A single Samba Active Directory Domain Controller for BRIGHTWELL.LAB (Brightwell University), no Windows VMs. Any authenticated user can read the directory over LDAP: a service account (svc-moodle, the Moodle LMS sync account) carries its own password in its description attribute, and a nested group chain (IT-Staff -> Registry-Admins) grants it the only path to a protected share. From the foothold user s.adeyemi, enumerate the directory with ldapsearch / nxc / BloodHound, recover the leaked credential, follow the nested group path, and read the flag from the registry share only Registry-Admins may open.
Not startedDockercommit 0eb4824x86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Opening guided steps or hints is recorded. A solve without them counts as stronger evidence for your skills.
From the s.adeyemi foothold, enumerate Active Directory over LDAP: recover svc-moodle's password from its description attribute, confirm the nested group path (IT-Staff -> Registry-Admins), then read flag.txt from the //dc/registry share that only Registry-Admins may open.
The brief for this lab lives in its repository.