Persisting Active Directory

Walkthrough summary

Persisting Active Directory TryHackMe walkthrough with 20 answered prompts and lab methodology notes.

Sample prompts covered

• What is the Mimikatz command to perform a DCSync for the username of test on the za.tryhackme.loc domain?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the NTLM hash associated with the krbtgt user?
  Open the walkthrough page to inspect the full answer and command flow.
• Which AD account's NTLM hash is used to sign Kerberos tickets?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of a ticket that impersonates a legitimate TGT?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of a ticket that impersonates a legitimate TGS?
  Open the walkthrough page to inspect the full answer and command flow.