auto/attack
← research

AutoAttack vs NodeZero's GOAD

Autonomous penetration testing on GOAD: we reran Horizon3 NodeZero's benchmark. 3/3 Domain Admin in a median of 51 seconds across 10 runs.

active-directorybenchmarkautonomous-adversary

TL;DR: 3/3 Domain Admin, median 0:51, 10 independent runs. Identical attack chain every run. Same GOAD environment spec NodeZero published.

Horizon3's NodeZero published their GOAD benchmark results in August 2025: 3/3 Domain Admin in 14 minutes. We reproduced their published AD hardening configuration and ran AutoAttack against it 10 times.

Environment

GOAD: two Active Directory forests, three domains, five machines, cross-domain trusts.

Each run: clean VM rollback, zero pre-configured credentials, zero environment knowledge, three-minute execution window.

The Attack Chain

~0:10
3 credentials in 10 seconds
AS-REP roast + LDAP description + SYSVOL script
~0:30
LSA secrets via remote registry
sql_svc password · castelblack
0:41
Cross-domain pivot + DCSync
ESSOS DA · meereen
0:45
Golden Ticket + ExtraSID
SEVENKINGDOMS DA · kingslanding
0:51
Parent-child DCSync
NORTH DA · winterfell

Same chain, same order, all 10 runs. The DA chain operates entirely through network protocols: Kerberos, LDAP, SMB, remote registry, and DRSUAPI. No files written to disk, no RAT deployment.

Credential Discovery. AS-REP roast captures brandon.stark (NORTH, no pre-authentication). Cracked in seconds. Authenticated LDAP recon finds samwell.tarly password in his description field. SYSVOL script on winterfell yields jeor.mormont password. 3 credentials, 3 misconfigurations, under 10 seconds.

Lateral Movement. jeor.mormont has local admin on castelblack. Direct SMB access, no MSSQL pivot needed.

Cross-Domain Pivot. LSA secrets dump on castelblack extracts the MSSQL service account password: NORTH\sql_svc. Same password exists in ESSOS. ESSOS\sql_svc is Domain Admin.

ESSOS DA (median 0:41). sql_svc authenticates to meereen DC. DCSync extracts krbtgt and the SEVENKINGDOMS trust key from the ESSOS TDO.

SEVENKINGDOMS DA (median 0:45). Golden Ticket with ExtraSID from ESSOS krbtgt + trust key. DCSync kingslanding extracts SEVENKINGDOMS\Administrator.

NORTH DA (median 0:51). Forest root admin replicates child domains. DCSync winterfell extracts all NORTH credentials.

Results

10 independent runs, fresh VM rollback each time.

Run ESSOS DA SEVENKINGDOMS DA NORTH DA
1 0:40 0:43 0:50
2 0:43 0:53 0:59
3 0:49 0:54 0:57
4 0:22 0:26 0:28
5 0:32 0:33 0:39
6 0:42 0:48 0:51
7 0:50 0:58 1:01
8 0:36 0:39 0:51
9 0:43 0:47 0:57
10 0:30 0:34 0:40

Median: 0:41 / 0:45 / 0:51.

ESSOS DA is the fastest path every run (sql_svc cross-domain pivot). SEVENKINGDOMS DA follows within seconds via cross-forest trust. NORTH DA last, through the forest parent-child relationship.

Why AutoAttack Is Faster

NodeZero's published run reached 3/3 Domain Admin in 14 minutes; AutoAttack's median is 0:51. The difference is chain length. One reused service-account password and two domain trusts link all three domains, so each falls from the one before it rather than being taken on its own. The whole forest goes down as one unbroken path instead of three separate escalations.

For the at-a-glance head-to-head, see AutoAttack vs NodeZero; for the same path walked step by step, see Active Directory takeover; for the broader practice behind it, see Active Directory penetration testing. See the full benchmark.

Run a free campaign against your network.

NodeZero's GOAD benchmark: Horizon3 blog.

← all research Deploy →