Practice — compromise an Active Directory lab environment — Offensive Security & Penetration Testing

What You'll Build

In this exercise you will work through a realistic attack chain against an authorized Active Directory lab, from an initial foothold to demonstrated domain-level impact, then document every step with its remediation. You will enumerate the domain, identify a weakly protected service account, use recovered credentials, move laterally, and reach elevated access, producing the exact deliverable an internal AD assessment yields: a clear chain of findings, each paired with the specific hardening that would have stopped it.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

A signed authorization and scope for the AD lab, from Lesson 1, rehearsing the discipline of confirming permission before any active step.
Recon and enumeration skills from Module 1 and Module 2 to establish and understand the initial foothold.
Conceptual grasp of Kerberoasting and pass-the-hash, from Lesson 16, including their dependencies and defenses.
Understanding of lateral movement and pivoting, from Lesson 17, and how segmentation and credential hygiene contain them.
Password-cracking fundamentals from Lesson 11, and the discipline of handling any recovered credentials as sensitive, scope-bound data.

Setup & Project Structure

Run everything inside an isolated Active Directory lab you are explicitly authorized to attack, never against a real domain, since AD compromise can affect an entire organization. Create a working directory to capture each phase's evidence, because in a real assessment the documented chain is the product. Dated, named files make your attack path reproducible and let a defender follow exactly how a foothold became domain-level impact, and precisely where each step could have been stopped.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Isolated, authorized AD lab only. Set up a documented workspace.
mkdir ad-engagement && cd ad-engagement
mkdir enum foothold escalate evidence

# Record scope up front as your reference of record.
cat > scope.txt <<'EOF'
AUTHORIZED AD LAB
  domain:  lab.corp.internal (isolated)
  foothold: 10.10.20.10 (low-priv user provided)
  rule:    this lab domain only; nothing outside the isolated network
EOF
cat scope.txt

Step 1 — Enumerate the Domain

From your provided low-privileged foothold, enumerate the domain to understand its structure: users, groups, and especially service accounts and privileged access. The goal is the same situational awareness a real assessment builds, identifying where weak configuration might exist before acting. Focus early on the two dependencies from Lesson 16: service accounts with weak passwords, and over-exposed privileged credentials. Save all enumeration output as evidence for the chain you will document.

Analogy🏏Cricket

🎬 Think of it like movies: Enumerating the domain is like the opening act of a heist film, before anyone moves, the crew studies the whole building's layout, staff, and routines to find the one weak point worth targeting. Just as the crew maps every guard and door before choosing an entry, you map users, groups, and especially service accounts and privileged access before acting. Just as the film lingers on the nervous inside contact rather than the vault's thick walls, you focus early on weakly configured service accounts and over-exposed credentials. This reveals why thorough reconnaissance, saved as evidence, must precede any escalation.

bash

# Enumerate the domain from the low-priv foothold (authorized lab).

# Map users, groups, and especially SERVICE ACCOUNTS + privileged access.
#   -> identify accounts with service principal names (Kerberoast targets)
#   -> note where privileged accounts appear reachable

# Conceptual enumeration (tools like BloodHound map these relationships):
#   collect domain data -> visualize paths to high privilege
#   record: which service accounts look weakly protected?

# Save findings to enum/ for the documented chain.

Step 2 — Target a Weak Service Account

Identify a service account whose configuration suggests a weak password, then request its service ticket and attempt to crack it offline, exactly the Kerberoasting dependency from Lesson 16. Success here depends entirely on that password being weak, which is the point you will report. Handle any recovered credential as highly sensitive, scope-bound data. Capture evidence that a weak service-account password enabled this step, since that weakness, not the technique, is the finding that matters.

Analogy🏏Cricket

⚽ Think of it like sports: This step is like targeting the opposition's one weak defender identified in your scouting, you direct the play at them precisely because that is where the structure gives way. Just as the goal comes from their positioning flaw rather than any brilliance of yours, the crack succeeds because the service-account password is weak, not because the request was clever. Just as the coach's report names the defensive lapse to be fixed, your evidence names the weak password as the finding that matters. This reveals that the reportable weakness is the configuration, not the technique that exploited it.

bash

# Kerberoasting depends on a WEAK service-account password.

# Request the service ticket for a targeted service account, then
# attempt to crack it OFFLINE (see Lesson 11 for cracking discipline):
#   john --wordlist=rockyou.txt --rules <captured_ticket_hash>

# If it cracks -> the FINDING is "weak service-account password", not the
# technique. If it resists -> that account was configured correctly.
# Treat any recovered credential as sensitive, scope-bound evidence.

Step 3 — Move Laterally & Escalate

Use the recovered credentials to authenticate to systems that account can reach, applying the lateral-movement thinking from Lesson 17. Map the blast radius: how far does this credential reach, and where does segmentation or credential hygiene stop it? Follow the reachable path toward more privileged access, capturing evidence at each hop. Prefer demonstrating potential spread over recklessly executing it, and note every point where a well-placed control does, or fails to, contain the movement.

Analogy🏏Cricket

💪 Think of it like fitness: Moving laterally is like testing how far strain travels from one overworked muscle through the whole kinetic chain, you trace where the weakness transfers load and where good structure finally absorbs it. Just as you note which strong joint stops the strain from cascading further, you note where segmentation or unique credentials stop the credential from reaching further. Just as a careful athlete probes range of movement deliberately rather than forcing it to injury, you demonstrate potential spread rather than recklessly executing it. This reveals that mapping the blast radius, and its limits, is the point of this step.

bash

# Use recovered creds to move laterally; MAP the blast radius.

# Authenticate to reachable systems with the recovered credential:
#   -> which hosts does this account reach? (Lesson 17 blast-radius map)
#   -> follow the reachable path toward higher privilege

# At each hop record:
#   - what the credential unlocked (credential reuse / over-privilege?)
#   - where segmentation or unique creds STOPPED the spread (a working control)

# Prefer demonstrating potential spread over reckless execution.

Step 4 — Document the Chain & Remediate

Finish by turning your captured evidence into a single remediable narrative. For each link, foothold, Kerberoasted service account, lateral movement, escalation, record the dependency it exploited and the specific hardening that would have broken the chain: managed service-account passwords, tiered administration, segmentation, credential hygiene. Confirm the write-up shows a defender both how the compromise unfolded and exactly where to intervene. This documented, fixable chain, not merely reaching domain admin, is the true product of the exercise.

Analogy🏏Cricket

📷 Think of it like photography: Documenting the chain is like assembling a photo-essay from your shoot, each image ordered so a viewer follows the whole story and understands exactly what each frame shows. Just as a strong essay pairs every photograph with a caption that gives it meaning, your write-up pairs every link, foothold, Kerberoasting, lateral movement, escalation, with the specific hardening that would have broken it. Just as the finished essay lets any viewer grasp the narrative without having been present, your documented chain lets a defender see how the compromise unfolded and exactly where to intervene. This reveals that the fixable narrative, not reaching domain admin, is the true product.

bash

# Consolidate the attack chain into ONE remediable narrative.
cat > evidence/chain.md <<'EOF'
# AD Engagement Chain — lab.corp.internal (authorized lab)

1. Foothold: low-priv user on 10.10.20.10
   Fix: least privilege; monitor auth anomalies

2. Kerberoasting: cracked WEAK service-account password
   Fix: gMSA (strong, auto-rotated); audit/minimize SPNs

3. Lateral movement: recovered cred reused across hosts
   Fix: unique per-host creds (LAPS); least privilege

4. Escalation: reached elevated access via exposed privileged cred
   Fix: tiered administration; reduce credential exposure

Each break in this chain would have stopped the compromise.
EOF
cat evidence/chain.md

Warning: Everything here is confined to your authorized, isolated AD lab. Running these techniques against any domain you do not own or lack written permission to test is unauthorized access and can be a crime, and AD compromise can affect an entire organization. Recovered tickets and credentials are highly sensitive; handle them strictly under the rules of engagement, retain the minimum necessary, and never carry lab techniques onto real domains without a signed engagement behind them.

Extension Challenge: Deepen the assessment three ways. First, for each chain link, note what a defender's authentication logs would have shown, practising the detection awareness Module 5 formalizes. Second, using your blast-radius map, propose a specific segmentation change and show which chain link it would have severed. Third, draft a one-paragraph executive summary translating the technical chain into domain-wide business risk for a non-technical reader.

A full AD assessment runs a realistic chain, enumerate, exploit a weak service account, move laterally, escalate, and documents each link with its remediation.
Everything stays inside an authorized, isolated lab, since AD compromise can affect an entire organization and the tooling is only lawful with signed authorization.
Enumeration builds situational awareness first, focusing on the two dependencies: weakly protected service accounts and over-exposed privileged credentials.
Kerberoasting succeeds only against a weak service-account password, so the finding to report is that weakness, not the technique itself.
Lateral movement maps a credential's blast radius, revealing where credential reuse enables spread and where segmentation or unique credentials contain it.
The true deliverable is a documented, fixable chain where each link is paired with the specific hardening, managed passwords, tiered admin, segmentation, that would break it.