From Vulnerability to Control — Active Directory Attack-Path Analysis on GOAD

Graduation thesis project — Offensive Security / Active Directory

A complete, evidence-backed walk from zero access to Domain Admin on the north.sevenkingdoms.local child domain — then a demonstration of what that control actually enables. The engagement is documented as a reproducible package: a consolidated report, seven per-phase manifests, 122 screenshots, 61 raw command logs, every helper script, and every loot artifact.

Headline outcome: Full Domain Admin on north.sevenkingdoms.local via three independent compromise paths, six cracked plaintext credentials, complete post-compromise capability demonstrations. Forest root (sevenkingdoms.local) was not reached — two real hardening controls (Print Spooler mitigation + AD CS Web-Enrollment EPA) blocked the ESC8 chain. The defenses that held are documented as carefully as the attacks that succeeded.

flowchart TB
    subgraph FOREST1["🏰 sevenkingdoms.local — forest root"]
        KL["KINGSLANDING · 192.168.56.10<br/>Server 2019 · DC + IIS + AD CS<br/>🛡️ ESC8 chain blocked here"]
    end

    subgraph CHILD["❄️ north.sevenkingdoms.local — child domain"]
        WF["WINTERFELL · 192.168.56.11<br/>Server 2019 · DC + GC + DNS<br/>🎯 Domain Admin achieved"]
        CB["CASTELBLACK · 192.168.56.22<br/>Server 2019 · member + MSSQL"]
    end

    subgraph FOREST2["🐉 essos.local — separate forest"]
        MR["MEEREEN · 192.168.56.12<br/>Server 2016 · DC"]
        BR["BRAAVOS · 192.168.56.23<br/>Server 2016 · member + MSSQL"]
    end

    KL ---|parent-child trust| WF
    WF --- CB
    MR --- BR
    FOREST1 <-->|bi-directional inter-forest trust| FOREST2

    ATT["💀 Kali · 192.168.56.1<br/>attacker workstation"]
    ATT -.->|host-only, isolated| KL

    style FOREST1 fill:#3d2b1e,stroke:#d9a94a,color:#fff
    style CHILD fill:#1e3a5f,stroke:#4a90d9,color:#fff
    style FOREST2 fill:#3d1e2b,stroke:#d94a7a,color:#fff
    style WF fill:#5f1e1e,stroke:#d94a4a,color:#fff
    style KL fill:#1e5f2b,stroke:#4ad96a,color:#fff
    style ATT fill:#333,stroke:#888,color:#fff

5 GOAD VMs across two forests joined by a bi-directional trust — the trust is what turns a single foothold into cross-forest reach.

Mapped to PTES and MITRE ATT&CK. Each phase has its own manifest with the full command index, detection signals, and mitigations.

📄 The full narrative is in GOAD-DOC/FINAL_REPORT.md.

What makes this engagement more than a linear walkthrough: three independent routes to privileged access, so removing any one control would not have saved the domain.

1. Delegation path — jon.snow (Kerberoasted) has constrained delegation to the DC itself → impersonate Administrator on WINTERFELL → DCSync.
2. SQL path — jon.snow is sysadmin on CASTELBLACK MSSQL → xp_cmdshell as north\sql_svc.
3. SYSVOL path — plaintext credentials in a logon script (jeor.mormont) → local admin on CASTELBLACK → LSA secrets → the sql_svc password we couldn't crack, sitting in cleartext.

41 findings (F-01 … F-41), each rated and mapped to a mitigation. Crucially, this includes the controls that worked:

➡️ Full register in FINDINGS.md · defensive recommendations in FINAL_REPORT §8.

This is why the project reads as security research, not an attack tutorial: every offensive step is paired with its detection signal (Windows event IDs) and its mitigation, and the engagement honestly records where it was stopped.

.
├── README.md                    ← you are here
├── DISCLAIMER.md                authorization, scope, ethics
├── FINDINGS.md                  consolidated finding register (F-01…F-41)
├── METHODOLOGY.md               PTES mapping + evidence pipeline
├── LICENSE                      CC BY-NC-ND 4.0
├── CITATION.cff
└── GOAD-DOC/
    ├── FINAL_REPORT.md          the consolidated engagement report
    └── 4.1 … 4.7/               per-phase packages
        ├── MANIFEST.md          command index · findings · detection/mitigation
        ├── images/              screenshots (before/after each step)
        ├── logs/                raw command output
        ├── _loot/               harvested artifacts (GOAD lab data)
        ├── _helpers/            wrapper scripts used during the phase
        └── _wordlists/          user/password lists (GOAD defaults)

nmap · netexec (nxc) · enum4linux-ng · kerbrute · impacket (GetNPUsers, GetUserSPNs, getTGT, getST, secretsdump, ticketer) · BloodHound · certipy-ad · hashcat · john · evil-winrm · xfreerdp · smbclient — all standard, publicly-available security tooling on Kali Linux.

Ahmad Al-Ahmad — Al-Jazeera Private University. Graduation thesis, "From Vulnerability to Control." Cite via CITATION.cff.

Documentation, findings, screenshots and logs: CC BY-NC-ND 4.0. Helper scripts are thin wrappers around public tools, provided as-is for educational reference. See DISCLAIMER.