Question

During an internal engagement, a penetration tester queries Active Directory and discovers several user accounts that have the 'Do not require Kerberos preauthentication' flag set. The tester wants to leverage this misconfiguration to obtain crackable credential material without needing any valid domain account authentication first. Which attack technique should the tester use?

Accepted Answer

AS-REP Roasting to request encrypted AS-REP responses and crack them offline

Answer

Kerberoasting to request TGS tickets for service accounts with SPNs

Answer

Golden Ticket forgery using the KRBTGT hash to impersonate any user

Answer

Pass-the-Hash using captured NTLM hashes to authenticate laterally