OSCP Active Directory Attacks 1 — Questions and Answers
Question 1: What is BloodHound used for during Active Directory penetration testing in OSCP?
- Brute-forcing Active Directory user passwords
- Visualizing Active Directory relationships and attack paths to Domain Admin using graph analysis (Correct answer)
- Monitoring Active Directory for suspicious login activity
- Generating phishing emails targeting Active Directory users
Correct answer: Visualizing Active Directory relationships and attack paths to Domain Admin using graph analysis
BloodHound uses graph theory to visualize Active Directory relationships and automatically identifies the shortest attack paths to high-value targets like Domain Admin.
Question 2: What tool is used to collect Active Directory data for BloodHound?
- ldapquery.py
- SharpHound (or BloodHound.py) (Correct answer)
- PowerView --collect
- ADExplorer --export
Correct answer: SharpHound (or BloodHound.py)
SharpHound (C# .NET assembly) or BloodHound.py (Python for Linux) are the data collectors (ingestors) that enumerate Active Directory and produce JSON files that BloodHound ingests.
Question 3: What does AS-REP Roasting target in Active Directory?
- Accounts with SPNs registered for services
- Accounts with Kerberos pre-authentication disabled, whose AS-REP can be cracked offline (Correct answer)
- Accounts in the Domain Admins group only
- Accounts that have logged in within the last 30 days
Correct answer: Accounts with Kerberos pre-authentication disabled, whose AS-REP can be cracked offline
AS-REP Roasting targets accounts where Kerberos pre-authentication is disabled; the KDC responds with an AS-REP encrypted with the account's hash, which can be cracked offline without any credentials.
Question 4: What is the purpose of the 'net user /domain' command in Active Directory enumeration?
- Creates a new domain user account
- Lists all user accounts in the current Active Directory domain (Correct answer)
- Resets a domain user's password
- Lists domain controllers in the environment
Correct answer: Lists all user accounts in the current Active Directory domain
The 'net user /domain' command queries the domain controller and returns a list of all user accounts in the Active Directory domain, useful for user enumeration.
Question 5: What is DCSync and what privilege is required to perform it?
- A technique to sync time with domain controllers; requires authenticated domain user
- A technique that mimics domain controller replication to extract all password hashes; requires Replicating Directory Changes All privilege (Correct answer)
- A technique to force a domain controller restart; requires SYSTEM on the DC
- A technique to enumerate all GPOs; requires Domain Admin
Correct answer: A technique that mimics domain controller replication to extract all password hashes; requires Replicating Directory Changes All privilege
DCSync uses Mimikatz to simulate a domain controller replication request (DRS protocol), extracting all password hashes from Active Directory; it requires the 'Replicating Directory Changes All' privilege typically held by Domain Admins.
Question 6: What is a Golden Ticket attack in Active Directory?
- Forging Kerberos TGTs using the krbtgt account's NTLM hash, granting persistent domain-wide access (Correct answer)
- Stealing administrative tokens from domain admin sessions
- Creating unauthorized domain administrator accounts
- Capturing all Kerberos tickets on the network via ARP poisoning
Correct answer: Forging Kerberos TGTs using the krbtgt account's NTLM hash, granting persistent domain-wide access
A Golden Ticket is a forged Kerberos Ticket Granting Ticket created using the krbtgt account's hash, allowing persistent, domain-wide access even after password resets of other accounts.
OSCP Active Directory Attacks 1
What is BloodHound used for during Active Directory penetration testing in OSCP?