ad-lab-scripts

A modular Active Directory lab builder for hands-on penetration testing and security research in isolated environments.

Each virtual machine is provisioned by its own PowerShell script, so you can stand up exactly what you need — the Domain Controller alone, a single member host, or the full multi-host enterprise. The Domain Controller build is a checkpoint-driven state machine: it survives the multiple reboots an AD DS install requires, resuming from where it left off each time you re-invoke it, until it prints a completion message.

The lab builds the ad.lab forest (NetBIOS AD) with a Domain Controller and a network of Windows Server and Windows 11 hosts, seeded with realistic users, service accounts, and deliberately weak configurations. It's a representative environment for practicing lateral movement, privilege escalation, Kerberoasting, AS-REP roasting, and NTLM relay.

⚠️ This lab is intentionally vulnerable. Build and run it only on an isolated host-only network. Never attach these machines to a production or public network.

Highlights

• One script per VM — compose a single host or the whole domain.
• Reboot-resilient DC build — a checkpoint file lets DC01.ps1 resume automatically across the forced restarts of host rename and forest promotion.
• Pre-flight validation — scripts verify the environment (correct adapter, DC reachability, DNS resolution, admin rights) before mutating system state, and fail fast with actionable messages.
• Attack-mapped misconfigurations — every weakness is deliberate and tied to a specific technique (see below).
• Attacker box included — KALI.sh provisions a Kali host with a Samba share for file transfer.
• Reference pentest report — pentest-report.txt documents an end-to-end compromise of the lab.

Why the credentials are published

This is a lab designed to be solved, so the credentials are intentionally weak and openly documented — they're the answer key, not a leak.

The intended attack paths (AS-REP roasting the no-preauth user, Kerberoasting the iis_service account, password spraying) only work end to end if the recovered hashes are crackable. Every seeded password is therefore chosen to fall to rockyou.txt (with standard rules). Publishing them lets you check your work and understand which weak credential enables which technique. The DSRM/Safe-Mode password is likewise a fixed lab constant.

In short: the password weakness is the exploitable surface. That's the point of the lab.

Requirements

• VMware (Workstation/Fusion) — scripts target VMware networking (VMNet1 host-only + NAT).
• Windows evaluation ISOs: Windows Server 2025 (DC01), Windows Server 2022 (MAIL01), Windows 11 Enterprise (all other workstations).
• A Kali ISO for the attacker box.
• Host resources — the full lab is memory-heavy; build only the hosts you need (per-VM RAM in the table below).

Topology

Forest root ad.lab, DC at 10.10.14.2, all hosts on the 10.10.14.0/24 host-only network (VMNet1) with a NAT adapter as a second interface for updates.

Host	IP	OS	RAM	Role
DC01	10.10.14.2	Server 2025	4 GB	Domain Controller / DNS, forest root ad.lab
WEB01	10.10.14.20	Win 11	4 GB	Web server (XAMPP)
WEB02	10.10.14.40	Win 11	6 GB	Web / SQL host — HTTP/web02 SPN on iis_service
DMZ01	10.10.14.60	Win 11	4 GB	DMZ host
MAIL01	10.10.14.80	Server 2022	3 GB	Mail server (SMTP relay)
DEV01	10.10.14.100	Win 11	6 GB	Developer workstation (two-stage setup)
ADMIN04	10.10.14.120	Win 11	3 GB	Admin workstation (SMB-signing-disabled OU)
ADMIN03	10.10.14.140	Win 11	3 GB	Admin workstation
ADMIN02	10.10.14.160	Win 11	3 GB	Admin workstation
ADMIN01	10.10.14.180	Win 11	4 GB	Admin workstation
FILES01	10.10.14.200	Win 11	3 GB	File server
KALI	—	Kali	4 GB	Attacker box

Domain users and their (intentionally weak) passwords are seeded by DC01.ps1 — see the script's user-seed step for the full list.

Build Order

instructions.txt is the authoritative, step-by-step guide. In brief:

1. Domain Controller — create the DC01 VM (Server 2025) on VMNet1 host-only with a single adapter, then run DC01.ps1. Re-run after each reboot until it prints "SETUP FULLY COMPLETE." Add a NAT adapter, sync time to an external source, and keep DC01 running whenever you use the lab.
2. Kali — build the attacker box, run KALI.sh, configure networking per KALI.txt, and confirm connectivity to the DC.
3. Member hosts — set adapter 1 to VMNet1 and adapter 2 to NAT, prep the OS, then run domain-join.ps1, entering the host's name when prompted. The script routes the host into the correct misconfiguration OU automatically.
4. Attack-surface setup — run each host's build script (WEB01.ps1, WEB02.ps1, DMZ01.ps1, DEV01.ps1 + DEV01-Part2.ps1, MAIL01.ps1, ADMIN0x.ps1, FILES01.ps1). Scripts resume after reboots until they report success.
5. Final touches — per-host steps in instructions.txt (caching a domain credential on WEB02, seeding a PowerShell-history clue on DMZ01, the DEV01 reverse-shell flow, etc.).

Each .ps1 has a companion .txt with that host's prerequisites, domain-join details, and required Windows Defender exclusions.

Staged Vulnerabilities

Configured by DC01.ps1 and the per-host scripts, mapped to the technique each one enables:

Misconfiguration	Where	Enables
HTTP/web02.ad.lab SPN on iis_service	DC	Kerberoasting
DONT_REQ_PREAUTH on Ernesto	DC	AS-REP roasting
Jamie added to Domain Admins	DC	Privilege-escalation target
Weak, rockyou-crackable passwords	DC	Offline cracking, password spraying
GPO: SMB signing disabled (ADMIN04's OU)	DC	NTLM relay
GPO: Defender disabled + ICMP allowed	DC	Tooling / reachability
Netlogon DisablePasswordChange	DC	Keeps machine passwords stable for a long-lived lab
Cached domain creds, planted clues (docs, mail, PS history)	member hosts	Credential discovery, pivoting

Member hosts inherit their specific weaknesses from the OU domain-join.ps1 places them in: ADMIN04 lands in the SMB-signing-disabled OU; all others land in the standard misconfiguration OU.

Engineering Notes

A few design decisions worth calling out for anyone reading the source:

• Idempotent, checkpoint-resumable DC build. DC01.ps1 is a ten-step state machine gated by an integer in C:\DC-Setup-Checkpoint.txt. Each step runs once, advances the checkpoint, and returns — so the unavoidable reboots from host rename and Install-ADDSForest don't lose progress. Re-invoke the script and it continues from the next step.
• Environment validation before mutation. The DC build refuses to run unless exactly one network adapter is up, and aborts if that adapter sits on a NAT range (persisting the chosen adapter name so resumed runs stay consistent). domain-join.ps1 confirms Tamper Protection is off, checks for admin rights, pings the DC, and resolves the domain before making changes.
• Resilient control flow. domain-join.ps1 skips the rename if the name already matches, retries the domain join in a loop on bad credentials instead of aborting, and treats the remote OU move (via Invoke-Command) as non-fatal since the join itself has already succeeded.
• Parameterized by default. domain-join.ps1 exposes DNS server, domain, credentials, and DC name as parameters with lab defaults, so it's reusable across hosts without edits.

Repository Layout

ad-lab-scripts/
├── DC01.ps1 / DC01.txt           # Domain Controller build (checkpoint-resumable)
├── domain-join.ps1 / .txt        # Parameterized domain-join + OU routing
├── WEB01 / WEB02 / DMZ01 ...     # Per-host build scripts + instruction notes
├── DEV01.ps1 / DEV01-Part2.ps1   # Developer host (two-stage setup)
├── KALI.sh / KALI.txt            # Attacker box provisioning
├── instructions.txt              # Authoritative end-to-end build guide
└── pentest-report.txt            # Reference walkthrough of a full compromise

Troubleshooting

• Wrong network adapter — DC01.ps1 expects a single host-only (VMNet1) adapter and stops if it detects a NAT range. Fix the adapter and re-run.
• Missing or disconnected ISO — attach the ISO with "Connect at power on" enabled.
• Insufficient resources — respect the per-VM RAM allocations.
• Antivirus interference — apply the Defender exclusions in each host's .txt note.
• Service timing — on WEB02, let SSMS finish starting before re-running the SQL steps after a reboot.

Documentation

Full setup and exploitation walkthroughs: lobenstein.com

Contributing

Suggestions and additional host scripts are welcome — open an issue or a pull request.

Disclaimer

For authorized testing and education only. This lab is deliberately insecure and must remain isolated. Do not use these techniques against systems you do not own or lack explicit written permission to test.