# Active Directory Attack Lab: Recon-to-Root

#### Active Directory Lab Overview

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FlVSxCR4mUDsN9IsIUB0V%2Fimage.png?alt=media&#x26;token=b86b6b07-a401-4691-92c3-9631355fc7f1" alt=""><figcaption></figcaption></figure>

#### Key Activities

* Service Enumeration
* Exploit misconfigurations and weak credentials
* Abusing Active Directory features for full control

#### Tools We'll Use

* **Reconnaissance:** Nmap
* **Enumeration:** smbclient, ldapsearch, kerbrute
* **Exploitation:** netxexc, evil-winrm
* **Privilege Escalation:** ldapdomaindump, BloodHound, winPEAS
* **Post-Exploitation:** Windows CLI, RPC Commands

**Note:** All required files and tools for this lab are preloaded and can be found on the kali `Desktop`

```bash
Attacker IP: 10.0.15.99                                                                                         
Target IP: 192.168.10.4
```
