Active Directory Homelab — Offensive Security

Overview

This project is an isolated Active Directory homelab designed to simulate realistic enterprise misconfigurations and practice offensive security attack paths against Windows domain environments.

The lab is intentionally built to be iterative and extensible, allowing new vulnerabilities and scenarios to be added over time rather than representing a single closed challenge.

---

Lab Architecture

Domain: acme.local

Machines

Machine	Operating System	Role
DC01	Windows Server 2022	Domain Controller
WS01	Windows 10	Domain-joined workstation
Kali	Kali Linux	Attacker (non-domain-joined)

Network

• Internal isolated network (no Internet access)
• Static IP addressing
• Domain services exposed internally only

---

Initial Access & Enumeration

Unauthenticated Enumeration

• Kerberos user enumeration via Kerbrute
• LDAP anonymous RootDSE information disclosure
• SMB null session (IPC$ access)

Authenticated Enumeration (Low-Privilege User)

Using the domain user natu:

• Full LDAP directory enumeration
• User and computer discovery
• SPN enumeration
• SYSVOL and NETLOGON read access

---

Vulnerability 1 — AS-REP Roasting

Description

A domain user account (drscout) was configured with Kerberos pre-authentication disabled, enabling AS-REP Roasting.

Impact

An attacker can request AS-REP responses for the affected account and perform offline password cracking without further interaction with the domain controller.

Evidence

• Account enumeration confirmed via Kerberos
• AS-REP misconfiguration validated at directory configuration level
• Attack performed from an external, non-domain-joined attacker perspective

---

Vulnerability 2 — ACL Abuse (Privilege Escalation)

Description

The user drscout was granted excessive permissions (GenericAll / Full Control) over the Administrator account object due to a misconfigured Access Control List (ACL).

Exploitation

• drscout successfully reset the password of the Domain Administrator account using standard domain commands
• No exploits, credential dumping, or memory attacks were required

Result

• Full Domain Admin compromise
• Verified via authenticated SMB access to administrative shares (ADMIN$, C$, SYSVOL, NETLOGON)

---

Attack Path Summary

Unauthenticated Enumeration → Kerberos User Discovery → AS-REP Roasting Misconfiguration → Valid Domain Credentials → ACL Abuse (GenericAll) → Domain Admin Compromise

---

Design Philosophy

• No artificial vulnerabilities
• No CTF-style shortcuts
• Focus on real enterprise misconfigurations
• Emphasis on attack paths and permission abuse
• Lab remains intentionally open for future extensions

---

Future Work

Planned extensions include:

• Additional ACL abuse scenarios
• Group Policy Object (GPO) misconfigurations
• Machine Account Quota (MAQ) abuse
• Kerberoasting
• Defensive hardening and detection use cases

---

Status

This lab is actively maintained and expanded as part of an ongoing Active Directory security research project.

---

Disclaimer

This project is intended strictly for educational and defensive research purposes in controlled environments.