# Ghost Protocol — Active Directory Audit (CTF challenge)

> ANALYSIS CHALLENGE (no live domain — real Kerberoast/DCSync can't run in the sandbox). A Domain Admin service account (svc_sql) was compromised.

Canonical: https://codelivly.com/ctf/challenges/ghost-protocol-ad-audit

| | |
|---|---|
| Category | Active Directory |
| Difficulty | Hard |
| Points | 2500 |
| Estimated time | 1 h |
| Type | Live instance |
| Solves | 17 |
| Author | Codelivly |

ANALYSIS CHALLENGE (no live domain — real Kerberoast/DCSync can't run in the sandbox). A Domain Admin service account (svc_sql) was compromised. Review the AD evidence — a GPP Groups.xml (MS14-025 cpassword), a Kerberoastable SPN, and an LDIF export — and recover the service-account secret where admins so often leak it: an AD attribute. Your own isolated instance; the secret is unique to you.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)