During an assessment, a penetration tester runs the following command from a Linux machine: GetUsersSPNs.py -dc-ip 172.16.1.1 DOMAIN.LOCAL/aholliday -request Which of the following is the…

Question

Options

• ACrack the user password for aholliday
• BDownload all TGS tickets for offline processing
• CPerform a pass-the-hash attack using the hash for aholliday
• DPerform password spraying

• A
  5% (1)
• B
  86% (18)
• D
  10% (2)

Explanation

Kerberoasting with GetUserSPNs.py

Running GetUserSPNs.py with the -request flag is the classic Kerberoasting technique, which queries Active Directory for accounts with Service Principal Names (SPNs) and requests their Ticket Granting Service (TGS) tickets - downloading them for offline cracking. The tickets are encrypted with the service account's password hash, allowing an attacker to attempt cracking them locally without further interaction with the domain controller.

Why the distractors are wrong:

• A is incorrect because the command itself doesn't crack passwords - it only collects the encrypted tickets; cracking happens afterward with a separate tool like Hashcat or John the Ripper
• C is incorrect because pass-the-hash uses NTLM hashes to authenticate directly, which is an entirely different attack and tool set
• D is incorrect because password spraying involves attempting a single password against many accounts, not requesting service tickets

Memory Tip: Think of SPN = Service, Please Now - GetUserSPNs.py finds service accounts and requests their tickets (TGS) for you to take offline. The -request flag is the giveaway that you're downloading tickets, not cracking or spraying anything in real time.

No community discussion yet for this question.