Deploying GOAD-Light with Ludus

What GOAD-Light is

GOAD (Game Of Active Directory) is a vulnerable AD lab by Orange Cyberdefense. The Light variant is 3 Windows Server 2019 machines and is the one that fits on a home server.

• kingslanding → domain controller for sevenkingdoms.local
• winterfell → domain controller for north.sevenkingdoms.local
• castelblack → member server of north with IIS and SQL Server

GOAD does not give you starting credentials. You practise it as a black box: discover hosts, enumerate and move forward. The details of each lab are in its documentation.

Cloning GOAD

On the Proxmox host, on the disk with space:

$ cd /mnt/pve/<big-disk>$ git clone https://github.com/Orange-Cyberdefense/GOAD.git$ cd GOAD

Check and deploy

First check that the environment meets the requirements (Python and Ansible dependencies, space, templates).

$ ./goad.sh -t check -l GOAD-Light -p ludus

Then install. GOAD creates a user and a range in Ludus and identifies them with an instance ID.

$ ./goad.sh -t install -l GOAD-Light -p ludus

When it does, GOAD creates in Ludus a dedicated user for that lab, named GOADLight plus a random suffix (for example GOADLight383ff8), and puts the range there. In the rest of the guide it appears as <range-user>. It is different from the Ludus admin created during installation. You can see yours with:

ludus users list

Commands that touch the lab (range configuration, deployments, WireGuard) are run with --user <range-user>.

The process has two phases:

• Ludus creates the router and the three VMs, assigns their IPs and gets them ready (Sysprep, reboots, WinRM). You will see the IPs 10.2.10.10, .11 and .22
• GOAD runs its Ansible playbooks: parent domain, child domain, users, groups, ADCS, ACLs and the vulnerable configuration of each server

It takes hours on a modest CPU. There are long stretches with no output and a 5-minute pause that the playbook itself adds so AD can replicate.

Keeping the SSH session from dropping

If you launch it over SSH and the session drops, Ansible dies with it and provisioning is left half done. Run it in the background with a log:

nohup env PYTHONUNBUFFERED=1 ./goad.sh -t install -i <instance-ID> -p ludus -a true \  > goad-provision.log 2>&1 < /dev/null &tail -f goad-provision.log

<instance-ID> is the name GOAD uses to identify your lab. It is created when the installation starts and looks like <suffix>-goad-light-ludus, for example 383ff8-goad-light-ludus. The suffix is the same one the Ludus user has (GOADLight383ff8). Write it down when you start.

With -i you resume the same instance without creating a duplicate lab. To check the status:

$ ./goad.sh -t status -i <instance-ID> -p ludus

Checking the result

At the end, the Ansible summary should show failed=0 on dc01, dc02 and srv02. The failures I hit (SQL Server, SSMS) are in Problems and fixes.