1. Enumerate the network to identify live hosts and potential targets (excluding 192.168.56.1 and 192.168.56.107)
1.1. [Completed] Live hosts discovered: 192.168.56.10 (domain controller), 192.168.56.11, 192.168.56.12 (domain controller), 192.168.56.22, 192.168.56.23, 
192.168.56.100
1.2. [Completed] Performed port scanning on discovered hosts:
1.2.1. 192.168.56.10 appears to be a primary domain controller for sevenkingdoms.local0
1.2.2. 192.168.56.11 also shows Active Directory services for sevenkingdoms.local0
1.2.3. 192.168.56.12 is a domain controller for essos.local
1.2.4. 192.168.56.22 / 192.168.56.23 have Windows SMB and RDP services open
1.2.5. 192.168.56.100 has all relevant ports filtered

2. Enumerate Active Directory to gather user account and group information
2.1. Attempt to query 192.168.56.10 and 192.168.56.11 (sevenkingdoms.local0)
2.1.1. [Completed] Attempted unauthenticated LDAP search on 192.168.56.10 and 192.168.56.11 – resulted in Operations error
2.1.2. [Finding] Authentication (bind) is required for successful queries
2.1.3. [Completed] Attempt domain bind on 192.168.56.10 and 192.168.56.11 using user1,user2,user3:Password123!
2.1.3.1. [Finding] Credentials user1,user2,user3:Password123! are invalid for sevenkingdoms.local0
2.2. Attempt to query 192.168.56.12 (essos.local) for domain users, groups, and policies (pending valid credentials)
2.2.1. [Completed] Attempt domain bind on 192.168.56.12 using user1,user2,user3:Password123!
2.2.1.1. [Finding] All tested credentials invalid; next step: password-spraying

3. Attempt credential gathering to get valid domain accounts
3.1. [Completed] Enumerate SMB shares on discovered hosts (using netexec) for exposed credentials
3.2. [Completed] Attempt password-based authentication with discovered users (using netexec) on 192.168.56.10, .11, .12, .22, and .23
3.2.1. [Finding] Credentials user1,user2,user3:Password123! have guest access on 192.168.56.22 (north.sevenkingdoms.local) and 192.168.56.23 (essos.local)
3.3. Enumerate and explore shares on 192.168.56.22 and 192.168.56.23 using the guest credentials
3.3.1. [Finding] On 192.168.56.22, discovered file arya.txt in the "all" share (accessible). The "public" share returned Access Denied.
3.3.2. [Finding] On 192.168.56.23, the "all" share is accessible but contains no files; "public" share returned Access Denied.
3.3.3. [Completed] Downloaded arya.txt from 192.168.56.22 "all" share using guest credentials
3.3.4. [Completed] Examined the contents of arya.txt – no useful credentials found
3.3.5. [Not applicable] No new credentials to test
3.4. [Completed] Attempt password-spray with "Welcome1!" for user1,user2,user3 on 192.168.56.10/11/12 for both sevenkingdoms.local and essos.local – all 
failed
3.5. [Completed] Attempt additional password-spraying with other common passwords (e.g., "P@ssw0rd", "Password1") for user1,user2,user3 on 192.168.56.10, 
.11, .12 – no valid credentials discovered
3.6. [Completed – no success] Attempt discovery of additional user accounts beyond user1,user2,user3 by enumerating domain controllers (via SMB or LDAP)
3.6.1. [Finding] Attempted unauthenticated or guest-based SMB enumeration on lower IP addresses – hosts were unreachable
3.7. [Completed] Attempt RID enumeration against domain controllers (192.168.56.10, .11, .12) using netexec
3.7.1. [Finding] STATUS_ACCESS_DENIED errors – no additional user accounts discovered
3.8. If no new users discovered, consider attempting default or well-known user names (e.g., Administrator) with further password-spraying employing netexec
3.8.1. [Completed] Attempted password-spraying "Administrator" with "Password123" on 192.168.56.10, .11, and .12 – all failed with STATUS_LOGON_FAILURE
3.8.2. [Completed] Attempted password-spraying "Administrator" with other common password variants ("Welcome1!", "P@ssw0rd", "Password1") on 192.168.56.10, 
.11, and .12 – all returned STATUS_LOGON_FAILURE
3.9. [Attempted] Explore additional methods to discover new accounts or capture credentials (e.g., offline domain attacks such as AS-REP Roasting or LLMNR 
poisoning): No success so far
3.9.1. [Finding] Enumerated local users on 192.168.56.11: arya.stark, sansa.stark, brandon.stark, rickon.stark, hodor, jon.snow, samwell.tarly (Password : 
Heartsbane?), jeor.mormont, sql_svc
3.9.2. [Finding] impacket-GetNPUsers attempts to connect to 192.168.56.100 on port 88 failed (connection error). 192.168.56.100 may not be the correct DC for
north.sevenkingdoms.local
3.9.3. [Finding] Error using "responder -I eth0 -rdw" – incorrect flags used
3.10. Attempt password-spraying with newly discovered users (arya.stark, sansa.stark, etc.) on domain north.sevenkingdoms.local.
3.10.1. Specifically test user "samwell.tarly" with password "Heartsbane" (based on clue from the description)
3.11. Re-attempt AS-REP Roasting with correct DC IP (e.g., 192.168.56.11) for domain north.sevenkingdoms.local and the newly discovered user list
3.12. Re-run Responder with correct flags (e.g., responder -I eth0 -w -d) to attempt LLMNR poisoning

4. Perform lateral movement across identified hosts in the 192.168.56.0/24 range
4.1. [Completed] Checked for SMB/OS vulnerabilities on 192.168.56.22 and 192.168.56.23 – no exploitable issues found
4.2. Attempt alternative lateral movement or local privilege escalation if any new domain credentials are obtained (e.g., pass-the-hash, pass-the-ticket)

5. Escalate privileges to obtain Domain Administrator permissions
5.1. Attempt known domain attacks (Kerberoasting, AS-REP Roasting, etc.) if valid domain credentials are discovered
5.2. If local or domain admin access is attained on any system, gather credentials (memory dumps, config files) to proceed toward Domain Admin

