OSCP Active Directory Attacks 2

Question 1

What PowerShell module is commonly used for Active Directory enumeration without BloodHound in OSCP?

Accepted Answer

PowerSploit / PowerView

Answer

ActiveDirectory (RSAT module only)

Answer

Get-ADObject (requires AD Web Services)

Answer

ADRecon (requires GUI)

Question 2

What is LDAP anonymous bind and why is it a security concern in Active Directory?

Accepted Answer

It allows querying Active Directory without authentication, potentially exposing user accounts and organizational structure

Answer

It allows users to change their own LDAP password without authentication

Answer

It provides anonymous access to DNS records stored in AD

Answer

It enables unauthenticated LDAP write operations to the directory

Question 3

What is a Silver Ticket attack and how does it differ from a Golden Ticket?

Accepted Answer

A Silver Ticket forges a TGS for a specific service using that service account's hash, bypassing the KDC; a Golden Ticket forges the TGT itself

Answer

A Silver Ticket targets regular users; a Golden Ticket targets admin users

Answer

A Silver Ticket is temporary; a Golden Ticket is permanent

Answer

There is no practical difference between the two attack types

Question 4

What is the significance of finding 'GenericAll' ACL permission on a user object in BloodHound?

Accepted Answer

It grants full control over the object, enabling password reset, adding to groups, or configuring Kerberos delegation

Answer

It allows reading the user's password hash from the DC only

Answer

It only allows viewing the user's attributes without modification

Answer

It grants permission to delete the user account permanently

Question 5

What is Unconstrained Delegation in Active Directory and why is it dangerous?

Accepted Answer

It allows a service account to delegate to any other service, caching users' TGTs which can be extracted and reused

Answer

It allows domain users to log into any machine in the domain

Answer

It removes password expiration requirements for service accounts

Answer

It allows services to read all Active Directory attributes

Question 6

What Impacket tool is used to retrieve a list of all usernames from a domain controller via Kerberos?

Accepted Answer

GetNPUsers.py

Answer

kerbrute userenum

Answer

GetUserSPNs.py

Answer

lookupsid.py