In Part 2, we gained SYSTEM on WINTERFELL and minted a long lived Golden Ticket for the child domain. We have total control of North, but in an Active Directory forest, the Child Domain is just a stepping stone. Our objective now is to leverage the trust relationship between the Read more
In Part 1, we set the stage. Now we turn that control into dominance. The goal here is simple. Move from a compromised machine account in the child domain north.sevenkingdoms.local to full Enterprise Admin access in the forest root sevenkingdoms.local. Phase 0: Creating a Controlled Machine Account Before RBCD, we Read more
We have access to the network, but no understanding of the environment. The next step is to enumerate and map what exists. Phase 1: Infrastructure Mapping (Nmap) We start by figuring out what actually exists on the network. A basic Nmap scan across the 192.168.66.0/24 range tells us which hosts Read more
Phase 1: System Tools & Compilers These packages provide the networking, compilation, and cross-platform headers needed for the lab. Enter blanks on all the krb5 stuff. Phase 2: Modern AD Tooling We use pipx to install some tools in isolated environments to prevent dependency conflicts with the system’s Impacket. Grab Read more