A single Samba Active Directory Domain Controller for LAKESIDE.LAB (Lakeside Regional Hospital, a healthcare provider), no Windows VMs. One legacy document-scanner service account (svc-scanner) has Kerberos pre-authentication disabled, so the KDC hands out an AS-REP encrypted with the account's key to anyone who asks, no credentials required. With only a username list, AS-REP roast svc-scanner, crack the hash offline, and read the flag from a share only svc-scanner may open.
Not startedDockercommit a1a6e23x86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Opening guided steps or hints is recorded. A solve without them counts as stronger evidence for your skills.
With only a username list, AS-REP roast the account whose Kerberos pre-authentication is disabled, crack its AS-REP hash offline to recover the password, then read flag.txt from the //dc/imaging share that only that account may open.
The brief for this lab lives in its repository.