Most of what I wanted to practise — AD enumeration, relay attacks, pivoting — needs more than one machine. Renting cloud boxes works until you need SMB, LDAP, and broadcast traffic on the same segment, at which point you’re paying for a VPN and fighting the provider’s network filters.
So: local lab.
Host requirements
Nothing exotic. I ran this on a machine with 32 GB of RAM and a 1 TB NVMe drive. The numbers that actually matter:
- RAM — budget 2–4 GB per running VM. Two domain controllers plus a workstation is already 12 GB.
- Disk — use NVMe. Spinning disks make Windows Server installs genuinely painful.
- CPU — enable VT-x/AMD-V in firmware. Without nested paging the VMs crawl.
Network design
The single most important decision is keeping the lab isolated. I use two host-only adapters:
| Adapter | Subnet | Purpose |
|---|---|---|
vboxnet0 | 10.10.10.0/24 | Attack network — Kali + targets |
vboxnet1 | 10.10.20.0/24 | Second segment, for pivoting practice |
Host-only means no NAT to the outside world, so a misconfigured payload can’t reach my real network.
Provisioning the attacker VM
Kali is the path of least resistance. After install, set a static address so target configs stay valid:
sudo tee /etc/network/interfaces.d/lab <<'EOF'
auto eth1
iface eth1 inet static
address 10.10.10.50
netmask 255.255.255.0
EOF
sudo systemctl restart networking
Then a baseline update and the usual toolkit:
sudo apt update && sudo apt full-upgrade -y
sudo apt install -y bloodhound neo4j crackmapexec impacket-scripts \
responder nmap smbclient ldap-utils
Standing up Windows targets
Windows Server 2019 evaluation ISOs are free and good for 180 days. Two rules that save hours:
- Snapshot immediately after install and before promotion. You will break the domain eventually.
- Disable Windows Defender’s real-time protection on target VMs only. Leaving it on turns every tooling exercise into an EDR-evasion exercise, which is not what you’re practising yet.
Promote the first box to a new forest:
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName lab.local -InstallDns
Join a second server and a Windows 10 workstation to lab.local, then create a handful of users with deliberately sloppy group memberships. If everything is configured securely, there is nothing to find.
Snapshots and hygiene
Snapshot discipline is what makes a lab reusable:
clean-install— right after OS installdomain-ready— promoted and joinedvulnerable— the state you actually attack from
When an exercise goes sideways, revert to vulnerable instead of rebuilding. I keep a plain-text lab-notes.md with the IP map, credentials, and which snapshot belongs to which scenario.
Where to go next
With a working domain and an attacker box on the same segment, the natural first exercises are SPN enumeration and Kerberoasting — that’s the next post.