LDAP

Active Directory machine combining anonymous LDAP enumeration, password reset abuse, SeRestorePrivilege execution, and a manual NTDS extraction.

Active Directory box where exposed SMB shares leak credentials that get reused, then Backup Operators membership is abused to dump domain hashes.

Active Directory machine covering AS-REP Roasting, BloodHound-guided lateral movement, LSASS credential extraction, and Backup Operators abuse.

Active Directory box capturing LDAP credentials through a printer admin panel, gaining WinRM access, and abusing Server Operators rights to DCSync.

Machine built around an Azure AD Connect misconfiguration that leaks credentials and leads to domain compromise.

Active Directory machine generating valid usernames, AS-REP Roasting an account, recovering AutoLogon credentials, and finishing with a DCSync attack.

Active Directory machine built on anonymous LDAP enumeration, AS-REP Roasting, nested group abuse, and a DCSync attack for domain compromise.