map
01 — AD beginner map
Learning objectives
- Define: domain, DC, domain user vs local admin, SPN, SYSVOL/GPP idea
- Read an AD fingerprint from ports (88/389/445/5985) without attacking yet
- Finish one Easy box with one primary objective written down
Intuition
AD is a directory of who can do what. Beginners win by stealing or finding identities and permissions, not by memorizing every ESC/relay chain.
Vocab (must-have)
| Term | Friend meaning |
|---|---|
| DC | Server that answers for the domain (Kerberos/LDAP) |
| Domain user | Identity in AD — may not be local admin anywhere |
| SPN | “This service runs as this account” → Kerberoast idea |
| AS-REP roastable | User that does not need pre-auth — crackable ticket material |
| GPP/cpassword | Old Group Policy Preference passwords in SYSVOL |
| BloodHound (idea) | Graph of who can reach what — use screenshots/guidance first |
Park for later (operator attacks.md)
Kerberoast tooling deep dive, NTLM relay, ACL abuse chains, ADCS/ESC, full forest trust attacks — after Active + Sauna (and optionally Forest) feel clear.
Two AD trees
- This track — friend path under
windows/active-directory/beginner/ - Operator — attacks + optional tradecraft AD
Do not start friends in both at once.