InGen Corporation spared no expense — on dinosaurs. The single Domain Controller has AS-REP roastable accounts, a Kerberoastable service, and a Domain Admin with a password from the default provisioning list.

You've just landed a foothold on the internal network of Meridian Financial Group — a mid-sized firm that never got around to hardening their Active Directory. Broadcasts are leaking credentials, service accounts are roastable, and someone left the ACLs wide open. Chain it all the way to Domain Admin.

The classic TCM Security lab — HYDRA-DC, THEPUNISHER, SPIDERMAN. LLMNR broadcasts are flying, SQLService is waiting to be Kerberoasted and the IT admin hash sits in memory on every boot. A perfect companion to the Practical Ethical Hacking course.