What is required to forge a Golden Ticket?

The domain SID and a user's password hash

The NTLM hash of the KRBTGT account

The domain administrator's password

A service ticket for the domain controller

You are enumerating a domain and find an account with the 'Do not require Kerberos preauthentication' flag set. You have network access to a domain controller but no valid credentials. What is the most effective way to obtain a crackable hash for this account?

Send an AS-REQ request without preauthentication and capture the AS-REP

Perform a password spray against the account using common passwords

Request a TGS ticket for the account's SPN and crack it

Use DCSync to replicate the account's hash from the domain controller

You have administrative credentials for a remote Windows server that has WinRM enabled. You need to execute a PowerShell command on the server. Which technique is most appropriate?

Use WMI to execute the PowerShell command.

Create a scheduled task to run the PowerShell command.

Use WinRM to execute the PowerShell command remotely.

Use PsExec to execute the PowerShell command.

You have Domain Admin privileges and want to maintain access to the domain even if the KRBTGT password is changed. You also want to avoid rebooting the domain controller. Which technique is most appropriate?

Extract the NTDS.dit file and crack all hashes offline.

Inject a Skeleton Key into the domain controller's LSASS process.

Forge a Golden Ticket using the current KRBTGT hash.

Modify the AdminSDHolder object to grant yourself persistent rights.

GIAC Red Team Professional

Domain 3Objective 2

Leveraging the Domain GRTP Practice Questions (Page 11)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

25concepts

25 Concepts in This Objective

Domain Enumeration
Kerberoasting
AS-REP Roasting
Pass-the-Hash
Pass-the-Ticket
Golden Ticket
Silver Ticket
DCSync
AdminSDHolder and SDProp
Group Policy Object (GPO) Abuse
Skeleton Key
ACL-Based Persistence
Domain Trust Exploitation
Lateral Movement via Scheduled Tasks
Lateral Movement via WMI
Lateral Movement via WinRM
Lateral Movement via PsExec
Credential Dumping from LSASS
NTDS.dit Extraction
Password Spraying
Kerberos Delegation Abuse
Privilege Escalation via Misconfigured ACLs
Domain Controller Synchronization (DCSync)
SID History Injection
GPO Link and Enforcement

Questions 51–55

51foundation · easy
What is required to forge a Golden Ticket?
Select an answer first
52application · medium
You are enumerating a domain and find an account with the 'Do not require Kerberos preauthentication' flag set. You have network access to a domain controller but no valid credentials. What is the most effective way to obtain a crackable hash for this account?
Select an answer first
53application · medium
You have administrative credentials for a remote Windows server that has WinRM enabled. You need to execute a PowerShell command on the server. Which technique is most appropriate?
Select an answer first
54expert · hard
You have Domain Admin privileges and want to maintain access to the domain even if the KRBTGT password is changed. You also want to avoid rebooting the domain controller. Which technique is most appropriate?
Select an answer first
55foundation · easy
Which service does PsExec typically install on the remote system to execute commands?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.