After Obtaining a Service Account Hash, Which Attack Next?
A penetration tester obtains the hash of a service account within a customer’s Active Directory. Which of the following attacks should the penetration tester attempt next?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The key is recognizing that Kerberoasting is the technique to acquire the hash; once the hash is in hand, the tester should move on to using or cracking it—making password spraying the best available choice.
This PT0-002 question tests post-exploitation attacks in Active Directory. The community majority selects password spraying after a service account hash is already obtained, while a minority mistakenly choose Kerberoasting.
The most common wrong answer is Kerberoasting (D), because test-takers associate service account hashes with that attack. However, Kerberoasting is the method used to obtain the hash—not an attack to perform after the hash is already in hand.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Password spraying (A) is the best choice among the options after an attacker has already obtained a service account hash. Once a hash is captured, the typical next step is to crack it offline to recover the plaintext password, then reuse that password across other accounts via password spraying. Since 'crack the hash' is not listed, password spraying is the only option that represents a subsequent credential-based exploitation step. Additionally, none of the other options are valid next steps: golden ticket requires the KRBTGT hash, cache poisoning is a DNS attack, and Kerberoasting is how the hash was originally obtained.Why the Other Options Are Wrong
Golden ticket (B) is incorrect because forging a golden ticket requires the hash of the KRBTGT account, not a service account hash. Cache poisoning (C) is unrelated to Active Directory credentials and typically targets DNS servers. Kerberoasting (D) is the attack used to request service tickets and extract service account hashes—if the hash is already obtained, Kerberoasting is no longer needed. The community comments highlight this confusion: one commenter notes that Kerberoasting is used to obtain hashes, so it does not make sense as the next step once the hash is already in hand.Community Comment Notes
Comment [1] correctly points out that Kerberoasting is a post-exploitation attack to obtain hashes, and since the tester already has the hash, performing Kerberoasting again is unnecessary. Comment [2] acknowledges that the ideal next step would be pass-the-hash, but since that is not an option, password spraying is the closest fit among the choices. Comment [3] argues for Kerberoasting, but that reflects a common misunderstanding of the attack chain—Kerberoasting ends with the hash, and the next phase is cracking or spraying. The vote distribution (75% A vs. 25% D) shows that most test-takers recognize the distinction.Official Reference
Exam Strategy
On exam day, focus on the exact wording: if the question says a hash has already been obtained, cross off Kerberoasting. The next step is typically to crack the hash or use it in a pass-the-hash attack; when those aren't listed, choose the only remaining attack that supports credential exploitation—password spraying.