Step 308. AD Set Takedown Training — From the Client to the Domain Controller
Level 4 — Expert | Difficulty ★★★★☆ | Estimated time: 2–3 days
Prerequisites: you finished Step 261 (AD structure), 262 (Kerberoasting & AS-REP), 263 (Pass-the-Hash & BloodHound), and 271 (the standard AD machine route). You have Step 307’s exam-format report template.
- What you need: an AD practice environment (a Proving Grounds Practice AD set, a THM network lab, or a self-built domain lab — 1 Windows Server + 2 clients), an attack machine, and Step 307’s report template.
- ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. In particular, use
lsassdumping, hash theft, and lateral movement techniques only inside your practice lab. - Screen guide: every lab screen and command output in this chapter is a screen example. The actual takedown is performed by you in your own practice environment.
Nearly half of the OSCP exam’s points come from the AD set — a single 3-machine environment of client machines and a domain controller joined to one domain is worth a whole 40 points. In Step 271 you took down "one domain machine"; today you take down "one domain." The difference is not scale but structure — the result of a compromise doesn’t stay on that machine; the harvested credentials become the key to the next machine, a chain. The Kerberoasting, BloodHound, and Pass-the-Hash you learned as parts in Level 3 connect today into a single chain.
1. Learning Objectives
By the end of this chapter, you will be able to:
- Explain the composition (client → server → DC) and scoring structure of the OSCP AD set
- Execute the chain from first-machine compromise to domain compromise, phase by phase
- Leave a "4-line memo" the moment a credential is found, preventing the chain from tangling
- Evaluate your walked path against BloodHound’s shortest path
- Write an exam-format report that includes a chain diagram
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | AD practice lab (PG Practice AD set / THM network lab / self-built domain lab) + attack machine |
| Today’s commands | whoami /all, net user /domain, SharpHound/bloodhound-python, mimikatz (lab only), evil-winrm -H |
| Concepts needed | Lateral movement, credential types (plaintext/NTLM/ticket), chain diagrams, BloodHound path evaluation |
| Today’s deliverable | AD set compromised + a report with a chain diagram (the AD section of Step 307’s template) |
2-1. What Is the AD Set — A 40-Point Chain
The exam’s AD set is generally 2 client machines + 1 domain controller joined to a single domain (screen example):
┌────────────────── corp.local domain ──────────────────┐
│ │
│ CLIENT01 (10.10.x.11) ──→ CLIENT02 (10.10.x.12) │
│ attackable from outside internal machine │
│ │ │ │
│ └────── credential theft ──┘ │
│ │ │
│ ▼ │
│ DC01 (10.10.x.10) ← final goal │
│ │
└────────────────────────────────────────────────────────┘
The decisive difference from standalone machines: breaking one machine is not the end but the beginning. The first machine’s true spoils are not its flag but the credentials sleeping inside it — hashes in memory, saved passwords, Kerberos tickets — and they open the next machine’s door. The set’s score is divided into per-machine partial points, so even if you never reach the DC, points accumulate with each machine you compromise.
2-2. The Chain’s Four Phases — The Standard Order
Taking down an AD set mostly follows the same skeleton.
① First-machine compromise — enter the externally visible machine (client)
via a web/service vulnerability or a credential spray
② Domain information gathering — enumerate the domain structure, users, groups
from inside that machine + collect BloodHound data
③ Credential harvesting and lateral movement — move to the next machine
with the stolen hash/password/ticket
④ Obtain Domain Admin — collect proof on the DC
You’ve already learned each phase’s technique — ① is the standalone machine cycle from Steps 118–127 and 305–306; ② and ③ are the AD basics from Steps 261–263 and 271. What’s new today is the management skill of operating these phases as one unbroken chain.
2-3. The Credential 4-Line Memo — So the Chain Doesn’t Tangle
Half of AD set failures are not technique but confusion. The moment "where did I get which credential" blurs, the chain tangles. The instant you find a credential, record four lines.
Where obtained: CLIENT01 (where — memory / a file / a config)
Account: corpj.smith
Type: plaintext / NTLM hash / Kerberos ticket — which?
Usable on: which machine, over which protocol
(e.g., CLIENT02 over WinRM — if already tried, the result too)
If Step 271’s "account ledger" was for one machine, this 4-line memo is for the whole domain. The order in which the memos pile up is itself the chain diagram’s first draft.
2-4. Path Evaluation — Comparing with BloodHound
After compromising the set, always do one more thing — compare BloodHound’s suggested shortest path with the path you actually walked.
The path I walked: CLIENT01 → (hash theft) → CLIENT02 → (ticket) → DC01 [3 arrows]
Shortest path: CLIENT01 → (WriteDacl abuse) → DC01 [2 arrows]
If your path was longer, that’s not failure but tuition — "why didn’t I see that shortcut" becomes your vision on the next set. Conversely, if your path was the shortest, leave the judgment’s grounds in a sentence — reproducible judgment is skill.
3. Follow Along
3-1. Choosing a Practice Environment
You have three options (screen example):
| Environment | Composition | Notes |
|---|---|---|
| Proving Grounds Practice AD set | Sets in the same format as the exam | Paid subscription; best for exam feel |
| THM network labs (Throwback, Wreath, etc.) | Multi-machine networks | Domain chain + pivot practice |
| Self-built domain lab | Windows Server 1 + 2 clients | Building it is itself study; reuse Step 261’s lab |
If you haven’t registered for the exam yet, PG Practice’s AD sets are formally the closest; to save cost, a sensible combination is to build chain sense first on THM or a self-built lab, then move to PG just before the exam.
3-2. ① First-Machine Compromise
When you connect to the set, look at the whole subnet first (screen example):
nmap -p- --min-rate 1000 10.10.x.10-12
10.10.x.10: 53,88,135,389,445,636,3268 open ← the DC's port combination (Step 271)
10.10.x.11: 80,135,445,3389 open ← a client with web
10.10.x.12: 135,445,3389 open ← a client with no external attack surface
How to read it: from the 88/389 combination, instantly identify 10.10.x.10 as the DC, and start from .11, which has an externally reachable attack surface — the chain’s starting point is "the machine I can reach." From here it’s the same as a standalone machine: enumerate (Step 306’s checklist) → vulnerability grounds → compromise. A web vulnerability or a credential spray is the typical first door — performed only against practice lab targets.
3-3. ② Domain Information Gathering
Once inside the first machine, enumerate the domain before the flag (screen example):
whoami /all
net user /domain
net group "Domain Admins" /domain
Users: j.smith, m.jones, svc-backup, administrator ...
Domain Admins members: administrator, m.jones
Then collect BloodHound data — from the attack machine:
bloodhound-python -d corp.local -u j.smith -p 'acquired-password'
-ns 10.10.x.10 -c All --zip
Why: this collection is "the map of the domain." Since losing your way while tracking relationships by eye is half of AD failure (Step 271), secure the map early in the compromise.
3-4. ③ Credential Harvesting and Lateral Movement
Once you have administrator privileges on the first machine, harvest credentials — the mimikatz concept practice and lsass memory dumping are performed only in the lab environment (screen example):
mimikatz # sekurlsa::logonpasswords
...
* Username : m.jones
* Domain : CORP
* NTLM : 5f4dcc3b5aa765d61d8327deb882cf99 ← fabricated example hash
The moment you find it, leave a 4-line memo — "where obtained: CLIENT01 memory / account: corpm.jones / type: NTLM / usable on: needs checking." And move:
evil-winrm -i 10.10.x.12 -u m.jones -H 5f4dcc3b5aa765d61d8327deb882cf99
How to read it: Pass-the-Hash (Step 263) — without knowing the password, the hash itself serves as the authentication material. If it connects, immediately confirm privileges with whoami and net user m.jones /domain and update the ledger. If m.jones is a Domain Admins member — one step remains to the DC.
3-5. ④ Domain Compromise and Evidence
The final move (screen example):
evil-winrm -i 10.10.x.10 -u m.jones -H 5f4dcc3b5aa765d61d8327deb882cf99
whoami
# corpm.jones
hostname
# DC01
type C:UsersAdministratorDesktopproof.txt
Evidence capture follows Step 305’s rules exactly — proof.txt contents + hostname + IP on one screen. You must leave evidence for each machine in the set for the partial points to be fully credited.
3-6. The Chain Diagram and the Report
Record the whole chain in the AD section of Step 307’s template. The key deliverable is the chain diagram:
[CLIENT01 10.10.x.11]
│ entry: web vulnerability (file upload) — grounds: evidence 02
│ harvest: m.jones NTLM (memory)
▼ move: evil-winrm -H (Pass-the-Hash)
[CLIENT02 10.10.x.12]
│ confirmed: m.jones ∈ Domain Admins
▼ move: evil-winrm -H
[DC01 10.10.x.10] ★ domain compromised — proof obtained
Finally, compare against BloodHound’s shortest path (2-4) and append that evaluation as one paragraph to the report. This document is both the starting point of the next AD set and the finished rehearsal of the exam-day report.
4. Missions & Exercises
Mission — Fully Compromise an AD Set (or Domain Lab)
- Choose one AD practice environment and connect
- Identify the DC and clients from the subnet scan and decide the attack order
- Execute the chain’s four phases (compromise → gather → harvest/move → own), leaving a 4-line memo for every credential
- Leave evidence for each machine following Step 305’s rules (captures including hostname+ip)
- Complete a report with a chain diagram in Step 307’s template, appending the comparison with BloodHound’s shortest path
Exercises
Exercise 1. Explain why the "true spoils" of the first-machine compromise in an AD set are not the flag.
Exercise 2. State the grounds for identifying which machine is the DC from a subnet scan, and why the attack order is not "DC first."
Exercise 3. List the four items of the credential 4-line memo, and explain what confusion arises if "usable on" is missing.
Exercise 4. State the training value of the procedure of comparing BloodHound’s shortest path with your own path after the compromise.
5. Model Answers & Completion Criteria
Mission Model Answer
The AD set section of a finished report has the following (the content is a screen example):
## Chain Diagram
[CLIENT01] --web upload RCE--> shell (user) --local escalation--> admin
--lsass harvest: corpm.jones NTLM--> [CLIENT02] evil-winrm -H
--confirmed m.jones ∈ Domain Admins--> [DC01] evil-winrm -H ★ proof obtained
## BloodHound comparison
- My path: 3 arrows (1 compromise + 2 moves)
- Shortest path: 2 arrows — CLIENT01's svc-backup account directly held
DCSync rights over the DC
- Evaluation: had I checked svc-backup's privilege relationships in the
initial enumeration, I wouldn't have gone through CLIENT02. From the
next set on, immediately after owning the first machine, query the
"current accounts → DA" path first.
How to verify: ① does each arrow in the chain diagram name the technique and the credential? ② were the credential 4-line memos written during the actual attack (not after)? ③ does each of the three machines’ evidence captures include hostname+ip? ④ does the BloodHound comparison include one line of "what I’ll do differently next time"? ⑤ does the report pass the validation script (Step 307)?
Exercise Answers
Answer 1. Because inside a set, the first machine’s flag is only partial points, while the credentials sleeping in that machine — hashes in memory, saved passwords, tickets — are the keys to the next machine. In a chain structure, the value of owning each machine is decided by "what you harvest inside it." A machine you left after reading only the flag is half compromised.
Answer 2. The identification grounds are the port combination of 88 (Kerberos) and 389 (LDAP) open together (Step 271). The reason the attack order is not "DC first" is that a DC usually has no externally reachable attack surface — a normal DC won’t even open SMB without domain authentication. The chain’s starting point is not "the important machine" but "the machine I can reach," and the important machine is reached by following the chain.
Answer 3. The four items are: where obtained / account / type (plaintext, NTLM, ticket) / usable on. If "usable on" is missing, you end up checking by trial and error every time which machine a hash works on — and in worse cases, you burn time retrying targets that already failed. If the type record is missing, inefficiencies arise like going the password-cracking route for something Pass-the-Hash would have handled. The longer the chain, the more this memo is your only navigation tool.
Answer 4. Three values. First, vision correction — it reveals shortcuts you didn’t see (like direct DCSync rights) and changes the enumeration priorities for the next set. Second, judgment verification — if your path was the shortest, putting its grounds into a sentence hardens it into reproducible skill. Third, exam strategy — in the exam, "the faster path" is exactly the time you have left, so path-comparison training connects directly to time-management ability.
Completion Criteria Checklist
- [ ] I can explain the AD set’s composition (2 clients + 1 DC) and scoring structure
- [ ] I identified the DC from the subnet scan and decided the attack order
- [ ] I executed the chain’s four phases without breaking it
- [ ] I left a 4-line memo immediately for every credential
- [ ] I left evidence captures (including hostname+ip) for each machine
- [ ] I compared BloodHound’s shortest path with my path and wrote an evaluation
- [ ] Mission: AD set compromised + report with chain diagram complete
6. Common Pitfalls & Fixes
Wall 1. I lose track of where I got each credential and the chain tangles
Symptom: three hashes, and you don’t know which account they belong to or which machine they came from.
Cause: you didn’t record at discovery and deferred it to "organize later" — in a set, later never comes.
Fix: write the 4-line memo at the very spot of discovery. If it’s already tangled, take your hands off and rebuild the ledger first — re-check whoami in each shell you hold so far, and take time to map each hash to an account one by one. Chain confusion is resolved only by organizing, not by attacking.
Wall 2. evil-winrm fails to connect with WinRMAuthorizationError
Symptom: an authentication failure like Error: An error of type WinRMAuthorizationError happened.
One of three causes — the hash is wrong (a copy omission), that account has no WinRM rights on the target machine, or that machine accepts only local accounts.
Fix: check in order — ① the hash string’s length (NTLM is 32 hex chars) and leading/trailing spaces, ② re-confirm groups with net user account /domain, ③ if it still fails, widen that credential’s "usable on" to other machines and other protocols (SMB, etc.). Record failures in the 4-line memo too.
Wall 3. BloodHound collection is incomplete due to insufficient privileges
Symptom: the collected graph is empty or shows no paths.
Cause: the account used for collection has low privileges, or the -c All option is missing.
Fix: confirm -c All, and re-collect after obtaining a higher-privilege account — in a set takedown, collection happens not once but every time the account changes. If there are still no paths, "no path from the current position" is itself information (same principle as Step 271’s Wall 4).
Wall 4. The lsass dump gets blocked
Symptom: the memory dump tool errors out, blocked by AV/EDR.
Cause: credential theft is the top surveillance target of defense solutions.
Fix: in the practice lab, check the defense settings (in the lab only) and proceed, or find alternative harvest routes the lab allows — saved credentials, config files, install traces like unattend.xml. In the exam, the block itself is a signal that "this isn’t the route," so searching for alternate paths takes priority over practicing evasion techniques.
Wall 5. Trapped on one machine, I burn the whole set’s time
Symptom: you spend 4 hours on the first client’s privilege escalation and leave the set unfinished.
Cause: you aimed for "full compromise of each machine" with standalone-machine instincts.
Fix: the set’s goal is not "full compromise of each machine" but "reaching the DC." If escalation is blocked, first sweep what’s harvestable at your current privileges (files, saved credentials) and look at other paths. If still blocked, leave that machine’s partial evidence and move to a standalone machine — going all-in on the 40-point set and abandoning the 60 points of standalones is a strategic defeat. The exam is not a per-machine seesaw; it’s a total-score fight.
7. Summary
Today’s Concepts
| Concept | One-line explanation |
|---|---|
| AD set | A domain environment of 2 clients + 1 DC — about 40 of the exam’s points |
| Chain | Compromise → domain gathering → credential theft/movement → DC — an unbroken chain |
| Lateral movement | To the next machine with stolen credentials — the hash/ticket is the key itself |
| Credential 4-line memo | Where / account / type / usable on — the navigation tool against chain tangles |
| Path comparison | BloodHound shortest path vs my path — the vision-correction procedure |
| Set strategy | The goal is reaching the DC — a total-score fight, not per-machine full compromise |
Today’s Commands & Tools
| Command | Use |
|---|---|
nmap -p- --min-rate 1000 subnet |
Set subnet scan — identify the DC by 88/389 |
whoami /all · net user /domain |
Domain enumeration from inside a compromised machine |
net group "Domain Admins" /domain |
Confirm the final target account group |
bloodhound-python -d domain -u account -p password -ns DC -c All --zip |
Collect the domain map |
mimikatz sekurlsa::logonpasswords |
Memory credential harvest — lab only |
evil-winrm -i target -u account -H hash |
Pass-the-Hash lateral movement |
| Step 307 template’s AD section | The report with a chain diagram |
The Core Instinct
If a standalone machine is a sprint, the AD set is a relay — drop the baton (the credentials) and no matter how fast you run, it isn’t a finish. So set skill is as much management skill as penetration skill: the ability to always know "what baton is in my hand right now and where it gets passed." The 4-line memo and the chain diagram are that ability’s formal shape. And this chain — compromise, harvest, move, own — is, beyond the exam, the actual AD procedure of a real penetration test. The chain diagram you drew today will be drawn again in the same shape, in the exam room and in the field.
Once every box is checked, Step 308 is complete.