38. Active Directory Attacks and Defence
38.2 Safe AD Lab Setup
Production AD var "try" = gunha. Aapan VirtualBox/VMware madhe teen VMs (host-only 192.168.56.0/24):
- Windows Server (Evaluation OK) → promote to DC for
sahyadri.lab(orrajarani.lab). Static IP plan (book lab): Kali192.168.56.10, DC192.168.56.30, client192.168.56.40. - Windows 10/11 member joined to domain – daily driver user
zoya/ service account later. - Kali – Impacket, BloodHound.py / SharpHound only against this lab.
Install AD DS role, create domain, create OUs (Users, Servers, Workstations), two normal users (shahrukh, amir), one helpdesk group, one SPN service account (later for Kerberoast lab). Snapshot before weakening anything.
Never bridge the DC to your real office Wi-Fi for "easy internet" while running attack tools. Host-only + optional NAT on Kali alone is enough. Aata pudhe jaauya.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Builds identical weak lab to practice paths safely | Same lab used by Blue to validate detections (Event IDs, Sysmon) before production |
Accidentally scans 192.168.1.0/24 home/office |
Strict host-only adapter; written lab IP list on sticky note; firewall deny other subnets |
| Uses real org names/passwords in lab | Fictional sahyadri.lab only; unique lab passwords never reused at work |
Ravindra Bagale's Tip
Students put the DC on a bridged network, and when they run Impacket a neighbour's PC gets scanned. Even as an accident, that can amount to an illegal act. Adapter = Host-Only. Take a snapshot, then try weak configs – restore after fixing. Never paste production credentials into the lab.
Ravindra Bagale's Tip – मराठी
Students DC ला bridged network देतात आणि Impacket चालवताना शेजाऱ्याचा PC scan होतो. हा अपघात असला तरी illegal ठरू शकतो. Adapter = Host-Only. Snapshot घेऊन weak configs try करा – fix नंतर restore. Production credentials lab मध्ये paste नको.
Ravindra Bagale's Tip – हिंदी
Students DC को bridged network दे देते हैं और Impacket चलाते समय पड़ोसी का PC scan हो जाता है. यह हादसा हो तो भी illegal माना जा सकता है. Adapter = Host-Only. Snapshot लेकर weak configs try करो – fix के बाद restore. Production credentials lab में paste नहीं.
Lab
VirtualBox/VMware madhe DC + Win10 + Kali host-only set kara. DC: AD DS install, domain sahyadri.lab, DNS on DC. Client join domain. Kali: ping 192.168.56.30 ani nxc ldap 192.168.56.30 (auth nantar – pudhe). Screenshot three IPs aaplya notes madhe. Written permission page: "I own this lab."