labs
03 — AD beginner labs
One primary objective per box. Write it before you spawn.
| Order | Machine | Diff | Primary objective |
|---|---|---|---|
| 1 | Dancing (Starting Point) | Very Easy | SMB comfort before domain games |
| 2 | Active | Easy | GPP / service-account style creds in a domain |
| 3 | Sauna | Easy | User discovery → AS-REP / identity → privilege |
| 4 | Forest | Easy | AS-REP + permissions path (optional third) |
| Stretch | Support | Easy | Only if 2–4 felt easy |
Prep
- Academy Introduction to Active Directory (vocab)
- VPN + note template: users found / interesting groups / what got DA
Defer
Full Academy AD Enum & Attacks dump in one sitting; ADCS; Hard multi-domain chains; running every Impacket script “to see what happens.”
Success
For each box: foothold → domain context → one abuse that matched the objective → cleanup notes (what would defenders see?).