Part 4: Hacking Lumon Industries (Active Directory)

Part 4: Hacking Lumon Industries (Active Directory)

Source: YouTube · Tyler Ramsbey - Hack Smarter · published Aug 25, 2026 · 21:45

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video shows how to escalate privileges in the Lumen Industries AD lab by using BloodHound to find high-value targets and NetExec to retrieve LAPS credentials, achieving full RDP and SMB access to the internet server 2:03.

Key Takeaways:
• BloodHound reveals the compromised "internet service" user has Force Change Password rights over several domain users 4:00
• Mark S and Peter K are identified as high-value targets due to membership in the LAPS Admins group 6:50
• Using net rpc password, the presenter changes Mark S's password and authenticates as that user 10:00
• NetExec with --laps retrieves the internet server's local admin password, which LAPS rotates automatically 13:50
• The presenter gains RDP access via Remmina and captures the first flag on Mark S's desktop 17:50

The video closes by challenging viewers to independently perform post-exploitation and find a path to the domain controller, stressing that getting stuck is essential to learning 21:18.

Sources:

  • 2:03 Intro to BloodHound enumeration
  • 4:00 Force Change Password permissions found
  • 6:50 LAPS Admins group targets identified
  • 10:00 Password change via net rpc
  • 13:50 LAPS password retrieved with NetExec
  • 17:50 RDP access and first flag
  • 21:18 Closing challenge to viewers

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What is up everyone? Welcome back to another video. This is part four of working through the Lumen Industries Active Directory lab from the Hack Smarter platform. Now, you're going to learn a lot by watching this video, but you'll learn even more by hacking alongside of me. So, if you haven't already, make sure you launch Lumen Industries, get your hands on your keyboard, and hack all of the things. Also, you will notice that there is a live chat on the screen. I make these videos while I live stream. I live stream all the time, and you should be part of the live studio audience next time. So, make sure you subscribe, hit the bell notification, so that you are notified the next time I am live. Hey Demograss, I complete one lab at your site. I liked it about the credits for free if I use a …