You are assessing a domain where a legacy application requires a set of user accounts to have 'Do not require Kerberos preauthentication' enabled. You want to obtain password hashes for offline cracking without sending any traffic to the domain controller beyond the initial authentication request. Which technique should you use?

Kerberoasting: request a service ticket for each account's SPN

AS-REP roasting: send an AS-REQ without preauthentication and capture the AS-REP

Pass-the-ticket: replay a captured TGT from one of the accounts

Silver ticket: forge a service ticket using the account's hash

You have compromised a server that has unconstrained delegation enabled. The server is trusted for delegation to a file server. You want to impersonate a domain admin who frequently connects to the compromised server. Which attack should you perform?

Wait for the domain admin to authenticate to the compromised server, capture their TGT, and use it to access the file server

Perform Kerberoasting against the file server's SPN to obtain a service ticket

Forge a silver ticket for the file server using the compromised server's hash

Use the compromised server's machine account to request a service ticket for the file server as the domain admin

You have compromised the password hash of the account running the SQL Server service in a domain. You want to access the SQL Server service as a domain admin without contacting a domain controller. Which attack should you perform?

Use pass-the-ticket with a captured TGT from the domain admin

Perform Kerberoasting to obtain a service ticket for SQL Server

Forge a silver ticket for the SQL Server service using the service account hash

Forge a golden ticket using the KRBTGT hash

You have compromised a server configured for resource-based constrained delegation (RBCD) where the server's computer account has the 'AllowedToActOnBehalfOfOtherIdentity' attribute set to allow a specific service account. You control that service account. You want to impersonate a domain admin to access the server. Which attack should you use?

Use the domain admin's TGT directly to access the server.

Perform Kerberoasting against the domain admin's account.

Forge a silver ticket for the server using the service account's hash.

Use the service account to perform S4U2Self to obtain a ticket for the domain admin, then S4U2Proxy to access the server.

GIAC Penetration Tester (GPEN)

Domain 4Objective 1

Kerberos Attacks GPEN Practice Questions (Page 5)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

12concepts

Questions 21–25

21application · medium
You are assessing a domain where a legacy application requires a set of user accounts to have 'Do not require Kerberos preauthentication' enabled. You want to obtain password hashes for offline cracking without sending any traffic to the domain controller beyond the initial authentication request. Which technique should you use?
Select an answer first
22expert · hard
You have compromised a server that has unconstrained delegation enabled. The server is trusted for delegation to a file server. You want to impersonate a domain admin who frequently connects to the compromised server. Which attack should you perform?
Select an answer first
23application · medium
You have compromised the password hash of the account running the SQL Server service in a domain. You want to access the SQL Server service as a domain admin without contacting a domain controller. Which attack should you perform?
Select an answer first
24expert · hard
You have compromised a server configured for resource-based constrained delegation (RBCD) where the server's computer account has the 'AllowedToActOnBehalfOfOtherIdentity' attribute set to allow a specific service account. You control that service account. You want to impersonate a domain admin to access the server. Which attack should you use?
Select an answer first
25foundation · easy
Which encryption type is generally considered the weakest and often targeted in downgrade attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Kerberos Attacks GPEN Practice Questions (Page 5)

Questions 21–25

You have compromised a server that has unconstrained delegation enabled. The server is trusted for delegation to a file server. You want to impersonate a domain admin who frequently connects to the compromised server. Which attack should you perform?

You have compromised the password hash of the account running the SQL Server service in a domain. You want to access the SQL Server service as a domain admin without contacting a domain controller. Which attack should you perform?

Which encryption type is generally considered the weakest and often targeted in downgrade attacks?

Keep studying — Active Directory Attacks