Procedure · Beginner → Intermediate
Enumerating AVENGERS.LOCAL
Domain and forest recon, privileged path hunting, and trust mapping — the same workflow you would use against a real enterprise forest. MCU principal names are there so you can track users and locations without inventing throwaway identities.
Objectives
What you practice here.
- Perform domain and forest enumeration
- Map trust relationships across partner domains
- Identify privileged and weak service accounts
- Connect directory findings to hardening recommendations
Toolkit
Tools in the student box.
- PowerView / SharpView
- BloodHound
- CrackMapExec
- enum4linux-ng
- ldapsearch
- Kerbrute
Procedure
Step-by-step enumeration.
Expand each phase. Commands are representative PowerView / BloodHound workflows against the lab forest — not a live public target.
Establish domain and forest context before hunting principals.
Get-NetDomain
Get-NetForestExpected findings
What should turn up.
- Multiple domains with uneven trust posture
- High-profile accounts with excessive rights
- Service accounts with SPNs and weak protection
- Group nesting that creates privilege escalation paths
Hardening
Close the paths you found.
- Tiered administration (Tier 0 / 1 / 2)
- Remove unnecessary user SPNs
- Protected Users + authentication policies
- Just Enough Administration (JEA)
- Regular BloodHound reviews
Lab questions
Confirm you understand the forest.
- Which principal carries the most dangerous privileges?
- Can you move from AVENGERS.LOCAL into SHIELD.GOV?
- Where does group nesting create an unintended escalation path?