In which of the following scenarios would a tester perform a Kerberoasting attack?
A) The tester has compromised a Windows device and dumps the LSA secrets.
B) The tester needs to retrieve the SAM database and crack the password hashes.
C) The tester has compromised a limited-privilege user and needs to target other accounts for lateral movement.
D) The tester has compromised an account and needs to dump hashes and plaintext passwords from the system.

Question

Quizplus · Accepted Answer

A Kerberoasting attack is performed when a tester has compromised a limited-privilege user account and aims to extract service account tickets from the Kerberos ticket-granting service for offline password cracking, facilitating lateral movement.

In Which of the Following Scenarios Would a Tester Perform