Active › Module 1 › Lesson 2
Lab AD Only
Practice only on YOUR intentional lab AD — GOAD, home lab, or joined AD range inside $LAB_AD with snapshots and written scope.
Visual · t25_lab_ad_only
Lab AD hygiene. $LAB_AD only. Original Cyberlium.
Opening
A lab forest you own or enrolled in is the safest teacher — you chose the scope, you control the VM.
Lab AD means a forest deployed for learning: GOAD on isolated VLAN, Hyper-V AD lab, or HTB/Proving Grounds AD room with explicit enrollment. Store domain name, DC IP, snapshot name, and scope letter in $LAB_AD notes. Run enum and auth-abuse literacy only inside that boundary — never against employer production or internet-facing strangers. Cyberlium treats lab AD as the foundation before reading public AD breach writeups. You will NOT point BloodHound collectors at neighbor networks. Next: No Stranger Domain.
1. Lab AD requirements
Document forest FQDN, domain SID placeholder, DC hostname, lab VLAN, snapshot date, and enrollment proof (GOAD readme, course letter, HTB room name). One scope file per lab under $LAB_AD with chmod 600.
Rebuild or revert snapshots before destructive tests. Log tool versions used for reproducibility — still no weaponized output against out-of-scope hosts.
Command guide
Try these commands — Lab AD requirements
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GOAD project — https://github.com/Orange-Cyberdefense/GOAD (intentional AD lab literacy) TryHackMe AD paths — https://tryhackme.com/ (assigned AD rooms you join only) Microsoft AD lab — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dmc/active-directory-domain-services (build YOUR lab)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t25-ad/notes" "$HOME/cyberlium-lab/t25-ad/evidence"
cat > "$HOME/cyberlium-lab/t25-ad/lab.env" <<'EOF'
export LAB_AD=$HOME/cyberlium-lab/t25-ad
export LAB_AD_HOST=${LAB_AD_HOST:-127.0.0.1}
export LAB_AD_DOMAIN=${LAB_AD_DOMAIN:-lab.local}
EOFCommand — copy this
chmod 600 "$HOME/cyberlium-lab/t25-ad/lab.env" grep -E 'LAB_AD|LAB_AD_HOST' "$HOME/cyberlium-lab/t25-ad/lab.env" curl -sS https://github.com/Orange-Cyberdefense/GOAD | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: GOAD project (https://github.com/Orange-Cyberdefense/GOAD); TryHackMe AD paths (https://tryhackme.com/); Microsoft AD lab (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dmc/active-directory-domain-services). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. VM boundary and network isolation
Daily driver holds notes — not LDAP binds to production DCs. Enum, Kerberos observation, and purple notes happen inside $LAB_AD VM or isolated segment with egress blocked to corporate/campus ranges.
If lab AD shares a host, use dedicated NIC/VLAN or host-only networking so stray queries cannot leave the sandbox.
3. Intake you must refuse
Unknown domain credentials from leaks, 'just try Kerberoast on contoso.com' forum posts, or DC IPs from Shodan without authorization. If you did not deploy it or receive explicit course scope for $LAB_AD, do not touch it.
Ship: lab AD inventory — forest name, DC IP, snapshot rule, scope source. Next: No Stranger Domain.
4. What you ship: lab AD inventory for $LAB_AD
Inventory: forest FQDN, DC IP, snapshot name, scope source. $LAB_AD VM only. NEVER production AD. chmod 600.
5. What you record before the next lesson
Date. Lab AD inventory. $LAB_AD named. File t25-m01-l02-lab-ad-only.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Point enum tools at employer DC without written scope. Use leaked creds on a stranger forest.
Right
Write lab AD inventory for $LAB_AD. Next: No Stranger Domain.
Mission: inventory YOUR lab AD
1) List forest FQDN and DC IP for YOUR lab. 2) Name VM snapshot rule before first enum. 3) Cite scope source (GOAD, course, range). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
A labeled GOAD snapshot beats guessing whether a query left your sandbox.
Knowledge Check
APPLY: Lab AD on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: AD literacy exercises belong inside $LAB_AD with network isolation.
True or False
Knowledge Check
APPLY: Best first AD literacy target is often:
Multiple choice