2ubZ3r0 · AD Labs

2ubZ3r0

Active Directory Lab Designer • Red Team Enthusiast • HackSmarter • Founder of R00tF0rce

Building realistic Active Directory penetration testing labs inspired by real-world enterprise environments.

Explore My Labs Play Frost Protocol

Westbridge Range BlackRiver Technologies

R00tF0rce on HTB ZeroTrace Research

❄️ FREEZE THE DOMAIN

$2ubZ3r0 profile image$

2ubZ3r0

About 2ubZ3r0

Hi, I'm 2ubZ3r0. Passionate about Active Directory security, red teaming, Windows internals and realistic attack simulations. I design hands-on penetration testing labs that teach modern AD attack paths, privilege escalation and enterprise compromise techniques without unrealistic CTF gimmicks.

HTBTHMHackSmarterActive DirectoryRed TeamingCTF

LinkedIn Buy Me A Coffee Jay Tiwari SecretMyth

              [ HACK THE BOX TEAM ]
            

R00tF0rce

Founder

I'm the Founder of the Hack The Box team R00tF0rce. Check out the team profile and follow our activity on HTB.

Open R00tF0rce

HackSmarter Challenge Labs

Hard

HSM Defense

RELEASED

Enterprise AD focused on privilege escalation, delegation abuse, advanced Kerberos attack paths.

KerberosSSH HoneypotRBCD

Medium

StellarComms

Satellite Operations / Space Tech

A realistic enterprise satellite operations environment where small pieces of public information become valuable attack vectors.

OSINTEXIFSMBBloodHoundWriteOwnerDCSync

Play on HackSmarter →

Medium

City Council

Municipal Government

An internal government network focused on realistic Active Directory misconfigurations. Phishing, DPAPI, Kerberoasting, IIS.

KerberoastingDPAPIIISOU DelegationJuicyPotato

Play on HackSmarter → Write-up →

Medium

ShadowGate 2

Cybersecurity Company

Exploit vulnerable dev infrastructure, abuse delegated AD rights, restore deleted users, escalate through AD CS.

SQLiNTLMMSSQLESC7AD CS

Play on HackSmarter → Write-up →

Medium

404 Bank

Financial Institution

Web apps, internal services, certificate infrastructure. BloodHound, password attacks, tunneling, AD CS abuse.

KerberoastingCeWLZIPChiselESC4

Play on HackSmarter →

Hard

North Stone

Healthcare / Enterprise

Complex healthcare AD with multiple paths: SQL injection into linked servers, AD CS, DLL hijacking, SYSTEM priv.

SQLiLinked SQLxp_dirtreeESC13DLL Hijack

Play on HackSmarter → Write-up →

Hard

NovaCart

Retail Enterprise

DNS abuse, NTLM relay, certificate attacks, advanced delegation. Realistic enterprise admin mistakes.

DNSAD CSNTLMKerberosRBCDWSL Linux

Play on HackSmarter → Write-up →

Hard

NovaForge

Manufacturing

Phishing entry, credential harvesting, Browser Extraction, BloodHound, NTLM reflection, Kerberos delegation.

PhishingBrowser ExtractionBloodHoundS4UWriteSPN

Play on HackSmarter → Write-up →

Featured HackSmarter Range

Hard

Westbridge University

7 Machine Active Directory Range

Westbridge University is a prestigious, well-funded academic institution that has spent the last year hardening its Active Directory infrastructure. Players are hired as internal penetration testers for a complete enterprise compromise assessment. Multi-subnet, trust relationships, modern AD, multiple attack paths.

Active DirectoryBloodHoundKerberos AD CSRBCDShadow Credentials MSSQLWinRMDCSyncLateral Movement

Play Westbridge Range Westbridge Write-up

Featured HackSmarter Range

Hard

BlackRiver Technologies

7 Machines · 3 Subnets · Active Directory Range

Take on a hard, seven-machine Active Directory range spanning three subnets. Explore a connected Windows and Linux environment, navigate corporate and branch networks, and put your enumeration, pivoting and cross-domain skills to the test.

WordPressHardActive DirectoryWindows & LinuxPivotingCross-Domain

Play BlackRiver Technologies

BlackRiver Technologies network topology

Upcoming Releases

Easy

Orion Corp

COMING SOON

Your first steps into a corporate Active Directory environment. Orion Corp is an easy, beginner-friendly Windows lab that rewards careful enumeration, curiosity and connecting the dots. Build confidence as you work toward taking control of the domain.

Beginner FriendlyActive DirectoryWindows

Medium

Hex Care

COMING SOON

Healthcare-themed AD lab featuring Windows administration mistakes, WSL Pivot to Windows, lateral movement, enterprise credential abuse.

WSL Pivot to WindowsNTLMv2 Hash StealDefault Creds

Hard

Avenford Intelligence

COMING SOON

A hard, eight-machine Active Directory range featuring a vulnerable LLM-powered machine. Explore three subnets, parent and child domains, and an external trust as you pivot through the environment.

8 Machines3 SubnetsActive DirectoryVulnerable LLMParent & Child DomainsExternal Trust

DOWNLOAD // PRACTICE LABS

Download Labs

Free and paid downloadable labs for hands-on practice with offensive security, Active Directory and CTF challenges. Pick up labs at very affordable prices in my Buy Me a Coffee Lab Shop—every purchase supports my work and helps me create more content. The shop exclusively offers previously unreleased labs that are not available on HackSmarter or other platforms.

Easy

PulpFiction

FREE

Windows Active Directory · Beginner CTF

Beginner-friendly Active Directory machine in a classic CTF style. Take it with humor and do not expect enterprise realism. Perfect for learning BloodHound, AD enumeration and common Windows attack paths.

Active Directory BloodHound Beginner CTF Style

Import the .OVA into VirtualBox or VMware. DHCP assigns the IP automatically. The archive includes the write-up and a Description file with the starting credentials.

Download PulpFiction

Easy

Hotel Mirage

FREE

Linux · Easy

Easy Linux lab available as a free download.

Linux Easy Free Lab

Download Hotel Mirage

Paid Lab

Redstone

Windows Active Directory · Single-Machine CTF

Redstone is a single-machine Windows Active Directory CTF lab with a Minecraft twist. Gain an initial foothold, uncover hidden services, and navigate AD misconfigurations to take control of the domain. A hands-on challenge combining service exploitation, Kerberos, and privilege escalation—capture both the user and root flags!

Active DirectoryKerberosPrivilege EscalationMinecraft

Buy Redstone

Paid Lab

StreamForge Media

Windows Active Directory · CTF Lab

Explore the infrastructure behind a media streaming company in this Windows Active Directory CTF lab. Gain an initial foothold, uncover exposed credentials, and follow a chain of misconfigurations to take control of the domain. Practice service exploitation and database enumeration.

Active DirectoryService ExploitationDatabase EnumerationExposed Credentials

Buy StreamForge Media

Paid Lab

Uni Phantom

Windows Active Directory · Easy CTF Lab

Explore a university’s Windows Active Directory environment in this beginner-friendly CTF lab. Discover exposed accounts, investigate student shares, and uncover clues hidden in university tools. Connect misconfigured permissions and Kerberos delegation to work your way toward domain compromise.

Active DirectoryGroup PermissionsKerberos DelegationExposed Credentials

Buy Uni Phantom

Paid Lab

Nexora

Windows Active Directory · CTF Lab

Explore the infrastructure of Nexora Systems, an enterprise IT company, in this Windows Active Directory CTF lab. Discover hidden web pages, investigate internal documents, and uncover credentials in forgotten backups. Follow a chain of misconfigured AD permissions, access internal services, and exploit React2Shell to advance toward domain compromise.

Active DirectoryAD PermissionsReact2ShellWeb Enumeration

Buy Nexora

Paid Lab

Our Great Leader 2

Windows Active Directory · CTF Lab

Practice SMB enumeration, DNS manipulation, shadow credentials, MSSQL enumeration, and the abuse of misconfigured AD permissions and Group Policies.

Active DirectoryShadow CredentialsMSSQLGroup Policies

Buy Our Great Leader 2

ZEROTRACE // RESEARCH ARCHIVE

ZeroTrace Research

Vulnerability research, CVEs, exploit analysis, payload research and offensive security notes.

9 Entries

Research

Customizing GodPotato for Improved Evasion

Renaming and modifying GodPotato to reduce obvious signatures and improve payload evasion.

Windows Privilege Escalation Tool Research Evasion

Open Write-up →

Research

Freeze Fud Payload

Building and obfuscating a custom payload with Freeze for cleaner AV evasion testing.

Evasion Payload Research

Open Write-up →

Research

Bypass AV with Metasploit

Using a custom loader and Metasploit payload workflow to test antivirus bypass techniques.

Metasploit Evasion

Open Write-up →

Research

Create Macro Payloads in Microsoft Word

Creating and embedding macro-based payloads in Microsoft Word for controlled phishing labs.

Microsoft Office Payload Research

Open Write-up →

Research

CVE-2026-54121 (Certighost)

Research and exploitation notes for Certighost, focusing on certificate trust abuse.

CVE Windows

Open Write-up →

Research

CVE-2025-33073

Technical notes on CVE-2025-33073, exploitation flow and privilege escalation impact.

CVE Windows

Open Write-up →

Research

CVE-2025-54918

Analysis of CVE-2025-54918 with a focus on exploitation and elevated system access.

CVE Security Research

Open Write-up →

Research

Reset Nightmare CVE-2026-27912

Research into Reset Nightmare, an Active Directory abuse path involving delegated account control.

CVE Security Research

Open Write-up →

Research

WP2Shell

Technical analysis of the WordPress WP2Shell exploit chain, proof-of-concept behavior, impact and mitigation guidance.

WordPress Exploit Analysis Web Security

Open Write-up →

Why These Labs?

Realistic Enterprise

Built from real-world internal penetration testing concepts.

Modern AD Attacks

Focus on current attack techniques used in enterprise environments.

Multiple Attack Paths

More than one valid compromise path exists in many labs.

Offensive Thinking

Enumeration matters more than guessing vulnerabilities.

Active DirectoryBloodHoundCertipyImpacketWinRM KerberosPowerShellMSSQLResponderChisel FirefoxIISSMB Active DirectoryBloodHoundCertipyImpacketWinRM KerberosPowerShellMSSQLResponderChisel FirefoxIISSMB

HTB // REPORTS

HTB Reports (Retired Machines)

Walkthroughs of retired Hack The Box machines.

7 Reports

Medium

AirTouch

Explore a segmented Linux network where wireless traffic and network services reveal the next lead. A hands-on journey through Wi-Fi security and internal network exploration.

LinuxSNMPWi-Fi SecurityNetwork Pivoting

Open Write-up →

Hard

Mirage

Investigate shared reports and a messaging service in a Windows domain. Connect infrastructure clues with authentication behavior across a layered Active Directory challenge.

WindowsActive DirectoryNFSMessagingKerberos

Open Write-up →

Insane

DarkCorp

Follow a webmail investigation into a mixed Linux and Windows corporate network. A longer challenge combining web analysis, internal exploration, and domain security.

Web SecurityLinux & WindowsNetwork PivotingActive Directory

Open Write-up →

Easy

Soulmate

Look beyond a dating website to discover its supporting services. Practice careful web enumeration and local service investigation in an approachable Linux challenge.

LinuxWeb EnumerationFile TransferService Analysis

Open Write-up →

Medium

Browsed

Explore a browser-extension testing platform and its developer tooling. Follow application behavior and source-code clues to understand how browser and system boundaries connect.

LinuxBrowser ExtensionsSource Code ReviewPython

Open Write-up →

Medium

Helix

Investigate a simulated industrial environment, from its web-facing data flows to internal control services. Documentation and maintenance workflows provide clues along the way.

LinuxApache NiFiIndustrial SystemsOPC UA

Open Write-up →

Insane

Hercules

A demanding Hack The Box challenge that combines deep enumeration, application analysis, and multi-stage privilege escalation across a complex environment.

HTBInsaneEnumerationPrivilege Escalation

Open Write-up →

Like the labs?

If you've enjoyed my HackSmarter labs and want to support future content, consider buying me a coffee.

Buy Me A Coffee Buy Me a Coffee Lab Shop LinkedIn HackSmarter R00tF0rce