https://wearethebug.dev/categories/chains/Recent content on WE ARE THE BUGTradecraften-usSat, 08 Nov 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-calipendula/Sat, 08 Nov 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-calipendula/Calipendula is a hybrid GCP and Active Directory breach scenario, pushing you through cloud IAM enumeration, service account chaining, RBCD relay attacks, multi-hop tunnelling in a segmented network.https://wearethebug.dev/posts/ertlabs-chains/Sat, 30 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-chains/4 Chains which consist of 2-3 machines that are meant to be exploited together.https://wearethebug.dev/posts/ertlabs-mailservice/Fri, 29 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-mailservice/MailService is a multi-stage internal penetration test scenario that required chaining several techniques across both Linux and Windows domains.https://wearethebug.dev/posts/ertlabs-ifix-tcen-tcen/Sat, 09 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-ifix-tcen-tcen/Ifix-Tcen-Tcen is a famous Italian onomatopoeia and cultural reference originating from the erotic *fotoromanzi* (photo-novels) of the 1970s and 1980s. In our case it's a multi-stage internal penetration test scenario focus on Active Directory.https://wearethebug.dev/posts/vl-chains/Thu, 27 Feb 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-chains/17 Chains which consist of 2-3 machines that are meant to be exploited together.https://wearethebug.dev/posts/vl-mythical/Wed, 06 Nov 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-mythical/Mythical is a Medium-rated small active directory chain on Vulnlab in which we start with an already running Mythic C2 beacon on an internal system. It is designed to practice operating through a C2 framework in a modern, challenging windows environment.https://wearethebug.dev/posts/vl-puppet/Tue, 22 Oct 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-puppet/Puppet is a Medium-rated small active directory chain in which you start with an already running Sliver C2 beacon on an internal system. It is designed to practice operating through a C2 framework in a modern, challenging hybrid environment.https://wearethebug.dev/posts/vl-heron/Thu, 13 Jun 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-heron/Heron is a medium-difficulty chain hosted on Vulnlab, featuring an assumed breach from a domain-joined linux jump server access to domain controller. Starting with an enumeration of the internal website for domain users and performing AS-REP roasting, decrypting GPP password from the sysvol share, leading to smb share having write access to web.config, gaining a shell by using AspNetCoreModule for executing powershell commands which lead to finding linux admin’s credentials, reusing the same password that will lead to another user which has WriteAccountRestrictions on dc that leads to resource based delegationhttps://wearethebug.dev/posts/vl-klendathu/Fri, 24 May 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-klendathu/Klendathu is an Insane difficulty chain hosted on Vulnlab, involved coercion with an undocumented function/procedure on MSSQL, forging a silver ticket, spoofing domain users on linux with GSSAPI authentication, and decrypting RDCMan credentials with domain backup keys.https://wearethebug.dev/posts/vl-unintended/Thu, 25 Apr 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-unintended/Unintended is an Medium chain that provides a hands-on experience with common missteps in Active Directory deployments, demonstrating how attackers can pivot between services to escalate privileges. It blends Linux privilege escalation techniques with Active Directory attack paths, making it a valuable practice ground for both offensive and defensive security practitioners.https://wearethebug.dev/posts/vl-vigilant/Mon, 15 Apr 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-vigilant/Vigilant is a Hard hybrid Active Directory chain. The environment consists of a domain-joined Linux system and a Windows Domain Controller, presenting a realistic enterprise attack surface. It designed to evaluate penetration testing capabilities in hybrid Windows-Linux environments. Participants begin with zero initial access and must systematically escalate privileges to achieve Domain Administrator-level compromise.https://wearethebug.dev/posts/vl-tengu/Thu, 28 Mar 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-tengu/Tengu is a medium-rated chained machine on VulnLab, features a mixed environment with two Windows hosts and one Linux host. Exploiting Node-RED on Linux (with MSSQL) grants command execution, decrypts service passwords, and pivots to dump NTLM hash. Constrained delegation allows impersonating MSSQL admin for local admin access then recover Domain Admin credentials via DPAPI and Kerberos to compromise the Domain Controller (DC).https://wearethebug.dev/posts/vl-kaiju/Fri, 02 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-kaiju/Kaiju is a Hard-rated Active Directory chain, from initial reconnaissance to full domain compromise, covering FileZilla exploitation, KeePass database extraction, NTLM relay attacks, and ADCS abuse (ESC8).https://wearethebug.dev/posts/vl-tea/Fri, 05 Jan 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-tea/Tea is a medium-rate small Active Directory chain that provides hands-on experience with common Active Directory and DevOps vulnerabilities and misconfigurations, demonstrating how attackers can pivot between services and retrieve sensitive data to move laterally and escalate privileges.https://wearethebug.dev/posts/vl-sidecar/Fri, 15 Dec 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-sidecar/Sidecar is a Hard-rated small Active Directory chain that contains 2 Windows machines, however, attacks are not for beginners on Active Directory Pentesting. From initial enumeration through to full domain compromise, including Shell via a .lnk file, NTLM relay, WebDAV coercion, Shadow Credentials, PKINIT abuse, and a Silver Ticket attack.https://wearethebug.dev/posts/vl-push/Fri, 22 Sep 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-push/Push is a Hard-rated small Windows Active Directory chain featuring a one domain controller and one member server. This chain focuses on advanced attack techniques including ClickOnce application exploitation, SCCM coercion, and ADCS exploitation via Golden Certificate attacks.https://wearethebug.dev/posts/vl-control/Fri, 21 Jul 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-control/Control is a Hard-rated chains focus on a small multi-host Linux environment that simulates a realistic internal network and endpoint-management infrastructure. The lab contains two primary hosts (os.control.vl and intra.control.vl) and a variety of services (web apps, OSCTRL/osquery, SSH, nginx, Docker) that chain together to a full domain compromise. It focuses on exploiting web applications, abusing management tooling (OSCTRL / osquery), and leveraging operational misconfigurations to move from an initial foothold to full root on multiple hosts.https://wearethebug.dev/posts/vl-hybrid/Thu, 22 Jun 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-hybrid/Hybrid is an Easy-rated, simplified Active Directory chain with 2 servers MAIL01 (Roundcube webmail) and DC01. Exploited a vulnerable Roundcube plugin via a crafted email, escalated privileges via NFS, and abused AD CS with certipy to achieve Domain Admin.https://wearethebug.dev/posts/vl-reflection/Sat, 10 Jun 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-reflection/Reflection is a medium-difficulty Active Directory chain that simulates a vulnerable enterprise environment and challenges users to progress from limited access to Domain Administrator. Including 3 machines, with anonymous SMB bind abuse, MSSQL abuse, NTLM relay attacks, Windows Credential Vault harvesting, Resource-Based Constrained Delegation (RBCD), and finally credential reuse.https://wearethebug.dev/posts/vl-trusted/Tue, 20 Sep 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-trusted/Trusted is an Easy small Active Directory chain involving two domain controllers (labdc.lab.trusted.vl and trusteddc.trusted.vl) that focuses on web vulnerabilities, local privilege escalation, and cross-domain trust abuse. An internal network access is provided with no credentials, and the goal is to assess the security posture of the AD environment.https://wearethebug.dev/posts/vl-intercept/Sat, 25 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-intercept/Intercept is a small Active Directory scenario rated as Hard that provides hands-on experience with common Active Directory vulnerabilities and misconfigurations, demonstrating relay attacks and authentication coercion attacks can be used to get access to the domain.https://wearethebug.dev/posts/vl-lustrous/Sat, 25 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-lustrous/Lustrous is a Hard-rated chain consisting of 2 machines on vulnlab. Cevering AS-REP roasts, Kerberoasts, the main lesson on this chain is to demonstrate how silver tickets can be used with service accounts in a Active Directory environment.