OSCP Active Directory Attacks 3

Question 1

What is a Pass-the-Ticket (PtT) attack in Active Directory?

Accepted Answer

Injecting a captured or forged Kerberos TGT or TGS into the current session to authenticate as that user

Answer

Pass-the-Ticket injects a captured or forged Kerberos ticket into the current Windows session using Mimikatz's kerberos::ptt, allowing authentication to services as the ticket owner.

Question 2

What does the PowerView cmdlet 'Get-DomainUser -SPN' retrieve in Active Directory?

Accepted Answer

All user accounts with Service Principal Names registered (Kerberoastable accounts)

Answer

The 'Get-DomainUser -SPN' command retrieves all Active Directory user accounts that have one or more Service Principal Names (SPNs) registered, identifying Kerberoastable targets.

Question 3

What is a domain trust and how can it be abused during OSCP multi-domain scenarios?

Accepted Answer

A domain trust allows authentication across domains; it can be abused with inter-realm tickets to pivot between trusted domains

Answer

Domain trusts establish authentication relationships between domains; attackers with Domain Admin in one domain can forge inter-realm trust tickets (e.g., Extra SID attack) to authenticate in trusted domains.

Question 4

What is NTDS.DIT and why is it a critical target during Active Directory attacks?

Accepted Answer

The Active Directory database file containing all user accounts, groups, and password hashes for the entire domain

Answer

NTDS.DIT is the Active Directory database file stored on domain controllers, containing all domain objects including user accounts and their NTLM hashes, making it the ultimate credential store for the domain.

Question 5

What is the primary purpose of running 'Invoke-Kerberoast' in a PowerShell session during OSCP?

Accepted Answer

To request TGS tickets for all SPN-registered accounts and output them in hashcat-crackable format

Answer

Invoke-Kerberoast requests service tickets for all accounts with registered SPNs and outputs the tickets in a format directly usable with hashcat (-m 13100) for offline cracking.

OSCP Practice Test

OSCP Practice Test

OSCP Active Directory Attacks 3