Active Directory Attack Lab
A guided walkthrough of BloodHound-style graph recon, Kerberoasting a weak service account, and forging a Golden Ticket.
A guided walk through the Active Directory attack chain that shows up in most enterprise compromises: map the graph, find the path, Kerberoast a weak service account, and forge a Golden Ticket.
How to use it
- Run graph-style recon and read the relationships.
- Find the path from your foothold to Domain Admin.
- Kerberoast a weak service account and crack it offline.
- Forge a Golden Ticket and understand what it grants.
What to take away
AD is a graph, and attackers read it as one
BloodHound made this mainstream: permissions that look harmless individually chain into a path to Domain Admin that nobody designed.
The krbtgt hash is the domain
It signs every ticket. Anyone holding it can mint credentials for any user, which is why recovery requires resetting it twice.
Frequently asked questions
What is a Golden Ticket?
A Kerberos ticket-granting ticket forged with the krbtgt account hash. It grants access as any user to any service and survives password resets, which is why it is the definition of full domain compromise.
How is Kerberoasting detected?
Watch for unusual volumes of service ticket requests, especially with weak encryption types. Managed service accounts with long random passwords remove the payoff entirely.
Where this fits in the course
This security lab pairs with Path 16 — Advanced — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Kerberoasting Simulator — Request a service ticket for a weak-password service account, then crack the offline-crackable hash it hands you.
- Windows Privesc Playground — A misconfigured service runs as SYSTEM with a writable binary path. Replace it and escalate — no exploit needed.
- Password Cracking Lab — Four hashed passwords, one wordlist. See exactly which ones fall to a dictionary attack and which survive it — and why.
- Log Analysis / IR Lab — A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.