Pentest Copilot ran an assumed-breach internal assessment against Ninja Hacker Academy (NHA) from a single internal subnet. The assessment used two manually seeded Secret entities as separate assumed-breach positions: the local MSSQL principal sa for the first round, followed by the domain identity frank for the second round. It received no host list, privileged account inventory, trust map, or hand-written attack route.

Across those two assumed-breach positions, the campaign discovered every Windows host in scope, mapped both Active Directory forests, proved code execution and SYSTEM-level impact on the member servers, worked the directory's own permissions, crossed the bidirectional forest trust, and mapped the certificate-services path on the second forest.

The result was not a collection of five isolated demonstrations. It was a two-round assumed-breach campaign: round one measured the blast radius of the seeded sa credential, while round two used a separately seeded Secret for the domain identity discovered through SQL. The graph preserved each starting assumption separately so that seeded access was not confused with credentials extracted by the assessment.

Summary And What To Expect#

The engagement began on 192.168.57.0/24 with the local MSSQL principal sa attached to the subnet root as a first-class Secret entity:

The sa node was the first of two manually seeded Secrets. After SQL enumeration identified academy\frank as a privileged domain login, a second Secret was added to represent that next assumed-breach position.

These seeded Secrets model an assumed-breach assessment. They do not ask whether the platform can break into the environment from the internet. They ask a more useful internal-security question: from each explicitly supplied attacker position, how far can the environment carry the assessment?

Pentest Copilot answered that question across all five NHA Windows systems:

Coverage At A Glance#

Coverage claims are useful only when the denominator is visible. This campaign's scope and execution were:

The twelve validation lanes covered SMB, WinRM, WMI, RDP, LDAP, MSSQL, MySQL, FTP, SSH, user enumeration, Kerberoasting, and MSSQL-specific vulnerability checks.

That distinction matters. Pentest Copilot did not receive a preselected route for each lab weakness. The campaign discovered the environment, tested the credential consistently, wrote the results into the exploit graph, and used those results to decide what to do next.

What Is NHA?#

Ninja Hacker Academy is a deliberately vulnerable Active Directory challenge maintained by Orange Cyberdefense as part of the GOAD project.

GOAD is designed to contain a large number of weaknesses. NHA is deliberately different: it has fewer findings, but each is intended to be a required link in a longer chain. The stated objective is domain administrator in both academy.ninja.lan and ninja.hack. Its Windows systems are patched and Defender is enabled, so the lab rewards identity attack paths rather than reliance on public exploits.

The five hosts are split across two forests:

The intended human route begins at the application on web. That application stores the privileged SQL connection credential in its configuration. Web-application testing and exploitation were explicitly out of scope for this internal assessment. Pentest Copilot did not exploit the IIS application or retrieve the credential from it; instead, the same database credential was manually supplied as the first assumed-breach Secret.

That boundary is important. The correct claim is not that the internal assessment exploited the application to steal sa. The first round measured the internal blast radius after sa had been supplied. A separate second round began from the seeded frank domain position discovered through SQL.

Why This Matters#

An Active Directory breach rarely depends on one dramatic vulnerability. It is normally a sequence of legitimate features used in the wrong security context:

• A database login reveals a privileged domain identity.
• Database command execution supplies a machine-account context.
• A computer object has excessive control over a directory container.
• Resource-based constrained delegation turns that control into impersonation.
• A scheduled task with a writable command path turns host access into SYSTEM.
• Constrained delegation opens a host the starting credential could not access directly.
• ACLs expose escalation and persistence paths without an exploit binary.
• A forest trust extends the blast radius into a second identity boundary.
• Certificate-template control turns directory authorization into authentication material.

Traditional scanners tend to report those items separately. The meaningful result is the path that joins them.

What Discovery Gave Us#

Before using the seeded credential, Pentest Copilot mapped the live systems and 78 exposed services on the subnet.

sql exposed three times as many services as its sibling member servers. In addition to TCP/1433, it presented a long tail of ephemeral RPC ports that web and share did not expose.

That asymmetry is what a disabled or ineffective host firewall looks like from the network. No registry read was required. Peer comparison made the hardening gap visible during discovery.

Main Compromise Paths

1. SQL: One Credential Owned The Database Tier On Arrival#

The seeded sa credential was validated against 47 services on all five hosts through the same twelve lanes. Forty-six services rejected it, which is the expected behavior for a local SQL Server principal. The one acceptance was MSSQL on 192.168.57.22:1433.

That one successful login was enough to enumerate the authorization surface of SQL\SQLEXPRESS:

• Seven sysadmin logins were identified.
• The list included the domain user academy\frank.
• The local provisioning account SQL\vagrant was also still a sysadmin.
• xp_cmdshell was enabled and operating-system command execution was proven in the SQL Server service context.

The appearance of academy\frank is strategically important. Pentest Copilot learned that a domain identity administered the database without first querying a domain controller. Database login tables are often a partial mirror of the directory's privileged population.

Impact: one local database credential produced a complete view of the SQL authorization tier, named the next high-value domain identity, and reached operating-system execution without a separate privilege-escalation step.

2. WEB: The Directory Opened A Door The Application Patch Would Not Close#

NHA's intended route reaches web through its IIS application. Pentest Copilot reached the same host through Active Directory.

The SQL$ computer account had GenericAll over the default Computers container in academy.ninja.lan. That right allowed the campaign to modify a target computer object's msDS-AllowedToActOnBehalfOfOtherIdentity attribute and configure resource-based constrained delegation (RBCD).

With RBCD in place, the controlled machine context could impersonate a privileged identity to services on web. Authenticated host access then exposed a scheduled task whose command path was writable. Replacing that path and allowing the task to execute produced SYSTEM.

Impact: fixing the web application alone would not have removed this route. Excessive directory permissions on the computer container independently opened the host and led to SYSTEM.

3. SHARE: Constrained Delegation Became Full Host Access#

The starting sa principal had no direct privileged access to share. The domain identity discovered through SQL did.

academy\frank was trusted to authenticate for delegation and allowed to delegate to an eventlog service on share. With protocol transition enabled, this becomes an impersonation primitive: the delegating account can request a service ticket on behalf of another user.

Kerberos does not cryptographically bind the service class in the second ticket as tightly as many administrators assume. The campaign changed the service class for the same host, widened the usable access, and reached share with privileged context. Local privilege-escalation enumeration then found another writable scheduled-task command path, which led to SYSTEM.

Impact: a delegation flag on an ordinary domain user became access to a host the starting credential could not reach, SYSTEM on that host, and a new identity-escalation position.

4. DC-AC: Privilege Escalation Through Active Directory's Own Authorization Model#

With authenticated footholds established, Pentest Copilot collected the academy.ninja.lan directory from dc-ac and modeled users, groups, computers, containers, delegation attributes, trusts, and ACLs.

The important paths did not depend on an unpatched service. They depended on directory rights such as:

• GenericAll over computer and container objects.
• WriteDacl over users and privileged objects.
• WriteOwner over groups and persistence targets.
• ForceChangePassword over controlled user principals.
• Rights over AdminSDHolder, whose protected ACL is periodically reapplied to privileged accounts and groups.

AdminSDHolder is particularly consequential. A malicious permission placed there can return after defenders clean an individual protected object's ACL, creating persistence inside the directory's own maintenance behavior.

Impact: the campaign established directory-level escalation and persistence paths by using the permissions NHA was configured to grant, not by dropping an exploit binary on the domain controller.

5. DC-VIL: Crossing The Forest Trust And Reaching NINJA-CA#

NHA contains a bidirectional trust between academy.ninja.lan and ninja.hack. Pentest Copilot enumerated that relationship from both sides, crossed the forest boundary, reached dc-vil, and collected the second directory.

Certificate-services enumeration then mapped the NINJA-CA object set: the root CA, enterprise CA, NT authentication store, published templates, enrollment rights, and template ACLs.

The critical escalation route was:

1. olivia.davis held WriteDacl over rachel.philips.
2. rachel.philips managed and belonged to the Sanin group.
3. Sanin held GenericAll over Jonin.
4. Jonin controlled the published SignatureValidation certificate template.
5. Template control allowed an ESC4-style rewrite: add a client-authentication EKU and allow the enrollee to supply the subject.
6. The rewritten template behaved as an ESC1 path, allowing enrollment for a privileged identity.
7. PKINIT with the resulting certificate completed the route to forest-administrator material.

Impact: the original database credential ultimately reached a second forest and a certificate-based path to its highest-value identity tier.

Additional Attack Paths And Vulnerability Categories

The campaign's findings are best understood as one ordered attack path rather than a catalogue of unrelated weaknesses. The route began with the seeded SQL credential, used the resulting database and machine context to identify the next identity and directory relationships, converted those relationships into access on web and share, then followed directory authorization, forest trust, and certificate-template control toward the second forest. Each stage below explains what Pentest Copilot learned and how that result informed the next decision.

MSSQL Authorization And Command Execution#

Step 1 — establish the first execution context. The seeded sa Secret authenticated only to MSSQL on sql. Pentest Copilot then enumerated server principals, role membership, configuration, and execution primitives. That work exposed academy\frank as a domain identity with sysadmin access and used xp_cmdshell to move from database administration into the SQL Server service context. The result supplied both the next identity to investigate and the SQL$ machine context used by the following directory path.

Defender takeaway: review sysadmin membership on every SQL instance, remove provisioning leftovers, disable xp_cmdshell where it is not explicitly required, and treat domain accounts in SQL roles as part of the AD privilege model.

Resource-Based Constrained Delegation#

Step 2 — turn the SQL machine context into access on web. The graph connected SQL$ to excessive control over the Computers container. Pentest Copilot followed that permission to the computer object for web, where resource-based constrained delegation provided the impersonation route. This was the bridge from the database host into a second member server; it was not a separate, disconnected RBCD finding.

Defender takeaway: include computer principals when reviewing ACL sources. Restrict who can create or modify computer objects, and alert on changes to msDS-AllowedToActOnBehalfOfOtherIdentity.

Constrained Delegation With Protocol Transition#

Step 3 — use the domain identity to open share. SQL enumeration identified academy\frank, and the directory graph showed that this identity was trusted for protocol transition to an eventlog service on share. Pentest Copilot treated the delegation target as a host-level opportunity rather than stopping at the configured service name: service-class substitution widened the usable ticket and provided the route into share.

Defender takeaway: constrained delegation should be rare, documented, and reviewed for protocol transition. Treat the allowed host—not only the listed service class—as the potential blast radius.

Writable Scheduled-Task Paths#

Step 4 — convert host access into local privilege escalation. Once the RBCD and constrained-delegation branches reached web and share, Pentest Copilot ran local privilege-escalation checks from those authenticated positions. Both hosts exposed an elevated scheduled task whose command path was writable from the obtained context. Those task paths were the conversion point from delegated service access to SYSTEM-level impact.

Defender takeaway: audit the executable, script, and every parent directory referenced by privileged scheduled tasks. A correctly permissioned task definition does not help if the invoked path is writable.

Kerberos Roasting#

Parallel credential branch — strengthen or recover the domain position. While the primary route continued through delegation, Pentest Copilot also identified SPN-bearing identities such as frank and sql_svc. Kerberoasting represented a parallel way to obtain reusable domain credentials if the delegation path stalled; it supported the same objective rather than forming an unrelated finding.

Defender takeaway: use long, randomly generated passwords or managed service identities for service accounts, remove unused SPNs, and monitor unusual ticket requests.

ACL Abuse And AdminSDHolder#

Step 5 — move from member-server footholds into directory control. With authenticated positions established, Pentest Copilot collected the directory graph and chained GenericAll, WriteDacl, WriteOwner, and password-reset relationships toward privileged users, groups, containers, and AdminSDHolder. The important result was not the number of ACL findings; it was the order in which one controllable principal exposed the next privileged object.

Defender takeaway: review privileged-object ACLs and AdminSDHolder together. Cleaning only the visible target can leave the mechanism that restores the malicious permission.

Forest Trust Abuse#

Step 6 — carry the directory path across the forest boundary. The bidirectional trust connected the Academy escalation path to ninja.hack. Pentest Copilot followed that relationship instead of treating the first domain as the end of the assessment, then used the far-side identities and ACLs as new graph inputs for the route to dc-vil.

Defender takeaway: a bidirectional trust creates a shared blast radius. Use selective authentication where possible, review SID filtering and trust direction, and monitor cross-forest logons as tier-zero activity.

ADCS Template Control#

Step 7 — convert second-forest authorization into authentication material. On the far side of the trust, the ACL chain reached Jonin, which controlled the published SignatureValidation template. Pentest Copilot connected that template-control edge to an ESC4-style rewrite and the resulting ESC1 conditions. This was the final transition in the attack story: directory control became a certificate path capable of representing a privileged identity.

Defender takeaway: review template ACLs, EKUs, enrollee-supplied subject settings, issuance requirements, publication state, and enrollment rights together. ADCS belongs in the tier-zero security model.

Host Exposure And Hardening Gaps#

Discovery context — why sql became the first high-value node. Before credential use, the service graph showed sql exposing three times the network surface of its sibling member servers, including MSSQL and a wide RPC range. That asymmetry focused the first credential-validation decision on the database tier and provided the network context for the attack path that followed.

Defender takeaway: compare similar hosts. Peer outliers often reveal disabled firewalls, unneeded listeners, or inconsistent segmentation faster than a configuration checklist.

Representative Findings Observed In The Campaign#

The Full Chain In One View#

No step in this chain required an internet-facing zero-day. The environment supplied the path through credentials, role assignments, object permissions, delegation flags, trust configuration, and certificate-template control.

Defensive Priorities#

If this were a production estate, remediation should follow attack-path leverage rather than raw finding count:

1. Remove excessive computer-container control from SQL$ and audit all RBCD attributes.
2. Remove unnecessary domain users and provisioning accounts from MSSQL sysadmin; restrict or disable xp_cmdshell.
3. Correct the writable paths used by privileged scheduled tasks on web and share.
4. Remove protocol-transition delegation from ordinary user accounts and review every allowed target host.
5. Clean dangerous ACLs on privileged users, groups, containers, and AdminSDHolder.
6. Review the bidirectional forest trust and adopt selective authentication where operationally possible.
7. Remove unneeded control over the SignatureValidation template and perform a full ADCS tier-zero review.
8. Restore host-firewall consistency and reduce exposed services on sql.

This order cuts the links that join the chain before addressing lower-leverage observations.

Method And Evidence Boundary#

This write-up describes a controlled, authorized lab campaign. It distinguishes the supplied starting position from what the internal assessment discovered:

• The sa credential was manually seeded for round one; it was not extracted by a web-exploitation lane, because web-application exploitation was out of scope.
• A second Secret was manually seeded for the frank domain position in round two.
• Hosts, services, validation results, directory objects, ACLs, delegation settings, trust relationships, and certificate-services objects were discovered during the broader campaign.
• Code execution and SYSTEM-level results were treated as verified only when an execution path completed.
• Exposure observations, such as the service-count anomaly on sql, are reported as discovery evidence rather than invented host-configuration reads.

That provenance is the reason the exploit graph matters. It preserves the difference between a starting assumption, an observed weakness, an attempted exploit, and a verified consequence.

Conclusion#

NHA is difficult because every missed relationship can stop the chain. Pentest Copilot used two explicitly seeded assumed-breach positions rather than presenting the second identity as a credential extracted by the first round: first sa, then a separate Secret for frank. Across those positions, the assessment kept asking the next operational question: where does this access work, what context does it provide, what can that identity modify, which host does that unlock, and which trust or certificate path comes next?

The campaign covered all five Windows hosts, both forests, every member server, both domain controllers, and the major attack-path families the lab is designed to teach.

That is the value of an autonomous internal assessment: not a longer list of findings, but a reproducible explanation of how one realistic foothold becomes enterprise-wide identity compromise.

References#

1. Ninja Hacker Academy README — Orange Cyberdefense
2. GOAD project — Orange Cyberdefense
3. Pentest Copilot vs Ninja Hacker Academy — campaign overview
4. Pentest Copilot Enterprise vs GOAD — full-lab attack-path coverage
5. Pentest Copilot Enterprise