Lv 8–16
AD Kingdom
A royal court whose trust relationships are its whole attack surface. Nothing here is broken — it is all working exactly as configured.
Null Session Herald · Lv 8
Anonymous LDAP Enumeration
Kerberoast Wyrm · Lv 9-10
Kerberoasting (TGS-REP)
locked
AS-REP Revenant · Lv 10-11
AS-REP Roasting
locked
Pass-the-Hash Shade · Lv 11-12
NTLM Credential Replay
locked
Delegation Djinn · Lv 12-13
Constrained Delegation Abuse
locked
Golden Ticket Lich · Lv 13-14
Kerberos TGT Forgery
locked
BOSS · DCSync Dominion · Lv 15-16
Two-phase: Directory Replication Abuse (DCSync), then forge the containment rule.
clear all 6 pairs first