A single Samba Active Directory Domain Controller for NORTH.SEVENKINGDOMS.LOCAL, no Windows VMs. The low-privilege foothold user hodor holds a dangerous GenericAll access-control entry over the higher-value account maester.luwin, which guards an archive share. Full control over a user object includes the right to reset its password without the old one: find the control edge, reset maester.luwin's password, authenticate as maester.luwin, and read the flag from a share hodor cannot open.
Not startedDockercommit c496e23x86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Opening guided steps or hints is recorded. A solve without them counts as stronger evidence for your skills.
From the hodor foothold, find the GenericAll control edge over maester.luwin, abuse it to reset maester.luwin's password (no old password needed), then authenticate as maester.luwin and read flag.txt from the //dc/archive share that only maester.luwin may open.
The brief for this lab lives in its repository.