Active › Module 6 › Lesson 4
Lab — Paths
Privilege path literacy lab on $LAB_AD — DCSync, ACL, delegation rows with defender fixes; no stranger-domain escalation.
Visual · t25_paths_lab
Lab: path literacy rows on YOUR $LAB_AD. Original Cyberlium.
Opening
Document three named paths in your lab forest — and the defender fix for each, not a domain admin trophy from the internet.
On YOUR $LAB_AD per RoE: (1) topology proof — domain, DC, lab VLAN; (2) one DCSync literacy row — permission name, detection idea (4662), hardening action; (3) one ACL path row from allowed BloodHound or manual ACL read — edge names, remediation; (4) one delegation row — type, risk, fix; (5) integrity block — $LAB_AD only, no stranger targets, no full escalation cookbook export; (6) chmod 600 pack. Run only brief-allowed collection on $LAB_AD. No importing leaked enterprise graphs, no DCSync against unauthorized DC, no publishing cracked lab creds.
1. Lab rows
Three rows minimum: DCSync, ACL path, delegation — each with defender fix column.
Link ATT&CK IDs where brief provides — T1003.006, path edges, T1558 delegation context.
Command guide
Try these commands — Lab rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Privilege path literacy — https://bloodhound.specterops.io/ (attack path concepts) MITRE TA0004 — https://attack.mitre.org/tactics/TA0004/ (Privilege Escalation tactic) CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/priv-paths-lab.txt" <<'EOF'
privilege path literacy (YOUR lab):
DCSync -> domain hash exposure (named, not executed)
ACL chains -> GenericAll -> DA (graph literacy)
Delegation -> impersonation (audit msDS-AllowedToActOnBehalfOfOtherIdentity)
scope: document paths for blue report — no secretsdump/psexec
EOFCommand — copy this
grep -E 'DCSync|ACL|Delegation|scope' "$LAB_AD/notes/priv-paths-lab.txt" curl -sS https://attack.mitre.org/tactics/TA0004/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: Privilege path literacy (https://bloodhound.specterops.io/); MITRE TA0004 (https://attack.mitre.org/tactics/TA0004/); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact real org names; lab domain only. Graph screenshot from $LAB_AD collection.
Impact literacy without live dump proof on unauthorized systems.
3. Teardown
Revert $LAB_AD snapshot if brief requires. Secure notes chmod 600.
Delete synthetic lab hash notes after exercise.
4. What you ship: privilege paths lab pack
Three path rows + topology + integrity — chmod 600.
5. What you record before the next lesson
Paths lab pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paths lab includes DCSync output from employer DC.
Right
Paths lab pack on $LAB_AD with defender fixes. Next: quiz.
Mission: paths lab
1) Topology proof. 2) DCSync ACL delegation rows. 3) Defender fix per row. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum graph evidence without cookbook?”
Knowledge Check
APPLY: Paths lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Full DA takeover proof required in paths lab.
True or False
Knowledge Check
APPLY: Each path row includes:
Multiple choice