Designing an Isolated Active Directory Lab for Red Team Practice
· 54:07 · Watch on YouTube ↗
Summary
A presenter plans a vulnerable Active Directory lab with isolated networks, linked SQL servers, simulated phishing targets and centralized security monitoring. Firewall and VM deployment are planned for a later session.
Key points
- The proposed lab uses VMware workstation pro and a dedicated network separated from the presenter's main network.
- The design includes parent and child domains to practice cross-domain attacks, with linked SQL servers as a potential movement path.
- Planned targets include a vulnerable web application, client workstations and a separate web server for initial-access scenarios.
- The presenter proposes Elastic monitoring to observe activity across lab systems and a certificate authority for certificate-related exercises.
- A Nextcloud deployment could support file access and simulated MFA phishing; the presenter also considers disabling SMB signing in the lab to enable relay exercises.
- The architecture remains a plan: the presenter intends to configure the firewall and networking in a subsequent session.
Article Details
- Topics
- [01:05] Lab hardware, virtualization and resource planning
- [05:05] Network isolation and firewall selection
- [13:28] Parent and child domains for cross-domain exercises
- [20:03] Linked SQL servers and vulnerable initial-access systems
- [24:36] Relay and phishing simulation with client workstations
- [26:25] Centralized management, monitoring and certificate authority planning
- [36:07] Linux tooling and internal scanning scenarios
- [39:23] Nextcloud and MFA phishing simulation
- [47:27] Additional vulnerable web server and final resource budget
- [52:26] Planned firewall and network deployment