> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/vulnerable-lab-setup.md).

# Vulnerable Lab Setup

### Environment Setup

Use **VirtualBox** to install a Windows Server instance. Ensure the system meets the following requirements:

* Minimum 4 GB RAM (recommended 8 GB)
* At least 1 virtual CPU (2 or more preferred)
* Enable virtualization in BIOS

***

### Initial Configuration

#### Disable Windows Firewall (for lab simplicity)

Run the following PowerShell command to disable all firewall profiles:

```powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
```

***

### PowerShell Execution Policy

Allow script execution:

```powershell
powershell -nop -exec bypass
```

***

### Install AD DS Role

Install the Active Directory Domain Services and associated management tools:

```powershell
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
```

***

### Create a New Forest

Create a new AD forest using the following command (choose your domain name accordingly):

```powershell
Install-ADDSForest `
  -CreateDnsDelegation:$false `
  -DatabasePath "C:\Windows\NTDS" `
  -DomainMode "7" `
  -DomainName "enum.local" `
  -DomainNetbiosName "ENUM" `
  -ForestMode "7" `
  -InstallDns:$true `
  -LogPath "C:\Windows\NTDS" `
  -NoRebootOnCompletion:$false `
  -SysvolPath "C:\Windows\SYSVOL" `
  -Force:$true
```

> Example alternate domain: `infosec.local` with NetBIOS name `INFOSEC`

***

### Install Vulnerable AD Configuration

Clone the vulnerable-AD-plus repository:

```bash
git clone https://github.com/WaterExecution/vulnerable-AD-plus.git
```

Navigate into the folder and load the PowerShell module:

```powershell
Import-Module .\vulnadplus.ps1
```

Once imported, the module can be used to configure various misconfigurations and vulnerabilities for AD exploitation practice.