Penetration › Module 7 › Lesson 4
Lab — AD Notes
Map YOUR $LAB_AD per brief — enum summary and auth-abuse literacy, no stranger domains.
Visual · t19_ad_lab
Lab: AD enum + auth literacy on $LAB_AD. Original Cyberlium.
Opening
One lab forest, one enum summary, one defender paragraph — not a domain admin trophy from the internet.
On YOUR $LAB_AD per RoE: (1) document domain name, DC, and ≥3 users/groups from allowed enum commands in brief; (2) sketch one weak misconfig finding (e.g., excessive group membership on lab service account); (3) write auth-abuse literacy paragraph naming Kerberoast OR PtH and matching defender control; (4) note what SIEM alert would fire. chmod 600 notes. Run only brief-allowed tools on $LAB_AD VMs — no spraying external AD, no importing third-party BloodHound databases, no publishing cracked credentials.
1. Lab topology proof
Screenshot or text: $LAB_AD domain, DC hostname, lab VLAN isolation statement.
Verify every target IP is in RoE file before enum.
Command guide
Try these commands — Lab topology proof
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AD lab notes — enum concepts without attack cookbook Nmap LDAP — https://nmap.org/nsedoc/scripts/ldap-rootdse.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install dnsutils sudo apt install nmap
macOS:
Command — copy this
brew install bind brew install nmap
Windows: Built-in: nslookup (or install BIND for dig)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t19-ad-notes.txt" <<'EOF' lab_ad: YOUR intentional AD lab only enum_concepts: users/groups/SPNs named auth_abuse: literacy only — no stranger domain EOF
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env"; nmap -p 389 --script ldap-rootdse "$LAB_HOST" 2>/dev/null | head -20 || nmap -p 389 "$LAB_HOST"
Primary tools to practice this lesson: dig, nmap. Reference sites: AD lab notes; Nmap LDAP (https://nmap.org/nsedoc/scripts/ldap-rootdse.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Findings literacy
One misconfig finding with impact in lab context — not copy-paste from real breach reports.
Auth abuse paragraph ties concept to defender mitigation — no full exploit chain export.
3. Teardown
Revert $LAB_AD snapshot after lab. Secure notes chmod 600.
Delete any cracked lab hashes from notes after exercise — synthetic lab creds only.
4. What you ship: AD lab pack
Topology summary + enum bullets + one finding + auth-abuse defender paragraph — chmod 600.
5. What you record before the next lesson
AD lab notes path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Password spray university AD and document in capstone.
Right
AD lab on $LAB_AD with revert. Next: quiz.
Mission: AD lab
1) Document $LAB_AD topology. 2) Enum summary per brief. 3) Auth-abuse literacy + defender paragraph. 4) Snapshot revert.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum enum output for AD lab credit?”
Knowledge Check
APPLY: AD lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Kerberoast stranger domains for lab credit.
True or False
Knowledge Check
APPLY: AD lab includes:
Multiple choice