NodeZero AI speedran the entire GOAD cyber range in just 14 minutes by exploiting Active Directory misconfigurations instead of CVEs. GOAD is Orange Cyberdefense’s deliberately vulnerable practice lab of five VMs spread over three domains in two forests. The autonomous system pulled off SMB null sessions, Kerberoasting, golden ticket generation, and AD CS exploitation to achieve full domain and forest compromise. Horizon3’s setup guide shows the lab was not left soft: every Windows host was fully patched with Defender enabled, and LLMNR poisoning was off the table. Skynet called: it wants its pentesting credentials back.
AI autonomously completes GOAD cyber range
··1 min