Active Directory Attack Path Lab

Active Directory Attack Path Lab

Pre-built Active Directory lab environment with 20+ configured attack paths from initial foothold to Domain Admin:

• Lab Architecture — 2 Domain Controllers, Exchange server, ADCS server, SQL server, 5 workstations with different privilege levels and trust relationships.
• Attack Paths — Kerberoasting, AS-REP Roasting, ACL abuse (GenericAll, WriteDACL, WriteOwner), ADCS ESC1-ESC8, constrained/unconstrained delegation, LAPS reading, gMSA abuse, DCSync, Golden/Silver Ticket, skeleton key.
• Progressive Difficulty — Each path has a difficulty rating (1-5) and can be attempted independently or chained for realistic lateral movement scenarios.
• Includes — Setup guide, provisioning scripts, writeups for each path, and pre-loaded BloodHound data for graph analysis.