During an assessment, you have successfully dumped a TGT from the memory of a domain user's workstation. You need to access a file share on a remote server as that user. Which technique should you use?

Pass-the-Ticket by injecting the TGT into your current session.

Use DCSync to replicate the user's hash from the domain controller.

Use the NTLM hash of the user to perform a Pass-the-Hash attack.

Forge a Silver Ticket for the file server using the user's hash.

You have compromised a workstation and extracted the NTLM hash of a domain admin account. You need to move laterally to a file server that does not support Kerberos. Which technique should you use?

Use the NTLM hash to authenticate to the file server via SMB

Create a scheduled task on the file server using the hash

Inject the hash into LSASS on the file server

Forge a silver ticket for the file server's SPN

What is needed to extract password hashes from NTDS.dit?

The SYSTEM hive and the NTDS.dit file

The Active Directory database file

GIAC Red Team Professional

Domain 3Objective 2

Leveraging the Domain GRTP Practice Questions (Page 5)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

25concepts

25 Concepts in This Objective

Domain Enumeration
Kerberoasting
AS-REP Roasting
Pass-the-Hash
Pass-the-Ticket
Golden Ticket
Silver Ticket
DCSync
AdminSDHolder and SDProp
Group Policy Object (GPO) Abuse
Skeleton Key
ACL-Based Persistence
Domain Trust Exploitation
Lateral Movement via Scheduled Tasks
Lateral Movement via WMI
Lateral Movement via WinRM
Lateral Movement via PsExec
Credential Dumping from LSASS
NTDS.dit Extraction
Password Spraying
Kerberos Delegation Abuse
Privilege Escalation via Misconfigured ACLs
Domain Controller Synchronization (DCSync)
SID History Injection
GPO Link and Enforcement

Questions 21–25

21foundation · easy
Which permission on a user object would allow an attacker to reset that user's password?
Select an answer first
22application · medium
During an assessment, you have successfully dumped a TGT from the memory of a domain user's workstation. You need to access a file share on a remote server as that user. Which technique should you use?
Select an answer first
23application · medium
You have compromised a workstation and extracted the NTLM hash of a domain admin account. You need to move laterally to a file server that does not support Kerberos. Which technique should you use?
Select an answer first
24foundation · easy
What is needed to extract password hashes from NTDS.dit?
Select an answer first
25foundation · easy
What is NTDS.dit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Leveraging the Domain GRTP Practice Questions (Page 5)

Questions 21–25

Which permission on a user object would allow an attacker to reset that user's password?

During an assessment, you have successfully dumped a TGT from the memory of a domain user's workstation. You need to access a file share on a remote server as that user. Which technique should you use?

You have compromised a workstation and extracted the NTLM hash of a domain admin account. You need to move laterally to a file server that does not support Kerberos. Which technique should you use?

What is needed to extract password hashes from NTDS.dit?

What is NTDS.dit?

Keep studying — Active Directory Attacks and Post-Exploitation