPO to add an immediate scheduled task that runs as SYSTEM allows code execution with elevated privileges on those servers. This directly escalates privileges by leveraging the GPO's application to all computers in the OU, achieving SYSTEM-level access.

The ms-MCS-AdmPwd attribute stores the cleartext Local Administrator Password for a computer managed by LAPS. By reading this attribute, an attacker can extract the password for the local administrator account of the target machine. This is a critical discovery because it allows immediate lateral movement from a low-privileged domain context to local administrative privileges on that specific host, potentially leading to further credential harvesting or domain escalation.

SMB Signing adds a cryptographic signature to each packet in an SMB communication. When a relay attack occurs, the attacker does not possess the session key required to generate these signatures for the relayed packets. Consequently, the target server detects the missing or invalid signature and rejects the authentication attempt, effectively neutering the relay attack at the protocol level.

A service ticket encrypted with RC4-HMAC (etype 23) is protected by a key derived from the target service account's NT hash, so the ciphertext can be attacked entirely offline. Extracting the TGS-REP hash and running Hashcat mode 13100 against a wordlist recovers the plaintext password when it is weak, without generating additional authentication traffic against the domain.

Pass-the-Hash requires a tool that can supply an NTLM hash directly during authentication. Impacket's psexec.py is a Python implementation of PsExec that accepts -hashes, enabling authentication to SMB shares with a hash. The other tools either crack hashes offline, harvest credentials, or extract credentials locally, none of which achieve remote authentication with a hash.

DCSync exploits the Active Directory replication protocol. By mimicking the behavior of a domain controller, an attacker can request that another domain controller replicate user credentials, including password hashes, to them. This requires the attacker to hold 'Replication-Get-Changes' and 'Replication-Get-Changes-All' permissions, which are typically only held by domain controllers or highly privileged administrators, making it a powerful tool for dumping the entire domain's secrets.

Unconstrained delegation abuse requires two things: enabling the TRUSTED_FOR_DELEGATION flag on a controlled computer so the DC forwards TGTs to it, and coercing a privileged user to authenticate to that computer so a TGT is cached in memory. Extracting the TGT then allows impersonation. The other options describe constrained delegation, an unrelated SPN configuration, or a security control that blocks the attack.

CrackMapExec with valid credentials is the standard tool for quickly checking administrative access across many hosts. It performs a single authentication per host using the known password, avoiding lockout, and reports whether the account has local admin rights. Alternatives either risk lockout, capture unrelated credentials, or collect session data that does not directly answer the access question.

To forge a Golden Ticket, you need the KRBTGT account's NTLM hash to encrypt the ticket and the domain SID to populate the PAC correctly. These two elements allow you to create a TGT for any user, granting persistent domain-wide access. Other items like a valid TGT or user passwords are not required, as the ticket is self-signed with the KRBTGT hash.