Setting up Game of Active Directory (GOAD-Light) on Windows 11 with VMware Workstation and Vagrant — and the real story behind it: troubleshooting the VMware utility, the launcher’s provider bug, a missing plugin, host-only networking, and provisioning failures that stood between me and a working AD lab.
A Windows domain box where a chain of small misconfigurations adds up to full control, ending in an Active Directory certificate template flaw. Henry → targeted Kerberoast on Alfred → AddSelf to INFRASTRUCTURE → ReadGMSAPassword on ansible_dev$ → Sam → John → WinRM pivot → reanimate tombstoned cert_admin via John’s GenericAll on OU=ADCS → ESC15 (CVE-2024-49019) on the WebServer template → Administrator.
Mapping an Active Directory domain with BloodHound, then walking the permission chain it exposes from a low-privilege account to domain administrator. Olivia → BloodHound ACL chain (ForceChangePassword) → Benjamin → FTP .psafe3 → hashcat → password spray to Emily → targetedKerberoast on Ethan → DCSync Administrator.
Step-by-step notes from a homelab penetration test: discovery, enumeration, Kerberos user discovery, brute force, and admin shell with Evil-WinRM. Includes commands used and outputs captured during the exercise.