Active › Module 4 › Lesson 4
Lab — Enum
Pack LDAP ports, BloodHound literacy, and enum hygiene — enum literacy file from $LAB_AD only.
Visual · t25_enum_lab
Lab: enum pack. $LAB_AD only. Original Cyberlium.
Opening
Enum pack ties ports to graph literacy — paperwork before auth abuse module.
Lessons 4-1–4-3 covered LDAP ports, BloodHound graph naming, and enum hygiene. This lab merges port map, graph card, and hygiene checklist with lab DC IP and scope reference. No unauthorized collector execution required — literacy paperwork acceptable. Next: Quiz — Enum Literacy.
1. Lab contract: enum pack
Create $HOME/cyberlium-lab/t25-m04-l04-enum-lab.txt merging port map, BloodHound card, hygiene checklist, and $LAB_AD DC IP.
Optional: if course requires scoped collector run, attach anonymized graph screenshot — still no stranger domains.
Command guide
Try these commands — Lab contract: enum pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
DNS for AD — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-integrated-dns-zones Nmap AD ports — scan LAB_AD_HOST per RoE BloodHound docs — https://bloodhound.readthedocs.io/ (read graph concepts — lab collector only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install dnsutils
macOS:
Command — copy this
brew install nmap brew install bind
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Built-in: nslookup (or install BIND for dig)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t25-ad/lab.env" 2>/dev/null || export LAB_AD_HOST=${LAB_AD_HOST:-127.0.0.1}
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
grep targets "$LAB_AD/roe.txt"
nmap -Pn -p 53,88,389,636,445,3389 "$LAB_AD_HOST" 2>/dev/null | head -15
dig +short @"$LAB_AD_HOST" ${LAB_AD_DOMAIN:-lab.local} ANY 2>/dev/null | head -10 || nslookup -type=any ${LAB_AD_DOMAIN:-lab.local} "$LAB_AD_HOST" 2>/dev/null | head -10 || echo 'Set LAB_AD_HOST to YOUR lab DNS'═══ WINDOWS ═══
YOUR lab DC IP only
Command — copy this
nslookup -type=srv _ldap._tcp.dc._msdcs.lab.local $env:LAB_AD_HOST
Primary tools to practice this lesson: nmap, dig. Reference sites: DNS for AD (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-integrated-dns-zones); Nmap AD ports; BloodHound docs (https://bloodhound.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for production FQDNs, mass scan commands, unredacted user lists — remove. Pack stays literacy and hygiene.
Confirm collector artifacts encrypted if present.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Auth Abuse Named.
Enum literacy feeds Kerberoast and AS-REP naming in M5.
4. What you ship: enum literacy pack for $LAB_AD
Merged ports, graph, hygiene sections. $LAB_AD named. NO stranger enum. chmod 600.
5. What you record before the next lesson
Date. Enum pack path. $LAB_AD named. File t25-m04-l04-enum-lab.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include LDAP dump from corporate AD. Skip hygiene checklist.
Right
Write YOUR enum pack for $LAB_AD. chmod 600. Next: Quiz — Enum Literacy.
Mission: freeze YOUR enum pack
1) Merge M4 literacy sections. 2) Confirm scope and DC IP match inventory. 3) Verify zero stranger FQDNs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Hygiene checklist travels with every future lab collector run.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Enum pack should reference $LAB_AD scope.
True or False
Knowledge Check
APPLY: BloodHound in enum pack is:
Multiple choice