AD domains, forests, GPOs, Kerberos tickets, NTLM, Pass-the-Hash, Kerberoasting, BitLocker and Windows event logs.
39 cards · basic cards · AI-written, checked twice. Edit anything.
- In Active Directory, what is a domain?
Show answer
A security boundary containing users, computers, and groups that share a common directory database.- What is an Active Directory forest?
Show answer
A collection of one or more domains that share a common schema, configuration, and global catalog.- In Active Directory, what is a tree?
Show answer
One or more domains sharing a contiguous namespace, connected through a two-way transitive trust.- What is an organizational unit (OU)?
Show answer
A container in Active Directory used to organize and delegate administration of users, computers, and groups.- What type of trust relationship connects two separate forests?
Show answer
A forest trust, which is a two-way transitive trust between the root domains of two forests.- In Kerberos, what is a TGT?
Show answer
A Ticket Granting Ticket, issued by the KDC after initial user authentication, used to request service tickets.- What is a Kerberos service ticket?
Show answer
A ticket issued by the Ticket Granting Service that proves a user's identity and grants access to a specific resource.- What is the role of a KDC in Kerberos?
Show answer
The Key Distribution Center authenticates users and issues tickets, consisting of the Authentication Service and Ticket Granting Service.- Name the three phases of Kerberos authentication.
Show answer
Authentication Service (AS) request, Ticket Granting Service (TGS) request, and Application Service (AP) request.- What key encrypts a Kerberos TGT?
Show answer
The user's password hash, derived from their password.- What is the default lifetime of a Kerberos TGT?
Show answer
10 hours, though this is configurable by administrators.- What is NTLM?
Show answer
NT LAN Manager, a legacy Windows authentication protocol that uses challenge-response authentication.- How does the NTLM challenge-response process work?
Show answer
The server sends a random challenge to the client, the client encrypts it with their password hash, and the server verifies the response.- What hash algorithm does NTLM use?
Show answer
MD4 hash of the user's password, stored as the NTHash.- Name one vulnerability of NTLM.
Show answer
Susceptible to relay attacks where an attacker relays authentication to another service without needing to crack the password.
FlashKeepers