Active › Module 6 › Lesson 4
Lab — Paths
Privilege path literacy lab on $LAB_AD — DCSync, ACL, delegation rows with defender fixes; no stranger-domain escalation.
Visual · t25_paths_lab
Lab: path literacy rows on YOUR $LAB_AD. Original Cyberlium.
Opening
Document three named paths in your lab forest — and the defender fix for each, not a domain admin trophy from the internet.
On YOUR $LAB_AD per RoE: (1) topology proof — domain, DC, lab VLAN; (2) one DCSync literacy row — permission name, detection idea (4662), hardening action; (3) one ACL path row from allowed BloodHound or manual ACL read — edge names, remediation; (4) one delegation row — type, risk, fix; (5) integrity block — $LAB_AD only, no stranger targets, no full escalation cookbook export; (6) chmod 600 pack. Run only brief-allowed collection on $LAB_AD. No importing leaked enterprise graphs, no DCSync against unauthorized DC, no publishing cracked lab creds.
1. Lab rows
Three rows minimum: DCSync, ACL path, delegation — each with defender fix column.
Link ATT&CK IDs where brief provides — T1003.006, path edges, T1558 delegation context.
Command guide
Try these commands — Lab rows
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: grep, curl. Reference sites: Privilege path literacy (https://bloodhound.specterops.io/); MITRE TA0004 (https://attack.mitre.org/tactics/TA0004/); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact real org names; lab domain only. Graph screenshot from $LAB_AD collection.
Impact literacy without live dump proof on unauthorized systems.
3. Teardown
Revert $LAB_AD snapshot if brief requires. Secure notes chmod 600.
Delete synthetic lab hash notes after exercise.
4. What you ship: privilege paths lab pack
Three path rows + topology + integrity — chmod 600.
5. What you record before the next lesson
Paths lab pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paths lab includes DCSync output from employer DC.
Right
Paths lab pack on $LAB_AD with defender fixes. Next: quiz.
Mission: paths lab
1) Topology proof. 2) DCSync ACL delegation rows. 3) Defender fix per row. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum graph evidence without cookbook?”
Knowledge Check
APPLY: Paths lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Full DA takeover proof required in paths lab.
True or False
Knowledge Check
APPLY: Each path row includes:
Multiple choice