Game of Active Directory (GOAD) is an intentionally vulnerable Active Directory lab environment built with Vagrant and VirtualBox. It simulates a multi-domain enterprise forest — inspired by Game of Thrones — spanning three domains: sevenkingdoms.local, north.sevenkingdoms.local, and essos.local.
This walkthrough covers the initial attack path: setting up the lab environment, performing network and service enumeration, harvesting valid user accounts via SMB and RPC, validating them against Kerberos, and finally exploiting an AS-REP Roasting misconfiguration to crack a domain user's password offline.
Network Setup & Configuration
Before launching any offensive activity, we need to ensure our attacker machine can resolve the lab's domain names. We manually configure /etc/hosts to statically map domain controllers and servers to their IP addresses.
We also update /etc/resolv.conf to point DNS resolution at the lab's Domain Controller, ensuring that domain lookups resolve correctly during our enumeration.
Network Reconnaissance
With connectivity established, we run a comprehensive Nmap scan across the target subnet (192.168.56.10–12, 22–23) using aggressive options to enumerate open ports, running services, OS fingerprints, and service banners.
sudo nmap -p- -sC -sV -oA full_goad 192.168.56.10-12,22-23 -Pn -vvv
Key findings from the scan include Kerberos on port 88, SMB on 445, LDAP on 389/636, and WinRM on 5985 — all classic indicators of Active Directory domain controllers.
SMB Enumeration with CrackMapExec
With the attack surface mapped, we pivot to SMB enumeration. CrackMapExec (CME) allows us to quickly probe the entire subnet for SMB shares, domain info, signing status, and OS versions — all without credentials.
Extending the scan with the --users flag against the primary Domain Controller (192.168.56.10) dumps a list of valid domain user accounts — a goldmine for subsequent attacks.
RPC & Null Session Enumeration
RPC provides another unauthenticated attack vector. Using enum4linux and rpcclient, we establish null sessions against the target (192.168.56.11) to extract domain groups, user SIDs, and — critically — the domain password policy.
The password policy is especially useful for planning offline cracking and judicious password spraying — knowing the lockout threshold and minimum password length significantly informs our approach.
User Validation via Kerberos
Armed with a candidate user list (got_users.txt), we use an Nmap Kerberos enumeration script to confirm which accounts are valid without triggering lockouts. Kerberos returns different error codes for non-existent vs. existing users, making this a stealthy validation method.
Exploitation: AS-REP Roasting
Using Impacket's GetNPUsers.py, we request AS-REP tickets for all users in our validated list. Accounts with pre-authentication disabled will respond with a ticket we can take offline for cracking.
Offline Hash Cracking with Hashcat
With the captured AS-REP hash saved to hashes.asreproast, we move to offline cracking. Hashcat's mode 18200 targets Kerberos 5 AS-REP etype 23 hashes. Combined with the rockyou.txt wordlist, this is a fast and effective attack.
🎯 Conclusion & Key Takeaways
This engagement demonstrates how a chain of low-severity misconfigurations can collectively result in a critical compromise. Starting from zero credentials, we achieved a full domain user account takeover via:
1. Unauthenticated SMB/RPC null sessions leaking domain users and password policy
2. Kerberos pre-authentication disabled on a domain account (DONT_REQ_PREAUTH)
3. Weak password crackable offline with a standard wordlist
From this initial foothold, the next phase involves BloodHound enumeration to map privilege escalation paths, lateral movement across the forest, and ultimately achieving Domain Admin across all three GOAD domains.