Knowledge Hub

Persisting Active Directory

TryHackMe20 answered prompts

Persisting Active Directory TryHackMe walkthrough with 20 answered prompts.

Prompts and answers

  • What is the Mimikatz command to perform a DCSync for the username of test on the za.tryhackme.loc domain?
    lsadump::dcsync /domain:za.tryhackme.loc /user:test
  • What is the NTLM hash associated with the krbtgt user?
    16f9af38fca3ada405386b3b57366082
  • Which AD account's NTLM hash is used to sign Kerberos tickets?
    krbtgt
  • What is the name of a ticket that impersonates a legitimate TGT?
    Golden ticket
  • What is the name of a ticket that impersonates a legitimate TGS?
    Silver ticket
  • What is the default lifetime (in years) of a golden ticket generated by Mimikatz?
    10
  • What key is used to sign certificates to prove their authenticity?
    private key
  • What application can we use to forge a certificate if we have the CA certificate and private key?
    ForgeCert.exe
  • What is the Mimikatz command to pass a ticket from a file with the name of ticket.kirbi?
    kerberos::ptt ticket.kirbi
  • What AD object attribute is normally used to specify SIDs from the object's previous domain to allow seamless migration to a new domain?
    SIDHistory
  • What is the database file on the domain controller that stores all AD information?
    ntds.dit
  • What is the PowerShell command to restart the ntds service after we injected our SID history values?
    Start-Service -Name ntds
  • What is the term used to describe AD groups that are members of other AD groups?
    Group Nesting
  • What is the command to add a new member, thmtest, to the AD group, thmgroup?
    Add-ADGroupMember -Identity "thmgroup" -Members "thmtest"
  • What AD group's ACLs are used as a template for the ACLs of all Protected Groups?
    AdminSDHolder
  • What AD service updates the ACLs of all Protected Groups to match that of the template?
    SDProp
  • What ACL permission allows the user to perform any action on the AD object?
    Full Control
  • What MMC snap-in can be used to manage GPOs?
    Group Policy Management
  • What sub-GPO is used to grant users and groups access to local groups on the hosts that the GPO applies to?
    Restricted Groups
  • What tab is used to modify the security permissions that users and groups have on the GPO?
    Delegation