Part 5: Hacking Lumon Industries (Active Directory)
Source: YouTube · Tyler Ramsbey - Hack Smarter · published Aug 28, 2026 · 30:08
In part five of the Lumen Industries AD lab on HackSmarter, the presenter pivots from the compromised internet server to full domain admin and completes the lab by retrieving the root flag 0:00.
Key Takeaways:
• NetExec with --local-auth authenticates as the compromised local admin, but SAM/LSA dumping initially fails 4:44
• After RDPing in and disabling Defender, Mimikatz is used to dump LSA secrets 10:48
• Key lesson: Remote UAC blocks the custom local admin but not the built-in RID 500 Administrator—pass-the-hash with that account enables remote SAM/LSA dumping 17:12
• LSA dumping reveals DCC2 cached credentials for Helly E (domain admin); cracked in the lab with Hashcat mode 21000 and rockyou, though computationally expensive in the real world 19:21
• With domain admin confirmed via NetExec's Pwn3d output, the root flag is retrieved from the administrator's desktop using plain smbclient—a native tool that avoids AV/EDR detection 24:32
The lab is officially completed and certified, closing the five-part Lumen Industries series. The presenter encourages viewers to launch the lab and hack alongside rather than just watch 28:42.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What is up everyone? Welcome back to another video. This is part five of working through the Lumen Industries lab on Hacksmarter. This is a multi-machine active directory lab and I do want to emphasize this is part five. If this is the first video that you are watching, you are going to feel lost. I would suggest going to part one and not only watching the videos. You will learn a lot by watching, but you'll learn even more by hacking alongside of me. So, enroll in Hacksmart if you haven't. Launch Lumen Industries and hack right alongside of me. You will also see that there is chat on the screen. I make these videos while I live stream. I live stream all the time. There are right now almost 70 people in the live studio audience across YouTube, LinkedIn, and Twitch, but you are missing. So,…