01 — AD intermediate map

Learning objectives

• Run a targeted domain enum (users/groups/SPNs/ACLs of interest) without spraying every Impacket module
• Explain and execute one Kerberos attack class per lab (AS-REP, Kerberoast, or constrained/unconstrained as encountered)
• Use BloodHound/SharpHound as a path finder, not a substitute for understanding the edge
• Stop before “win DA by any means” — write the path that matched the objective

Intuition

Beginner found an identity. Intermediate maps who can become whom and abuses Kerberos where the graph points.

Intermediate path

1. Revisit vocab from beginner map
2. AI5 — Phases that match your lab; skip tool spam
3. AI6 — Kerberos section for the roast/ticket class you need
4. Labs — one primary Kerberos or permission objective each
5. Optional: peek tradecraft AD notes only for the technique you used

Park for later (operator)