A penetration tester obtains the hash of a service account within a customer’s Active Directory. Which of the following attacks should the penetration tester attempt next?
Kerberoasting is a post-exploitation attack used in Microsoft Active Directory environments to obtain password hashes for service accounts. The question states the pen tester already obtained the hash of the service account. So there is no need for kerberoasting. It's asking what would be the next step now that the hash of the service account has been obtained. Or am I just not reading/understanding this correctly?
D. Kerberoasting
Kerberoasting involves requesting a service ticket for the service account from the Kerberos Key Distribution Center (KDC). The ticket is then encrypted with the service account's password. By capturing the ticket and attempting to crack it offline, the tester can potentially recover the account's plaintext password.
Here's why the other options are less suitable in this context:
A. Password spraying: This involves trying common passwords against many accounts to avoid lockouts, but it doesn't leverage the obtained hash.
B. Golden ticket: This attack requires the hash of the KRBTGT account, not a service account.
C. Cache poisoning: Typically targets DNS or ARP caches, unrelated to the scenario of having a service account hash.
But Kerberoasting is a post-exploitation attack used in Microsoft Active Directory environments to obtain password hashes for service accounts. The question states the pen tester already obtained the has of the service account. So by your own explanation for kerberoasting and how the account's plaintext password can be recovered, I would think that using that password and password spraying to see what other account can be exploited/breached without being detected. This is a pen test exam so this is where my head goes and why I'd think the answer would be A. Would love others thoughts on this as these options are somewhat flawed here and feel these exams test to see how well you can read and interpret their questions lol.
upvoted 2 times
...
...
This section is not available anymore. Please use the main Exam Page.PT0-002 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Ric350
1 month, 2 weeks agoRic350
1 month, 2 weeks agostudy_study
3 weeks, 1 day agoSnagggggin
2 months, 3 weeks agoRic350
1 month, 2 weeks ago