OSCP Active Directory Attacks 3 — Questions and Answers
Question 1: What is a Pass-the-Ticket (PtT) attack in Active Directory?
- Brute-forcing Kerberos ticket passwords until one matches
- Injecting a captured or forged Kerberos TGT or TGS into the current session to authenticate as that user (Correct answer)
- Passing authentication tickets between domain forests via trust relationships
- Replaying captured Kerberos packets to re-authenticate to services
Correct answer: Injecting a captured or forged Kerberos TGT or TGS into the current session to authenticate as that user
Pass-the-Ticket injects a captured or forged Kerberos ticket into the current Windows session using Mimikatz's kerberos::ptt, allowing authentication to services as the ticket owner.
Question 2: What does the PowerView cmdlet 'Get-DomainUser -SPN' retrieve in Active Directory?
- All users with active sessions on domain computers
- All user accounts with Service Principal Names registered (Kerberoastable accounts) (Correct answer)
- All users with disabled Kerberos pre-authentication
- All users with expired passwords in the domain
Correct answer: All user accounts with Service Principal Names registered (Kerberoastable accounts)
The 'Get-DomainUser -SPN' command retrieves all Active Directory user accounts that have one or more Service Principal Names (SPNs) registered, identifying Kerberoastable targets.
Question 3: What is a domain trust and how can it be abused during OSCP multi-domain scenarios?
- A domain trust is a firewall rule between domains; it can be abused by disabling it
- A domain trust allows authentication across domains; it can be abused with inter-realm tickets to pivot between trusted domains (Correct answer)
- A domain trust is a shared DNS zone; it can be poisoned to redirect traffic
- A domain trust is an SSL certificate; it can be stolen and replayed
Correct answer: A domain trust allows authentication across domains; it can be abused with inter-realm tickets to pivot between trusted domains
Domain trusts establish authentication relationships between domains; attackers with Domain Admin in one domain can forge inter-realm trust tickets (e.g., Extra SID attack) to authenticate in trusted domains.
Question 4: What is NTDS.DIT and why is it a critical target during Active Directory attacks?
- The Active Directory database file containing all user accounts, groups, and password hashes for the entire domain (Correct answer)
- The domain controller's system event log containing authentication records
- The Kerberos ticket cache stored on the primary domain controller
- The group policy template database containing domain security settings
Correct answer: The Active Directory database file containing all user accounts, groups, and password hashes for the entire domain
NTDS.DIT is the Active Directory database file stored on domain controllers, containing all domain objects including user accounts and their NTLM hashes, making it the ultimate credential store for the domain.
Question 5: What is the primary purpose of running 'Invoke-Kerberoast' in a PowerShell session during OSCP?
- To force all domain users to re-authenticate with Kerberos
- To request TGS tickets for all SPN-registered accounts and output them in hashcat-crackable format (Correct answer)
- To perform an AS-REP Roasting attack against pre-auth disabled accounts
- To enumerate all Kerberos delegation settings in the domain
Correct answer: To request TGS tickets for all SPN-registered accounts and output them in hashcat-crackable format
Invoke-Kerberoast requests service tickets for all accounts with registered SPNs and outputs the tickets in a format directly usable with hashcat (-m 13100) for offline cracking.
Question 6: What does 'constrained delegation' mean in Active Directory and how does it differ from unconstrained delegation?
- Constrained delegation limits which services a host can delegate to, while unconstrained delegation allows delegation to any service (Correct answer)
- Constrained delegation requires a password; unconstrained delegation uses certificates
- Constrained delegation applies to users only; unconstrained applies to computers only
- Constrained delegation is enabled by default; unconstrained requires manual configuration
Correct answer: Constrained delegation limits which services a host can delegate to, while unconstrained delegation allows delegation to any service
Constrained delegation specifies exactly which target services a host/account can impersonate users to, unlike unconstrained delegation which allows impersonation to any service in the domain.
OSCP Active Directory Attacks 3
What is a Pass-the-Ticket (PtT) attack in Active Directory?