Purple Edge
Get started

Active Directory Attacker

advanced10 labsSubscription

An end-to-end attack chain against a vulnerable Active Directory: enumeration, BloodHound, Kerberos attacks (Kerberoast/AS-REP), spraying, ACL/delegation abuse, lateral movement, credential dumping, DCSync, and golden/silver-ticket persistence.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Hands-on lab Subscription

    AD Fundamentals & Enumeration

    Learn the building blocks of Active Directory — domains, forests, OUs, groups, and SIDs — then enumerate a target domain with crackmapexec, ldapsearch, and enum4linux-ng.

    45 min3 tasksActive Directory
  2. 2
    intermediate Hands-on lab Subscription

    BloodHound & Attack Paths

    Collect AD relationship data with SharpHound, ingest it into BloodHound, and follow the graph to find the shortest path from your foothold to Domain Admin.

    50 min3 tasksActive Directory
  3. 3
    intermediate Hands-on lab Subscription

    Kerberoasting

    Request service tickets for accounts with a Service Principal Name, then crack the RC4-encrypted TGS offline with hashcat mode 13100 to recover the service account's cleartext password.

    50 min3 tasksActive Directory
  4. 4
    intermediate Hands-on lab Subscription

    AS-REP Roasting

    Find accounts that do not require Kerberos pre-authentication (DONT_REQ_PREAUTH), grab their AS-REP with impacket-GetNPUsers, and crack it offline with hashcat mode 18200.

    45 min3 tasksActive Directory
  5. 5
    intermediate Hands-on lab Subscription

    AD Password Spraying

    Try one weak password across many accounts with crackmapexec to land a foothold, while respecting the domain lockout policy to avoid locking users out.

    40 min3 tasksActive Directory
  6. 6
    advanced Hands-on lab Subscription

    ACL & Delegation Abuse

    Weaponize dangerous AD object rights (GenericAll, WriteDACL, GenericWrite) and Kerberos delegation — unconstrained, constrained, and resource-based (RBCD) — using PowerView, impacket, and Rubeus S4U.

    60 min3 tasksActive Directory
  7. 7
    advanced Hands-on lab Subscription

    Lateral Movement (PtH/PtT/WMI/PSExec)

    Move between hosts without a cleartext password using Pass-the-Hash and Pass-the-Ticket via impacket psexec/wmiexec/smbexec and evil-winrm.

    50 min3 tasksActive Directory
  8. 8
    advanced Hands-on lab Subscription

    Credential Dumping (LSASS/SAM/NTDS)

    Harvest secrets from the local SAM, live LSASS memory, and the domain's NTDS.dit using secretsdump and mimikatz to recover NTLM hashes and plaintext credentials.

    55 min3 tasksActive Directory
  9. 9
    advanced Hands-on lab Subscription

    DCSync & Domain Dominance

    Abuse directory replication rights (DS-Replication-Get-Changes / -All) to pull the krbtgt and any account's hash straight from a DC with secretsdump -just-dc or mimikatz lsadump::dcsync — no code on the DC.

    50 min3 tasksActive Directory
  10. 10
    advanced Hands-on lab Subscription

    Persistence: Golden & Silver Tickets

    Forge Kerberos tickets for stealthy persistence — Golden Tickets from the krbtgt hash (any service, domain-wide) and Silver Tickets from a service account hash (one service) — with mimikatz and Rubeus.

    55 min3 tasksActive Directory

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-06