Active Directory Enumeration & Attacks
Question
Section Answer
Number
External Recon and
Question 1 HTB{5Fz6UPNUFFzqjdg0AzXyxCjMZ}
Enumeration Principles
Initial Enumeration of the ACADEMY-EA-
Question 1
Domain DC01.INLANEFREIGHT.LOCAL
85
Initial Enumeration of the
Question 2 172.16.5.130
Domain
LLMNR/NBT-NS Poisoning -
75
Question 1 backupagent
from Linux
LLMNR/NBT-NS Poisoning -
Question 2 h1backup55
from Linux
LLMNR/NBT-NS Poisoning -
m#
Question 3 transporter@4
from Linux
LLMNR/NBT-NS Poisoning -
Question 1 security#1
to
from Windows
Enumerating & Retrieving
Question 1 7
Password Policies
ch
Enumerating & Retrieving
Question 2 8
Password Policies
Password Spraying - Making a
Question 1 56
Target User List
te
Internal Password Spraying -
Question 1 sgage
from Linux
Internal Password Spraying -
Question 1 dbranch
from Windows
Credentialed Enumeration -
Question 1 mmorgan
from Linux
Credentialed Enumeration -
Question 2 10
from Linux
Credentialed Enumeration -
Question 1 13
from Windows
Credentialed Enumeration -
Question 2 Test-AdminAccess
from Windows
Trusted Exam Report Seller & Exam Service Provider
techtom#7585
, Question
Section Answer
Number
Credentialed Enumeration -
Question 3 sa
from Windows
Credentialed Enumeration -
Question 4 ILFREIGHTDB01!
from Windows
Living Off the Land Question 1 4.18.2109.6
Living Off the Land Question 2 adunn
85
Living Off the Land Question 3 HTB{LD@P_I$_W1ld}
Kerberoasting - from Linux Question 1 !SapperFi2
75
Kerberoasting - from Linux Question 2 Account Operators
Kerberoasting - from Windows Question 1 svc_vmwaresso
Kerberoasting - from Windows Question 2
m# Virtual01
Access Control List (ACL)
Question 1 DACL
Abuse Primer
Access Control List (ACL)
Question 2 GenericAll
to
Abuse Primer
00299570-246d-11d0-a768-
ACL Enumeration Question 1
00aa006e0529
ch
ACL Enumeration Question 2 ResolveGUIDs
ACL Enumeration Question 3 GenericWrite
ACL Enumeration Question 4 GenericAll
te
ACL Enumeration Question 5 Self-Membership
ACL Abuse Tactics Question 1 SyncMaster757
DCSync Question 1 syncron
DCSync Question 2 Mycleart3xtP@ss!
DCSync Question 3 4bb3b317845f0954200a6b0acc9b9f9a
Privileged Access Question 1 bdavis
Privileged Access Question 2 ACADEMY-EA-DC01
Privileged Access Question 3 1m_the_sQl_@dm1n_n0w!
Bleeding Edge Vulnerabilities Question 1 2021-42278&2021-42287
Bleeding Edge Vulnerabilities Question 2 D0ntSl@ckonN0P@c!
Trusted Exam Report Seller & Exam Service Provider
techtom#7585
, Question
Section Answer
Number
Miscellaneous
Question 1 ygroce
Misconfigurations
Miscellaneous
Question 2 Pass@word
Misconfigurations
Domain Trusts Primer Question 1 LOGISTICS.INLANEFREIGHT.LOCAL
Domain Trusts Primer Question 2 FREIGHTLOGISTICS.LOCAL
85
Domain Trusts Primer Question 3 BiDirectional
Attacking Domain Trusts -
S-1-5-21-2806153819-209893948-
Child -> Parent Trusts - from Question 1
75
922872689
Windows
Attacking Domain Trusts -
S-1-5-21-3842939050-3880317879-
Child -> Parent Trusts - from Question 2
m# 2865463114-519
Windows
Attacking Domain Trusts -
Child -> Parent Trusts - from Question 3 f@ll1ng_l1k3_d0m1no3$
Windows
to
Attacking Domain Trusts -
Child -> Parent Trusts - from Question 1 49a074a39dd0651f647e765c2cc794c7
Linux
ch
Attacking Domain Trusts -
Cross-Forest Trust Abuse - Question 1 1logistics
from Windows
Attacking Domain Trusts -
te
Cross-Forest Trust Abuse - Question 1 sapsso
from Linux
Attacking Domain Trusts -
Cross-Forest Trust Abuse - Question 2 pabloPICASSO
from Linux
Attacking Domain Trusts -
Cross-Forest Trust Abuse - Question 3 burn1ng_d0wn_th3_f0rest!
from Linux
Additional AD Auditing
Question 1 COMPLETE
Techniques
AD Enumeration & Attacks -
Question 1 JusT_g3tt1ng_st@rt3d!
Skills Assessment Part I
AD Enumeration & Attacks -
Question 2 svc_sql
Skills Assessment Part I
Trusted Exam Report Seller & Exam Service Provider
techtom#7585
Question
Section Answer
Number
External Recon and
Question 1 HTB{5Fz6UPNUFFzqjdg0AzXyxCjMZ}
Enumeration Principles
Initial Enumeration of the ACADEMY-EA-
Question 1
Domain DC01.INLANEFREIGHT.LOCAL
85
Initial Enumeration of the
Question 2 172.16.5.130
Domain
LLMNR/NBT-NS Poisoning -
75
Question 1 backupagent
from Linux
LLMNR/NBT-NS Poisoning -
Question 2 h1backup55
from Linux
LLMNR/NBT-NS Poisoning -
m#
Question 3 transporter@4
from Linux
LLMNR/NBT-NS Poisoning -
Question 1 security#1
to
from Windows
Enumerating & Retrieving
Question 1 7
Password Policies
ch
Enumerating & Retrieving
Question 2 8
Password Policies
Password Spraying - Making a
Question 1 56
Target User List
te
Internal Password Spraying -
Question 1 sgage
from Linux
Internal Password Spraying -
Question 1 dbranch
from Windows
Credentialed Enumeration -
Question 1 mmorgan
from Linux
Credentialed Enumeration -
Question 2 10
from Linux
Credentialed Enumeration -
Question 1 13
from Windows
Credentialed Enumeration -
Question 2 Test-AdminAccess
from Windows
Trusted Exam Report Seller & Exam Service Provider
techtom#7585
, Question
Section Answer
Number
Credentialed Enumeration -
Question 3 sa
from Windows
Credentialed Enumeration -
Question 4 ILFREIGHTDB01!
from Windows
Living Off the Land Question 1 4.18.2109.6
Living Off the Land Question 2 adunn
85
Living Off the Land Question 3 HTB{LD@P_I$_W1ld}
Kerberoasting - from Linux Question 1 !SapperFi2
75
Kerberoasting - from Linux Question 2 Account Operators
Kerberoasting - from Windows Question 1 svc_vmwaresso
Kerberoasting - from Windows Question 2
m# Virtual01
Access Control List (ACL)
Question 1 DACL
Abuse Primer
Access Control List (ACL)
Question 2 GenericAll
to
Abuse Primer
00299570-246d-11d0-a768-
ACL Enumeration Question 1
00aa006e0529
ch
ACL Enumeration Question 2 ResolveGUIDs
ACL Enumeration Question 3 GenericWrite
ACL Enumeration Question 4 GenericAll
te
ACL Enumeration Question 5 Self-Membership
ACL Abuse Tactics Question 1 SyncMaster757
DCSync Question 1 syncron
DCSync Question 2 Mycleart3xtP@ss!
DCSync Question 3 4bb3b317845f0954200a6b0acc9b9f9a
Privileged Access Question 1 bdavis
Privileged Access Question 2 ACADEMY-EA-DC01
Privileged Access Question 3 1m_the_sQl_@dm1n_n0w!
Bleeding Edge Vulnerabilities Question 1 2021-42278&2021-42287
Bleeding Edge Vulnerabilities Question 2 D0ntSl@ckonN0P@c!
Trusted Exam Report Seller & Exam Service Provider
techtom#7585
, Question
Section Answer
Number
Miscellaneous
Question 1 ygroce
Misconfigurations
Miscellaneous
Question 2 Pass@word
Misconfigurations
Domain Trusts Primer Question 1 LOGISTICS.INLANEFREIGHT.LOCAL
Domain Trusts Primer Question 2 FREIGHTLOGISTICS.LOCAL
85
Domain Trusts Primer Question 3 BiDirectional
Attacking Domain Trusts -
S-1-5-21-2806153819-209893948-
Child -> Parent Trusts - from Question 1
75
922872689
Windows
Attacking Domain Trusts -
S-1-5-21-3842939050-3880317879-
Child -> Parent Trusts - from Question 2
m# 2865463114-519
Windows
Attacking Domain Trusts -
Child -> Parent Trusts - from Question 3 f@ll1ng_l1k3_d0m1no3$
Windows
to
Attacking Domain Trusts -
Child -> Parent Trusts - from Question 1 49a074a39dd0651f647e765c2cc794c7
Linux
ch
Attacking Domain Trusts -
Cross-Forest Trust Abuse - Question 1 1logistics
from Windows
Attacking Domain Trusts -
te
Cross-Forest Trust Abuse - Question 1 sapsso
from Linux
Attacking Domain Trusts -
Cross-Forest Trust Abuse - Question 2 pabloPICASSO
from Linux
Attacking Domain Trusts -
Cross-Forest Trust Abuse - Question 3 burn1ng_d0wn_th3_f0rest!
from Linux
Additional AD Auditing
Question 1 COMPLETE
Techniques
AD Enumeration & Attacks -
Question 1 JusT_g3tt1ng_st@rt3d!
Skills Assessment Part I
AD Enumeration & Attacks -
Question 2 svc_sql
Skills Assessment Part I
Trusted Exam Report Seller & Exam Service Provider
techtom#7585
