labs
04 — Windows intermediate labs
Host focus (ANG + agentctl). Not full AD forests yet.
Tier A — Easy depth
| Order | Machine | Focus |
|---|---|---|
| 1 | Bastion | Backups / VHD / offline cred recovery |
| 2 | Access | FTP/DB/email artifacts → saved creds / runas |
| 3 | ServMon or Remote | Service→service cred chains (NVMS/NSClient++ or NFS/Umbraco/TeamViewer) |
| 4 | Heist / Return | Host enum depth or printer/LDAP-adjacent hybrid |
Tier B — Intermediate capstone
| Order | Machine | Diff | Primary objective |
|---|---|---|---|
| 5 | Buff | Easy–stretch | Loopback service + port forward/chisel on one host (bridge to F5-I) |
| 6 | Jeeves | Medium | Jenkins → KeePass/admin hash; optional ADS awareness |
Per-box checklist
- Foothold → local admin in ≤3 sentences
- Cred source named (file / SAM / LSASS / saved / other)
- Persistence or clear “why not persist yet” note
- Domain next? yes/no
Defer
Responder→relay as first intermediate Windows lesson; ADCS; multi-host DA (AD-I).