Operation Dead Bolt

LOCKOUT · WINDOWS · difficulty 3 · ~25 min · 14 steps

The domain controller locked every admin out. Recover it from the boot up.

Briefing

The attacker disabled every Domain Admin account on DC01 and set their own logon script to run at every reboot. Nobody can log into the domain. A domain controller has a back door built for exactly this: Directory Services Restore Mode, a boot state with its own local administrator that exists outside Active Directory. You have console access through vCenter. This is a recovery, and it teaches how Windows authentication is layered.

Objectives

Return to the range lobby

THREAT FEED ▲ lateral movement via wmiexec up 18% ▲ new loader family 'GHOSTPULSE' staging via DLL search-order hijack ▲ prompt injection in support queues now routine ▲ cron persistence campaign targeting exposed SSH ▲ poisoned model weights on public hubs ▲ remember: trust nothing, hash everything ▲
operator@dojo:~$