Yes another pentester blog..
DRACARYS is a new lab environment challenge (not for beginners) on GOAD : https://github.com/Orange-Cyberdefense/GOAD The lab consists of three machines: two Windows Server 2025 (one DC and one server) and one Ubuntu 24.04 server. All connected to the same Active Directory domain “dracarys.lab”. The lab start on the Linux machine with the .12 IP, which serves as the starting point for reconna...
On GOAD v3 Update: A New Addition appear : EXCHANGE! Huge thanks to aleemladha for his pull request and invaluable help in integrating Exchange into the GOAD lab! I’ve been wanting to write an Exchange exploitation guide for a long time—now, it’s finally happening! Stay tuned. Exchange installation Launch GOAD : ./goad.sh Select the lab instance where you want to add exchange :...
In the previous blog post on ADCS (Goad Pwning Part 6), ESC1, ESC2, ESC3, ESC4, ESC6, and ESC8 were exploited. This post examines additional ESC vulnerabilities within the domains. Several modifications have been made to GOAD (excluding goad-light and goad-mini) to support various ADCS attack techniques. Updating an existing GOAD instance will incorporate these changes. Some of these mod...
Full view and regulary updated Active Directory Pentest mindmap is available on orange cyberdefense mindmap site : https://orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg Upgrade A lot of stuff (timeroasting, SCCM attacks, adcs 11-15,…) But the main upgrade is the generation from markdown ! Now we can integrate pull request easily....
On the previous post (SCCM LAB part 0x2) we have done SCCM exploitation with a low privilege user. On this part we will exploit SCCM with an admin access on one vm. On part 0x1 we discovered the credentials of local administrator user on CLIENT vm. nxc smb 192.168.33.10-13 -u administrator -p 'EP+xh7Rk6j90' --local-auth So we will start by exploit with local admin account. also on pa...