A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication…

Question

Options

• ACarry out a passive wire sniffing operation using Internet packet sniffers
• BExtract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz
• CPerform a PRobability INfinite Chained Elements (PRINCE) attack
• DRequest a service ticket for the service principal name of the target service account

• A
  10% (3)
• B
  3% (1)
• C
  3% (1)
• D
  83% (24)

Explanation

Kerberoasting Attack Explanation

Why D is correct: In a Kerberoasting attack, once an attacker possesses a valid TGT, the logical next step is to request a Service Ticket (TGS) for the target service account's Service Principal Name (SPN). The service ticket is encrypted with the service account's password hash, which can then be extracted and subjected to offline brute-force or dictionary cracking to recover the plaintext password.

Why the distractors are wrong:

• A (Wire sniffing) is a passive network reconnaissance technique unrelated to Kerberoasting, which is an active, credential-based attack
• B (Mimikatz) is used for credential dumping from memory after gaining elevated access, and doesn't fit this specific stage of a Kerberoasting workflow
• C (PRINCE attack) is a password cracking methodology that would only be relevant after obtaining the encrypted ticket hash - it's a later step, not the immediate next one

Memory Tip: Think of Kerberoasting in three stages - "Have TGT → Get TGS → Crack it offline." The TGT is your entry ticket; the TGS is the prize containing the encrypted password. If you already have the TGT, your next move is always to request the service ticket (TGS).

No community discussion yet for this question.