In which of the following scenarios would a tester perform a Kerberoasting attack?

Question

Options

• AThe tester has compromised a Windows device and dumps the LSA secrets.
• BThe tester needs to retrieve the SAM database and crack the password hashes.
• CThe tester has compromised a limited-privilege user and needs to target other accounts for lateral
• DThe tester has compromised an account and needs to dump hashes and plaintext passwords

• A
  13% (4)
• B
  3% (1)
• C
  7% (2)
• D
  77% (23)

Explanation

Kerberoasting is a technique that relies on requesting service tickets for service account service principal names (SPNs). The tickets are encrypted with the password of the service account associated with the SPN, meaning that once a tester has obtained the service tickets by using a tool like Mimikatz, the tester can crack the tickets to obtain the service account password using offline cracking tools. Kerberoasting is a four-step process: Scan Active Directory for user accounts with service principal names (SPNs) set. Request service tickets using the SPNs. Extract the service tickets from memory and save to a file. Conduct an offline brute-force attack against the passwords in the service tickets

No community discussion yet for this question.