OSCP Active Directory Attacks 2 — Questions and Answers
Question 1: What PowerShell module is commonly used for Active Directory enumeration without BloodHound in OSCP?
- PowerSploit / PowerView (Correct answer)
- ActiveDirectory (RSAT module only)
- Get-ADObject (requires AD Web Services)
- ADRecon (requires GUI)
Correct answer: PowerSploit / PowerView
PowerView (part of PowerSploit) provides cmdlets for enumerating users, groups, computers, trusts, and ACLs in Active Directory without requiring RSAT or AD module installation.
Question 2: What is LDAP anonymous bind and why is it a security concern in Active Directory?
- It allows querying Active Directory without authentication, potentially exposing user accounts and organizational structure (Correct answer)
- It allows users to change their own LDAP password without authentication
- It provides anonymous access to DNS records stored in AD
- It enables unauthenticated LDAP write operations to the directory
Correct answer: It allows querying Active Directory without authentication, potentially exposing user accounts and organizational structure
Anonymous LDAP bind allows unauthenticated queries to Active Directory, potentially exposing user accounts, groups, computer names, and organizational structure that aids attackers in reconnaissance.
Question 3: What is a Silver Ticket attack and how does it differ from a Golden Ticket?
- A Silver Ticket forges a TGS for a specific service using that service account's hash, bypassing the KDC; a Golden Ticket forges the TGT itself (Correct answer)
- A Silver Ticket targets regular users; a Golden Ticket targets admin users
- A Silver Ticket is temporary; a Golden Ticket is permanent
- There is no practical difference between the two attack types
Correct answer: A Silver Ticket forges a TGS for a specific service using that service account's hash, bypassing the KDC; a Golden Ticket forges the TGT itself
A Silver Ticket forges a TGS (service ticket) for a specific service using the service account's hash, bypassing the KDC entirely; a Golden Ticket forges the TGT (master ticket) using the krbtgt hash.
Question 4: What is the significance of finding 'GenericAll' ACL permission on a user object in BloodHound?
- It allows reading the user's password hash from the DC only
- It grants full control over the object, enabling password reset, adding to groups, or configuring Kerberos delegation (Correct answer)
- It only allows viewing the user's attributes without modification
- It grants permission to delete the user account permanently
Correct answer: It grants full control over the object, enabling password reset, adding to groups, or configuring Kerberos delegation
GenericAll is the highest-privilege ACL right, granting full control over an AD object, including the ability to reset passwords, add group memberships, or configure Kerberos-based attacks.
Question 5: What is Unconstrained Delegation in Active Directory and why is it dangerous?
- It allows a service account to delegate to any other service, caching users' TGTs which can be extracted and reused (Correct answer)
- It allows domain users to log into any machine in the domain
- It removes password expiration requirements for service accounts
- It allows services to read all Active Directory attributes
Correct answer: It allows a service account to delegate to any other service, caching users' TGTs which can be extracted and reused
Unconstrained Delegation allows a service to authenticate to any other service as the connecting user; Windows caches the user's TGT on the delegating host, where it can be extracted with Mimikatz and reused.
Question 6: What Impacket tool is used to retrieve a list of all usernames from a domain controller via Kerberos?
- GetNPUsers.py (Correct answer)
- kerbrute userenum
- GetUserSPNs.py
- lookupsid.py
Correct answer: GetNPUsers.py
GetNPUsers.py from Impacket enumerates accounts with Kerberos pre-authentication disabled (for AS-REP Roasting) and can also enumerate valid usernames through Kerberos error responses.
OSCP Active Directory Attacks 2
What PowerShell module is commonly used for Active Directory enumeration without BloodHound in OSCP?