PROJECT / 003 · LAB ENGINEERING
Active Directory Attack LabBuild the environment. Understand the attack paths.
A custom, isolated Active Directory environment designed to explore credential exposure, authentication weaknesses, and domain-compromise paths.
DOMAIN CONTROLLER RA01 Active Directory Domain Services
USER WORKSTATIONHorus01
USER WORKSTATIONOsiris01
4 DOMAIN USERS
Environment
The lab contains RA01 as the domain controller, Horus01 and Osiris01 as user workstations, and four domain users. The environment was built and compromised to test several independent techniques and paths.
Techniques demonstrated
- Credential recovery from Windows Credential Manager.
- LNK abuse.
- Kerberoasting.
- LLMNR poisoning.
- NTLM relay.
Learning outcomes
The project explores how endpoint configuration, name resolution, authentication protocols, and credential handling can combine into domain-level attack paths. The public portfolio describes the lab at a high level; sensitive credentials and reusable attack artefacts are not published.