A single Samba Active Directory Domain Controller for SUMMIT.LAB (Summit Retail Group, a retail chain), no Windows VMs. Account lockout is disabled and a roster of store-staff domain users is seeded; every password is policy-compliant, but exactly one account (k.verma, a store manager) still uses the weak onboarding default while the rest are strong and random. Spray a short list of common candidate passwords across the roster, find the single account that authenticates, and use it to read the flag from a share only that account may open.
Not startedDockercommit 40d3053x86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Opening guided steps or hints is recorded. A solve without them counts as stronger evidence for your skills.
Spray a short list of common candidate passwords across the domain user roster, find the single account that authenticates (the one reusing the weak onboarding default), then read flag.txt from the //dc/storeops share that only that account may open.
The brief for this lab lives in its repository.