Summary And What To Expect#

PCE started from the internal subnet 192.168.56.0/24. From that scope it identified the GOAD Windows hosts, mapped the exposed services, and built verified attack chains across three domains:

The main compromise paths covered below show how PCE moved from one-click setup to domain-level impact:

1. winterfell: Responder captured robb.stark, cracking produced sexywolfy, validation showed privileged access, and PCE dumped NORTH domain NTDS.
2. castelblack: SMB user enumeration on winterfell exposed samwell.tarly:Heartsbane, and that recovered credential was then accepted on castelblack for RDP and MSSQL xp_cmdshell execution through impersonation. A separate NTDS-derived NORTH Administrator hash path also led to WMI and WinRM PowerShell execution on the same host.
3. kingslanding: NORTH domain compromise exposed eddard.stark material, which enabled parent-child trust abuse into sevenkingdoms.local and administrator-backed WinRM command execution on the parent domain controller.
4. meereen: AS-REP roasting exposed missandei, cracking produced fr3edom, and ADCS ESC1 produced ESSOS Administrator material.
5. braavos: PCE reached the host through ESSOS administrator material and independently proved SQL linked-server command execution as essos\sql_svc.

The second half covers additional vulnerability categories PCE identified: SMB shares, domain trusts, trust-ticket and golden-ticket class risk, ADCS, ACLs, delegation, RBCD, NTDS and DCSync-class credential exposure, MSSQL lateral movement, and PrintNightmare exposure.

In customer terms, this was not five manual demos. It was a single campaign that moved across the whole lab and connected the attack paths customers expect an automated internal pentest to cover.

Coverage At A Glance#

The strongest customer-facing claim is specific: PCE delivered 100% coverage of the GOAD Windows host and domain scope, then exercised the major GOAD attack-path families from the same campaign.

The important distinction is that PCE did not require a hand-written route for each weakness. The same campaign discovered, validated, and chained the paths.

What Is GOAD?#

Game of Active Directory is a deliberately vulnerable Active Directory lab maintained by Orange Cyberdefense. It is designed to exercise realistic identity attack paths rather than single-host vulnerability checks.

The GOAD lab has five important Windows hosts:

GOAD matters because the attack paths are familiar to real enterprise defenders: SMB, LDAP, Kerberos, WinRM, WMI, RDP, MSSQL, ADCS, delegation, ACLs, and domain trusts. It is a useful benchmark because the question is not whether a tool can find one weak password. The question is whether it can cover the full range and keep chaining.

Why This Matters#

Active Directory compromise is usually a chain, not one isolated finding.

A responder capture becomes a cracked password. A cracked password becomes privileged SMB, WMI, WinRM, or RDP access. Privileged access to a domain controller becomes NTDS extraction. NTDS material becomes trust abuse and administrator-backed command execution. ADCS turns a low-privileged user into domain admin. SQL Server links become command execution on another host.

That is what PCE demonstrated in this benchmark. It did not stop at saying a weakness existed. It kept asking the next question: what does this credential, permission, ticket, certificate, service, or trust relationship unlock?

That is also where the 100% coverage message matters. PCE discovered every GOAD Windows host in scope, mapped every domain in the lab, reached every domain controller in the campaign story, and exercised the major attack-path families GOAD is built to teach: credential exposure, roasting, cracking, protocol validation, SQL abuse, ADCS, trust abuse, ACLs, delegation, SMB exposure, and DC credential extraction.

What Discovery Gave Us#

PCE first identified the live hosts in 192.168.56.0/24, then mapped the services that mattered for identity attack paths.

Main Compromise Paths

1. WINTERFELL: Responder To NORTH Domain Controller Compromise#

winterfell was the domain controller for north.sevenkingdoms.local.

PCE captured a NetNTLMv2 hash for north\robb.stark through the responder lane. The hash was cracked to the plaintext password sexywolfy. PCE then validated the credential across exposed remote services. On winterfell, the credential had privileged access over SMB, WMI, WinRM, and RDP.

That access was not treated as magic. The AD data showed why robb.stark mattered: the account was a member of the NORTH built-in Administrators group, had a session on winterfell, owned the NORTH Domain Admins group, and had additional write-control edges around tier-zero groups. In practical terms, the credential was not just valid. It carried domain-controller administrative reach.

PCE then used robb.stark:sexywolfy to dump NTDS from winterfell. This is a DC credential-extraction path, not a generic claim that every valid user had DCSync. The chain confirmed robb.stark authenticated to winterfell over SMB, NTDS extraction ran, and the output included the NORTH Administrator hash.

PCE validated that NORTH Administrator hash over SMB, WMI, and WinRM on NORTH systems, then used it for PowerShell execution through WMI on winterfell and through WMI and WinRM on castelblack.

The important source relationship is straightforward:

Impact: PCE moved from a network authentication capture to privileged access on the NORTH domain controller, then to domain credential extraction.

2. CASTELBLACK: WINTERFELL SMB User Enumeration, SQL Execution, And Admin-Backed RCE#

castelblack was a member server in north.sevenkingdoms.local.

PCE discovered the credential samwell.tarly:Heartsbane during SMB user enumeration against winterfell, the NORTH domain controller. The netexec smb 192.168.56.11 --users output listed samwell.tarly and exposed Password : Heartsbane in the description field. PCE then validated the recovered credential against castelblack, where it provided RDP access and MSSQL access.

On MSSQL, PCE found that samwell.tarly could impersonate sa. That allowed xp_cmdshell to be enabled, and PCE proved operating system command execution as north\sql_svc.

Separately, PCE chained the winterfell NTDS result into CASTELBLACK. The flow was: Responder produced robb.stark, cracking produced sexywolfy, Robb's NORTH privilege context allowed NTDS extraction from winterfell, and that NTDS output included the NORTH Administrator hash. PCE then validated the Administrator hash against castelblack over SMB, WMI, and WinRM, and used WMI and WinRM to execute PowerShell.

Impact: CASTELBLACK had three separate paths of consequence: RDP access from exposed AD metadata, SQL service-account execution through MSSQL impersonation, and administrator-backed WMI/WinRM command execution from the NORTH NTDS chain.

3. KINGSLANDING: NORTH Compromise To Parent-Domain Trust Abuse#

kingslanding was the domain controller for the parent domain sevenkingdoms.local.

The clean chain into kingslanding started with the winterfell compromise. After PCE dumped NORTH domain credential material, the NTDS output included eddard.stark NTLM material. PCE also identified the parent-child trust from north.sevenkingdoms.local to sevenkingdoms.local.

Using the recovered NORTH material and the discovered trust relationship, PCE performed parent-child trust abuse and obtained sevenkingdoms.local Administrator NTLM material. That administrator material was then validated against kingslanding over privileged services.

PCE then used the sevenkingdoms.local\Administrator NTLM material over WinRM on kingslanding and executed PowerShell.

Impact: Compromise of the child domain became administrator-backed command execution in the parent domain.

4. MEEREEN: AS-REP Roasting To ADCS ESC1 And ESSOS Administrator#

meereen was the domain controller for essos.local.

PCE identified missandei as AS-REP roastable. It captured AS-REP material, cracked the password to fr3edom, and used the credential to interact with ESSOS certificate services.

The ADCS path was ESC1. The vulnerable certificate template allowed a requester to supply an alternate identity suitable for client authentication. PCE used missandei:fr3edom to request a certificate for administrator@essos, authenticated with the resulting certificate, and recovered the ESSOS Administrator NTLM hash.

Impact: A roastable user plus a vulnerable certificate template produced ESSOS domain administrator material.

5. BRAAVOS: ESSOS Administrator Material And Linked SQL Execution#

braavos was a member server in essos.local.

PCE reached BRAAVOS through two important routes.

First, the ESSOS Administrator material recovered through ADCS represented privileged control over ESSOS domain systems, including BRAAVOS. PCE validated that the same ESSOS administrator material had privileged access to ESSOS systems during the campaign.

Second, PCE proved an independent SQL path into BRAAVOS. The chain started in NORTH. PCE found brandon.stark through AS-REP roasting and cracked it to iseedeadpeople. PCE also found jon.snow through Kerberoasting and cracked it to iknownothing. Those NORTH identities were useful in SQL paths involving castelblack. From there, PCE found a linked-server route into BRAAVOS and enabled xp_cmdshell, proving command execution as essos\sql_svc.

Impact: BRAAVOS was reachable through ESSOS administrator material, and PCE separately proved SQL linked-server command execution on the BRAAVOS side.

Additional Attack Paths And Vulnerability Categories

SMB Shares And Anonymous SMB#

PCE identified SMB share exposure and anonymous SMB access. These findings matter because shares often contain scripts, deployment files, certificates, configuration data, or operational documents that turn a low-level foothold into better credentials.

The campaign identified anonymous SMB access on BRAAVOS and CASTELBLACK. It also identified readable or writable shares, including administrative, logon, public, and certificate-related shares, depending on the credential used.

Defender takeaway: share findings should not be treated as file-system noise. They are often where attackers find the next credential, script, certificate, or deployment secret.

Domain Trust Abuse#

PCE identified the trust path from north.sevenkingdoms.local to sevenkingdoms.local and proved that recovered child-domain material could be used to obtain parent-domain administrator material.

Defender takeaway: a child domain is not a safe blast-radius boundary when trust relationships and credential material allow escalation into the parent.

Trust Tickets And Golden-Ticket Class Risk#

PCE identified trust-ticket and Kerberos escalation risk tied to recovered trust and domain material. The strongest verified chain in the benchmark was parent-child trust abuse that produced parent-domain administrator material. PCE also identified trust-ticket style exposure in the environment.

This is a golden-ticket class risk because once krbtgt or inter-domain trust material is exposed, defenders are no longer dealing with one compromised host. They are dealing with identity infrastructure that can mint or accept forged authentication material.

Defender takeaway: ordinary password resets are not enough after krbtgt or trust material exposure. Kerberos keys and trust secrets need a deliberate rotation plan.

ADCS#

The clearest ADCS path was ESC1 in ESSOS:

PCE also identified broader certificate-service risk classes in the environment, including multiple ESC categories. The proven customer-facing chain is ESC1 to ESSOS Administrator through missandei.

Defender takeaway: ADCS is tier-zero infrastructure. Template permissions, enrollee-supplied subject settings, EKUs, enrollment rights, and CA exposure should be reviewed like domain controller security controls.

ACL Abuse#

PCE identified dangerous Active Directory permissions such as GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, and ReadLAPSPassword.

These are high-value findings because they often represent privilege escalation without an exploit binary. The attacker abuses the directory's own authorization model.

Defender takeaway: AD object permissions are attack surface. Privileged groups, computer objects, service accounts, and certificate-service objects need regular ACL review.

Delegation And RBCD#

PCE identified constrained delegation, unconstrained delegation, and resource-based constrained delegation exposure across the lab.

Delegation findings matter because they let attackers impersonate users to services, capture delegated Kerberos material, or configure machine-account based access.

Defender takeaway: delegation should be rare, documented, and scoped. Computer objects with delegation rights deserve the same scrutiny as privileged users.

NTDS, DCSync-Class Risk, And DC Credential Extraction#

The strongest NTDS path in this write-up is the NORTH domain controller path:

Defender takeaway: once NTDS is extracted, the incident changes from host compromise to domain compromise. Response must include credential rotation, privileged account review, Kerberos key rotation where needed, and trust review.

For defenders, this belongs in the same risk family as DCSync: a domain-level path has crossed into directory credential material. The exact mechanism matters for remediation, but the business impact is domain credential exposure.

MSSQL Lateral Movement#

PCE identified MSSQL paths that went beyond login success. It followed impersonation, linked servers, and xp_cmdshell to prove command execution.

Defender takeaway: SQL Server belongs in Active Directory attack modeling. Linked servers and impersonation can turn one database login into cross-host execution.

PrintNightmare Exposure#

PCE identified PrintNightmare-style exposure on multiple Windows systems. In an environment where valid credentials already exist, exposed print spooler attack surface increases the number of available privilege and lateral movement routes.

The clearest RCE proof for this category was meereen: PCE recorded SYSTEM-level execution through PrintNightmare on 192.168.56.12. PCE also identified PrintNightmare exposure on NORTH systems such as castelblack, where the same campaign already had administrator-class credential paths.

Defender takeaway: print spooler exposure on servers and domain controllers should be minimized. Where the service is not needed, disable it.

Representative Findings Observed In The Campaign#

The headline chains are only part of the coverage. The table below intentionally lists findings we tied to PCE campaign evidence, not raw GOAD expected-lab entries.