How Pentest Copilot Achieved Full-Coverage Exploitation of NHA Lab

Pentest Copilot entered Ninja Hacker Academy with one database credential and one subnet:

The finished campaign reported five out of five Windows hosts across both Active Directory forests, 78 discovered services, validation of all 47 eligible services, and execution of all 12 assessment lanes. It proved code execution on the SQL server, SYSTEM on two member servers, directory ACL abuse in the academy domain, traversal of the bidirectional forest trust, and mapping of the certificate-services objects that completed the lab's second-forest path.

This is what full-coverage exploitation meant for the NHA campaign: every known host and forest was reached, every eligible service was tested against the seeded identity, every planned validation lane completed, and the lab's major exploitation families were connected into one evidence-backed chain.

Why NHA is a coverage test, not a vulnerability count#

Ninja Hacker Academy is a challenge in the GOAD Active Directory lab family maintained by Orange Cyberdefense. The project lists NHA as five virtual machines across two domains, without a supplied schema. The environment is deliberately vulnerable and designed for isolated practice.

NHA differs from a lab that exposes many independent flaws. Its weaknesses form dependencies. Missing one identity, permission, delegation relationship, or trust edge can stop the rest of the chain.

That makes three coverage dimensions important:

1. Surface coverage: were all reachable hosts and services discovered?
2. Decision coverage: did every eligible service receive a clear accepted, rejected, or inconclusive credential result?
3. Path coverage: were the identities and control relationships joined far enough to prove the designed attack paths?

A scanner can satisfy part of the first dimension. A password checker can satisfy part of the second. Full NHA exploitation required all three.

The starting credential was a precondition#

NHA's intended human path obtains the database credential from the IIS application's configuration. Pentest Copilot was running an internal assessment rather than a web application assessment, so the sa credential was supplied directly.

That substitution matters when reading the result. The campaign did not claim that it discovered an exposed web configuration. It treated the credential as the assumed-breach starting position and tested everything downstream from it.

The credential was attached to the subnet as an explicit piece of campaign evidence. This preserved the origin of every later edge:

Without that provenance, a report can blur supplied access and recovered access. NHA coverage depended on the former.

Discovery established the complete visible estate#

Before using the credential, the campaign found five Windows hosts across two forests and enumerated 78 services.

The host comparison produced a finding before exploitation. sql exposed three times the service surface of its member-server peers, including MSSQL and a long tail of RPC ports. The campaign interpreted that asymmetry as a network-visible host-hardening gap consistent with a disabled firewall.

The evidence was comparative. Domain controllers were expected to expose broad directory infrastructure. Three similar member servers were expected to look more alike. The outlier mattered because role and exposure did not match.

Twelve lanes turned discovery into decision coverage#

Pentest Copilot then evaluated the visible estate through 12 lanes:

• SMB, WinRM, WMI, and RDP;
• LDAP and user enumeration;
• MSSQL, MySQL, FTP, and SSH;
• Kerberoasting;
• MSSQL vulnerability checks.

The seeded credential was eligible for 47 service checks. Forty-six rejected it. One accepted it.

Those rejections were part of full coverage. For example, a rejected WinRM decision proved that sa was not a reusable remote-management identity on that host; it did not imply that WinRM itself was unreachable. Across the matrix, the evidence showed that the identity was local to SQL Server and constrained its scope before any broader claim was made.

The one acceptance was enough because the account held sysadmin authority on the SQL instance. Pentest Copilot continued past “login succeeded” and enumerated server principals, roles, and relevant configuration. It found seven sysadmin logins, including a domain user and a leftover provisioning identity, and established operating-system command execution through the database service context.

The transition was therefore:

Authentication was only the first edge. Authorization and execution created the identity needed for the rest of the lab.

The SQL machine identity opened the web host#

The SQL server's computer account controlled the directory container holding neighboring computer objects. That authority allowed a resource-based constrained delegation relationship to be written onto web.

Microsoft documents that msDS-AllowedToActOnBehalfOfOtherIdentity participates in access checks for acting on behalf of identities to services running as an account. In the NHA chain, writable control of the target computer object turned that relationship into an impersonation path.

The campaign then authenticated to web, identified a writable scheduled-task command path used by a SYSTEM service, changed the controlled path, and observed execution as SYSTEM.

This route bypassed the web application entirely. Patching NHA's intended application entry would not have removed the machine-account ACL or local task weakness. Coverage joined the directory and host controls instead of treating them as separate findings.

Delegation opened the share host through a different identity#

share did not reuse the resource-based delegation path. It was reached through the domain user learned from SQL Server.

The account's constrained-delegation configuration allowed protocol transition. The campaign obtained a service ticket on behalf of another identity, reached the permitted target, and demonstrated that changing the service class widened access on the second hop. That produced privileged access to share.

Local enumeration then found another writable scheduled-task command path and established SYSTEM on the host. The result also provided the authorized-host position relevant to the group-managed service account path.

This mattered for path coverage. Two member servers ended at SYSTEM, but the upstream authorities were different:

Collapsing them into one “delegation issue” would hide both remediation paths.

Directory collection exposed the academy control plane#

With authenticated positions established, Pentest Copilot collected users, groups, containers, access control lists, delegation attributes, and trust configuration from the academy domain.

The result included dangerous GenericAll, WriteDacl, and WriteOwner relationships. The campaign did not stop at listing them. It walked abuse paths and proved directory-level control, including rights involving AdminSDHolder.

Microsoft describes AdminSDHolder as the template for permissions applied to protected domain accounts and groups. Control of that object can therefore persist beyond one account because protected permissions are reapplied from the template.

The academy-domain coverage also identified constrained, unconstrained, and resource-based delegation. The value was not three labels in a report. It was proof that multiple identity-control systems converged on the same reachable hosts and privileged accounts.

The forest trust extended coverage to NINJA-CA#

The two domain controllers exposed a bidirectional trust between academy.ninja.lan and ninja.hack. Pentest Copilot enumerated the trust from both sides, authenticated across it, and collected the second forest's directory from dc-vil.

Certificate-services enumeration then mapped the NINJA-CA root CA, enterprise CA, NT authentication store, and published templates. The campaign followed the relevant directory rights through controlled users and groups to the writable SignatureValidation template, then described the certificate escalation path from template control to privileged authentication.

The important boundary was the forest transition:

Reaching dc-vil was not counted as coverage merely because the host answered. The campaign connected trust authentication, second-forest identity data, and certificate authority control objects.

What “full coverage” included#

The published campaign grouped its completed exploitation coverage into ten families:

• credential validation across the service estate;
• MSSQL authorization and command execution;
• local privilege escalation on web and share;
• constrained delegation;
• resource-based constrained delegation;
• dangerous directory ACLs and AdminSDHolder;
• group-managed service account password exposure;
• Kerberos roasting opportunities;
• bidirectional forest-trust abuse;
• Active Directory Certificate Services template control;
• plus the network-visible firewall and host-exposure gap.

Some paths produced direct code execution or SYSTEM. Others produced recovered material, directory control, a privileged ticket, trust reachability, or a mapped certificate escalation path. The campaign kept those outcomes distinct while connecting their dependencies.

Full coverage did not mean firing every public exploit or enumerating every theoretical vulnerability. The source page states that no step required a public exploit or unpatched service. Credentials, permissions, delegation flags, local task configuration, and trust relationships supplied the chain.

Why this was more than a graph#

An identity graph can show that one principal appears to control another object. Exploitation coverage requires evidence that the relationship works in the assessed environment.

For each important transition, the NHA campaign retained the starting identity, target service or object, authorization relationship, executed proof, resulting authority, and the next edge it unlocked. Failed credential checks also stayed in the coverage record instead of disappearing.

That produces a stronger completion rule:

A host is not covered when it is merely discovered. A path is not covered when it is merely inferred. Coverage is complete when the planned decisions have outcomes and the claimed exploitation edges have evidence.

Methodology and review scope#

This article is a technical rewrite of the public Pentest Copilot NHA campaign. The NHA topology was checked against the Orange Cyberdefense GOAD repository, and the delegation and protected-object explanations were checked against Microsoft documentation.

The article preserves the campaign's published counts, host outcomes, validation lanes, and identity transitions. It does not expose exploit commands, payloads, credentials, private implementation names, or private campaign artifacts.

Limitations#

The campaign counts and exploitation results come from the published NHA page. This rewrite did not independently replay the run or inspect its private evidence store.

NHA is an intentionally vulnerable isolated lab. Full coverage of this campaign does not imply that every enterprise uses the same protocols or contains the same paths. It also does not mean every possible NHA vulnerability was tested. Here, full coverage is limited to the five-host, two-forest inventory, the 47 eligible service validations, the 12 defined lanes, and the exploitation families reported by the campaign.