> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/ad-lab-built-with-purpose/setup-order.md). # Setup Order Each phase depends on the previous. Total build time: 12–15 hours across three sessions. Take a Proxmox snapshot after each phase expect to roll back at least once, usually during Phase 3 or 4. *** #### Phase 1 Proxmox VE on Both Hosts (60 min) Flash Proxmox VE 8.x to USB. Boot each machine, install bare-metal. Set management IPs: SYS-1 at 10.0.0.11, SYS-2 at 10.0.0.12. Create all four virtual bridges (vmbr0–vmbr3) on each host via System → Network in the web UI. **Common problem:** The Proxmox installer sometimes assigns the wrong network interface name if the machine has multiple NICs. Verify that vmbr0 is bound to the correct physical NIC in `/etc/network/interfaces` before proceeding. *** #### Phase 2 pfSense Router and VPN (75 min) Create pfSense VM on SYS-2: 512 MB RAM, 8 GB disk, 4 NICs on vmbr0–vmbr3. Run the pfSense setup wizard. Configure DNS resolver with conditional forwarders for each domain before the DCs exist. Apply firewall rules from the Networking section. **Common problem:** The pfSense DNS conditional forwarders for corp.local domains fail silently until the DCs are up on port 53. Cross-domain DNS will not work until Phase 3 is complete. *** #### Phase 3 Domain Controllers and Forest Trust (3–4 hrs) Create DC-USA VM (Win Server 2022 Core, 1.5 GB, 40 GB, vmbr1). Static IP 10.10.0.10. powershell ```powershell Install-ADDSForest -DomainName "usa.corp.local" -DomainNetbiosName "USA" ` -SafeModeAdministratorPassword $pass -Force ``` Repeat for DC-INDIA on vmbr2 as a separate new forest. Establish trust: ``` netdom trust usa.corp.local /domain:india.corp.local /twoway /add /passwordt:TrustSecret123 ``` Run user and OU creation scripts on each DC. **Common problems:** * Forest trust establishment frequently fails first attempt usually pfSense rule for TCP 135 not applied yet. Verify rule, retry. * Kerberos clock skew: DCs differing by more than 5 minutes causes silent trust auth failure. Sync both to the same NTP source before trust setup. * Cross-domain nslookup working from DC but not workstations: restart Unbound on pfSense to pick up the new DC address in the conditional forwarder. *** #### Phase 4 File Servers via LXC (90 min) Create Ubuntu 22.04 LXC containers on SYS-1 for FILE-USA (512 MB) and FILE-IND (256 MB). bash ```bash apt install -y samba winbind krb5-user realmd sssd-ad realm join usa.corp.local -U administrator ``` Configure department shares in `/etc/samba/smb.conf` with AD group ACLs. Seed IT$ with canary files. **Common problems:** * `realm join` fails with sssd-ad package error: install `sssd-ad` explicitly before running realm join. * User authenticates to share but cannot list files: check Unix permissions on the share directory Samba's `valid users` will authenticate successfully but return access denied at the file handle if underlying Unix permissions don't match. *** #### Phase 5 Windows Workstation Template and Clones (2–3 hrs) Build one Windows 10 LTSC base VM: install OS, Virtio drivers, Sysmon with SwiftOnSecurity config. Configure Defender with reduced real-time protection but not fully disabled leave behavioral detections and ScriptBlock logging active. Enable WinRM. Snapshot: `baseline-clean`. Clone seven times, set unique hostnames and static IPs, domain-join each. Snapshot: `domain-joined-clean`. **Common problems:** * Linked clones share the base disk modifying the template after cloning breaks all clones. Full clone and re-snapshot to update the template. * Domain join fails if DNS client still points to a DHCP-assigned address. Set DNS manually to 10.10.0.10 or 10.20.0.10 before domain join. *** #### Phase 6 Security Onion Detection Stack and Wazuh Agents (2–3 hrs) Create Security Onion VM: 4 GB RAM, 200 GB disk, two NICs (management at 10.0.0.50 on vmbr3, monitor NIC on SPAN bridge). Boot, run `sudo so-setup`, select Standalone/Eval. Verify Zeek is capturing Kerberos: bash ```bash tail -f /nsm/zeek/logs/current/kerberos.log ``` **Common problems:** * Elasticsearch dies during `so-setup` due to Java heap too high. Reduce to `-Xms1g -Xmx1g` in `/etc/elasticsearch/jvm.options` before restarting setup. * tc mirror rules need re-application after every host reboot. Write into a systemd unit. * Wazuh agents for workstations offline at GPO application time won't install. Run `gpupdate /force` on each workstation after boot. *** #### Phase 7 Kali Attack Platform and Toolchain (60 min) Create Kali VM on SYS-2, vmbr3, static IP 10.0.0.99. bash ```bash apt install -y bloodhound neo4j crackmapexec impacket-scripts hashcat golang git clone https://github.com/HavocFramework/Havoc && cd Havoc && make ``` Start neo4j, configure BloodHound. Snapshot: `kali-clean`. Restore between scenarios to prevent artifact contamination. *** #### Phase 8 Validation and Baseline Snapshot (60 min) bash ```bash nmap -sV -sC 10.10.0.0/24 ``` All USA hosts should be visible with correct service fingerprints. Run a BloodHound collection, confirm the intended DA path appears in the graph. Verify Security Onion alerts on the Nmap scan. Confirm `kerberos.log` is capturing authentication events. Take full Proxmox snapshots of every VM labeled `pre-attack-baseline`. Restore to this checkpoint before each scenario run. **Lab is ready.** *** ### Honest Closing Notes CorpSim is a constrained-resource identity attack and detection validation lab for multi-domain Active Directory environments. That description is precise, and I want to hold to it rather than let scope drift toward claims it cannot support. **What it actually teaches:** * How Kerberos authentication traverses AD trust boundaries and where SID filtering changes the outcome * What DACL-based privilege escalation paths look like in BloodHound and in the event log * How to correlate Zeek network metadata with Sysmon and Windows Security events for the same attack * What the actual event fields and values look like for DCSync, Kerberoasting, PtH, and LSASS access not the blog-post summary, the real telemetry **What it does not cover, and why that matters:** * EDR evasion against commercial products (without real EDR, process lineage, AMSI behavior, and memory scanning telemetry all differ from production) * Cloud identity attack paths (Entra ID, OAuth, hybrid sync a pure on-prem lab in 2026 covers one segment of the identity attack surface) * Operational friction of a real engagement (dead pivots, stale credentials, blocked paths, inconsistent MFA enrollment) * The accumulated configuration entropy of an environment running for a decade The detection timings here are useful for confirming detection logic fires not for benchmarking SOC response capability. A 4 GB Security Onion under load introduces indexing lag. Use this stack for logic validation, not performance measurement. The setup will have problems. The networking will have problems. The first BloodHound collection will probably fail. That troubleshooting is part of the lab. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://blog.r00t-hunter.com/ad-lab-built-with-purpose/setup-order.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.