Pentest Copilot ran an assumed-breach internal assessment against the Dracarys lab from a single controlled access point. It received two starting identities in separate campaign rounds and no hand-written attack route, privileged-account inventory, service map, or prebuilt chain to the domain controller.

From that position, the campaign discovered every host in scope, modeled the dracarys.lab identity plane, validated application and database access on Linux, established privileged Linux execution, correlated Active Directory ACL and delegation relationships, exercised the credential paths through Vhagar, and reached Balerion with privileged Windows code execution and SYSTEM-level control.

The result was not a collection of isolated checks. It was one continuous graph-driven campaign in which each service, credential, permission, delegation setting, and host-control event became input for the next decision.

Summary And What To Expect#

The engagement began on the Dracarys internal subnet with two controlled assumed-breach identities attached to the assessment graph in successive rounds:

This models an assumed-breach assessment. It asks the practical internal-security question: if an attacker already possesses a valid low-privilege identity, how completely can the environment's applications, Linux permissions, Active Directory relationships, and delegated credentials carry the intrusion?

Pentest Copilot answered that question across all three Dracarys systems:

Coverage At A Glance#

The denominator was the checked-in Dracarys lab definition at the assessed revision: three hosts and eleven intended attack-path families. Coverage was measured by whether Pentest Copilot discovered, correlated, validated, or—where the scenario explicitly supplied the prerequisite—exercised each path to its intended security impact.

The campaign used three complementary validation lanes:

1. Observed and exploited: live authentication, application/database access, SSH, sudo, WinRM, agent callbacks, and post-compromise collection.
2. Graph-correlated: ACLs, SPNs, delegation targets, host identities, credentials, and control relationships were joined into executable attack paths.
3. Assumed-breach completion: controlled scenario prerequisites were represented as explicit Secret or host-state entities, preserving provenance while measuring the full intended path.

What Is Dracarys?#

Dracarys is an Active Directory training environment in the Game of Active Directory project. Its compact topology is deliberately cross-platform: a Linux application server introduces web, database, SSH, and sudo paths; a Windows member server introduces ACL, credential-store, SPN, and delegation abuse; and the domain controller concentrates the final privileged objective.

The two initial passwords were engagement seeds and are intentionally omitted here. Everything derived from them—host reachability, application access, directory relationships, privilege transitions, and remote-execution results—was modeled separately so the campaign retained a clear evidence boundary.

Why This Matters#

Dracarys demonstrates how an internal compromise becomes a domain compromise without relying on one spectacular vulnerability. The high-impact chain is assembled from legitimate enterprise features:

• an application that stores an LDAP bind identity;
• a reachable database with recoverable application credentials;
• recurring SSH automation that carries a reusable domain identity;
• domain groups mapped into Linux SSH and sudo policy;
• an ACL that permits a user to write SPNs on a computer account;
• constrained-delegation targets that become powerful when correlated with that ACL;
• a repeatedly opened KeePass database on a Windows member server;
• CredSSP policy that delegates credentials between Windows systems;
• and remote administration on the domain controller.

Each control can look ordinary in isolation. The attack graph shows the security impact of their composition.

What Discovery Gave Us#

The discovery phase normalized the lab subnet, resolved hostnames and FQDNs, enumerated reachable services, and built the host-to-domain relationships needed by later modules.

Discovery also established the callback architecture used by later agents. Syrax presented lab-reachable HTTPS endpoints while securely relaying RTCS, payload, and message-bus traffic to the dedicated control plane. This kept payload delivery, agent registration, and job dispatch aligned with the graph's host context.

Main Compromise Paths

1. Application And Database Exposure On Syrax#

GLPI 10.0.17 provided the first application-centered route. Pentest Copilot identified the exposed service, matched the affected inventory endpoint class, and correlated the GLPI deployment with its backing MySQL service.

The recovered application database identity was validated against MySQL, after which the data-access module exercised authenticated collection. The graph retained both the service finding and the exploit relationship, allowing application-layer evidence to feed the identity campaign rather than ending as a standalone web finding.

Impact: An application finding became an authenticated database path and supplied context for further identity-based movement.

2. SSH To Verified Root Control On Syrax#

Both assumed-breach rounds were tested against the Linux control surface. Pentest Copilot mapped domain identities to SSH access, then correlated the LinuxUsers and LinuxAdmins group relationships with local policy on Syrax.

The deployment workflow handled password-backed sudo non-interactively, created the privileged agent from the approved payload location, and required a positive execution marker plus agent registration before reporting success. This converted valid SSH access into a verified root-capable control channel.

Impact: Syrax moved from an application foothold to durable, verified root execution with a live job channel.

3. WriteSPN And Constrained Delegation Compose On Vhagar#

Directory collection identified that Viserion could write service principal names on the Vhagar computer account. Separately, it identified that the Syrax computer account was allowed to delegate to the repointable HTTP/arrax service and that Vhagar carried a WSMAN delegation configuration.

Pentest Copilot normalized the SPN fields, resolved the computer-account identities, and joined the ACL and delegation evidence into one SPN-jacking path. Targeted Kerberoasting against the Vhagar account and the Linux Kerberos execution lane provided concrete validation of the directory-control primitives.

Impact: Two individually valid Active Directory relationships became a complete lateral-movement path when correlated in the graph.

4. KeePass And CredSSP Extend The Credential Chain#

Vhagar's intended workflow repeatedly unlocks a KeePass database containing a higher-value identity. Pentest Copilot represented the credential-store exposure, the interactive host context, and the downstream Drogon identity as one coherent path.

The lab's CredSSP policy then connected that credential context to Balerion's administrative workflow. Instead of treating KeePass, delegated credentials, and WinRM as separate findings, the graph retained their causal order.

Impact: A local credential-store condition on a member server became a privileged domain-controller access path.

5. Privileged WinRM Execution On Balerion#

With the privileged identity path established, Pentest Copilot validated WinRM execution on Balerion, created a service-backed Windows agent running as LocalSystem, and verified both RTCS and message-bus callbacks.

Post-compromise jobs collected privilege context, delegation configuration, directory relationships, and host data. Balerion was then marked compromised in Neo4j, allowing dependent checks and exploit modules to route from verified tier-zero control.

Impact: The campaign reached the domain controller with verified privileged code execution and a SYSTEM-level agent.

Additional Attack Paths And Vulnerability Categories

GLPI Inventory SQL Injection#

The GLPI version and reachable inventory surface matched the affected unauthenticated SQL-injection class. Pentest Copilot connected the application finding to the MySQL service and the database identity used by the deployed application.

Defender takeaway: Patch GLPI promptly, restrict inventory endpoints, and keep the application database reachable only from the application tier.

Privileged LDAP Bind Credentials#

The GLPI deployment used a domain identity for LDAP integration. Once application or database access is available, that identity can become a bridge from the application tier into Active Directory authentication.

Defender takeaway: Use a dedicated least-privilege bind account, rotate it automatically, and prevent application administrators from recovering reusable directory secrets.

Recurring SSH Automation#

The Vhagar-to-Syrax automation path carried a reusable domain identity into a recurring SSH workflow. Pentest Copilot mapped the identity, the source host, and the reachable Linux target as a credential-exposure and remote-execution chain.

Defender takeaway: Replace embedded automation passwords with short-lived keys or managed workload identities and constrain source, destination, and command scope.

Domain-Backed Linux Privilege#

Dracarys maps domain groups into local SSH and sudo policy on Syrax. Pentest Copilot resolved the group membership and validated the resulting root transition.

Defender takeaway: Treat Linux sudo mappings as tiered identity controls, review nested group membership, and alert on new root-capable agents or services.

KeePass Database And Memory Exposure#

The Vhagar workflow stores and repeatedly opens a KeePass database. The campaign treated the file, the unlocking process, and its high-value identity as one credential-access opportunity.

Defender takeaway: Keep privileged vaults off shared administration hosts, use device-bound authentication, and monitor access to vault files and KeePass process memory.

Wildcard CredSSP Delegation#

CredSSP enables legitimate remote administration but also carries reusable credential material into the destination session. Dracarys demonstrates how a broad delegation policy can extend a member-server compromise to tier-zero administration.

Defender takeaway: Avoid wildcard CredSSP targets, use restricted administration endpoints, and separate domain-controller administration from general-purpose servers.

WriteSPN ACL Abuse#

Viserion's extended right on VHAGAR$ allows service identity to be manipulated. Pentest Copilot detected the ACL, represented it as a directed graph edge, and routed targeted Kerberos validation.

Defender takeaway: Audit WriteSPN and GenericWrite rights on computer accounts and alert on unexpected SPN additions or removals.

SPN-Jacking And Constrained Delegation#

The campaign joined WriteSPN with msDS-AllowedToDelegateTo instead of reporting them independently. This correlation is the central Dracarys directory attack: control over where a delegated SPN resolves changes the security meaning of the delegation configuration.

Defender takeaway: Review delegation together with SPN-write permissions; neither dataset is sufficient on its own.

Targeted Kerberoasting#

The WriteSPN primitive also supports targeted Kerberoasting against the Vhagar computer identity. Pentest Copilot generated targeted service-ticket requests and preserved the result as evidence on the same attack-path entity.

Defender takeaway: Use long, rotated computer-account secrets, enforce modern Kerberos encryption, and monitor anomalous service-ticket requests after SPN changes.

Exposed MySQL Application Credentials#

The GLPI database identity permitted authenticated MySQL access on Syrax. Pentest Copilot validated the credential and ran data collection as an exploit step rather than merely reporting an open port.

Defender takeaway: Store application secrets in a managed secret store, rotate them, scope database grants tightly, and restrict MySQL network exposure.

Graph-Driven Agent Orchestration#

Every verified agent was attached to its host entity only after the callback and privilege context were confirmed. That let the campaign route Windows-only, Linux-only, and post-compromise jobs to compatible execution lanes.

Defender takeaway: Correlate service creation, unusual child processes, outbound control channels, and identity events across hosts instead of investigating each alert independently.

Representative Findings Observed In The Campaign#

The Full Chain In One View#

Defensive Priorities#

1. Patch GLPI and isolate its data tier. Remove the application entry point and prevent direct database access from user networks.
2. Rotate and scope application identities. LDAP bind and MySQL credentials should be non-interactive, least-privilege, and managed centrally.
3. Replace reusable SSH automation secrets. Use short-lived, source-bound credentials and narrowly scoped commands.
4. Review Linux domain-group mappings. Treat SSH and sudo authorization as part of the Active Directory tiering model.
5. Remove unnecessary SPN write rights. Audit extended rights on computer objects and alert on SPN mutations.
6. Analyze delegation and ACLs together. Continuously identify SPNs that can be repointed by identities elsewhere in the graph.
7. Constrain CredSSP. Eliminate wildcard delegation and keep privileged Windows administration on dedicated endpoints.
8. Protect credential stores. Keep privileged KeePass databases off shared member servers and monitor vault access.
9. Harden domain-controller remote administration. Restrict WinRM sources, require privileged access workstations, and monitor new services.
10. Use graph-based detection. Prioritize combinations of ordinary permissions that create end-to-end control paths.

Method And Evidence Boundary#

This was a controlled lab assessment. The two initial user credentials were seeded engagement inputs and are not presented as discoveries. The AWS Systems Manager-to-Proxmox workflow supplied authorized lab access and host lifecycle control, while the Dracarys graph, service data, live authentication results, agent registrations, and post-compromise jobs supplied campaign evidence.

For the assumed-breach coverage model, each of the three lab hosts was treated as available at its intended scenario state. This preserves the lab designer's complete attack chain while keeping the source of each prerequisite explicit. Balerion's privileged WinRM execution and LocalSystem agent were live-validated; the Vhagar segment was represented through its intended ACL, SPN, delegation, KeePass, and CredSSP relationships; and Syrax's SSH-to-root transition was verified through agent registration.

Accordingly, 100% coverage means all three in-scope hosts and all eleven documented Dracarys vulnerability families were discovered, correlated, validated, or exercised to the maximum level defined by the assumed-breach scenario. It is a statement about complete scenario-path coverage—not a claim that seeded credentials were independently recovered.

Conclusion#

Dracarys is compact, but its attack graph is rich. The decisive risk does not come from one protocol or one host; it comes from the composition of application secrets, Linux authorization, Active Directory ACLs, Kerberos delegation, credential stores, and remote administration.

Pentest Copilot converted those conditions into one continuous campaign: discover the full estate, gain and elevate execution on Syrax, correlate WriteSPN with constrained delegation, model the credential transition through Vhagar, reach Balerion through privileged WinRM, and establish SYSTEM-level control at the domain tier.

That is full-coverage assumed-breach testing: every intended path is represented, each prerequisite retains provenance, and the graph explains not only what is exposed, but how the environment carries an attacker from an ordinary identity to domain control.

References#

• Game of Active Directory
• Dracarys lab definition
• GLPI security advisory GHSA-jv89-g7f7-jwfg
• Pentest Copilot
• How Pentest Copilot Achieved Full-Coverage Exploitation of NHA Lab